{ "Event": { "published": true, "date": "2023-05-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-14", "timestamp": 1684108981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6f613305-51fd-4504-872d-44ed2fce7719", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0eaec8d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089179, "uuid": "e8679f27-709e-44cb-b4d7-b43999c83319", "comment": "Malware payload", "value": "f0884429290c27b47173d916b5cdd77a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089179, "uuid": "aedb9c2a-2d97-4dfe-a48b-29bed0002257", "comment": "Malware payload", "value": "0010b0703863cb44f882616a81633a77d5fa3e279a4d531129096e52b39a5694", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089179, "uuid": "412c0631-3d9a-47c7-96f7-65359a3aebb4", "comment": "Malware payload", "value": "7e76417d2e0c5e3a049af81b393c351ec4b06dfe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089179, "uuid": "63e7ed25-73eb-4b9a-b703-375740da9ebf", "comment": "Malware payload", "value": "249b2cc3ed09f5373ed90aaabdc1be6509d7576bb0b76580668cc5ebc81e4dab121903a0f7b14d9b00e7b7b57959c29d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089179, "uuid": "cb04aaf7-bcc6-4c39-bc8b-cb7549e20300", "value": "T18BE512813DA4FDA3FE0614704BEF9FF366B2FD362A4448179AC964DB416DB687022067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089179, "uuid": "bf6a7006-4e5c-4ec5-9654-a1e26ac108c1", "value": "4ecfbe6e42943fae92c4582752c63b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089179, "uuid": "45a28baa-af99-4db3-b70b-f54e6e496127", "value": "49152:bteJvjS524HXE7S8K6tulvfEIfdS5JTVtC/r/HS/DJ0HbmFSx+KT+cW5MSqde70k:xek20EkvlnEIQ9tcrvS/OHhkKqcJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089179, "uuid": "7923334f-787b-49eb-a8cc-db57c82ae636", "value": 3311616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089179, "uuid": "9735c68b-dffb-47e4-88fd-d778d26a1cc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089179, "uuid": "b3b7862c-7d09-4a5b-b60c-04c3de666780", "value": "Clip1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbb929a-f271-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684080692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080692, "uuid": "7f3361ae-8fcc-416a-9e62-520bc1b57d4d", "comment": "Malware payload", "value": "0c38fab30ba28ad85d943150a5a3b2b2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080692, "uuid": "3291da79-582b-4fea-9ac8-0f2a3a8039c9", "comment": "Malware payload", "value": "0089970739fad5ebc14ec26b78eba1752eb41491992a35ae0763c73b718d5660", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080692, "uuid": "56e96493-a140-40e7-88c3-63c7513b41b4", "comment": "Malware payload", "value": "3865358f0025a56d045754d3109ce9125e2d3dda", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080692, "uuid": "5a58fc22-c35c-4e02-b690-b0b79066e013", "comment": "Malware payload", "value": "032a0c293239810c75de06215d08950a8b538a964a29127bf07409d7eebf46e75f5d39498c6e1f32b81160812f170a8f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080692, "uuid": "83e2ae36-0467-40b3-a880-5531087e5146", "value": "T1E9444165609AC8DEFE5ADB40B1B8FFA161F1B1B355C81A2013786104CFE9F962F8D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080692, "uuid": "5c9ea285-8fa7-480b-a937-22bd8cd0c9b9", "value": "6144:PhMHd8wF9VtLr3EXGpI5cGIE+QIqSNlwBauIM/eT315Z3Apv:eHt9VtLr3EXGpI5cGILgBauJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684080692, "uuid": "6f3417ae-853f-4e5e-a88d-33e1ff3ed1a2", "value": 262788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684080692, "uuid": "f6954688-91d1-43b1-b3dd-a2a47c78b9ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080692, "uuid": "ff227fa2-e14c-4689-bbde-2945e742241b", "value": "ib.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab7d9d8-f269-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684076928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684076928, "uuid": "ae765d76-3a92-4c36-b83b-e3e79d7ef051", "comment": "Malware payload (RedLineStealer)", "value": "c00d42f5f8eef3a7e139ae88b45229ff", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684076928, "uuid": "8897c098-7749-4146-8ea5-15c87c4d32be", "comment": "Malware payload (RedLineStealer)", "value": "01f957ac4729f5b08f3bee2bd059b7c81a12558e468bdecc98d6ea0e11940843", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684076928, "uuid": "5560e3b7-8b02-4177-be94-43d71767973c", "comment": "Malware payload (RedLineStealer)", "value": "dbfb4642c076a69ff70c70fd93055f72eea400d4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684076928, "uuid": "85faa684-355f-4dfd-baff-095ca589b668", "comment": "Malware payload (RedLineStealer)", "value": "a00c14e597ba291ccfbdc4a7f62e5403aa21cb57d85d68e1777e4984c7b4d0ccbffd3a61f0d4fa78d0da951aab60c4da", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684076928, "uuid": "7ea6c3ba-d341-4cd1-8220-0d7d11a79488", "value": "T1DD45235227E86121E9F1177449F603DB0C38FEA17D3887EE22A9688C3D32A54E176777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684076928, "uuid": "6be2df54-241d-4089-b429-d7a31f8ae25c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684076928, "uuid": "840a680f-df94-43e6-8b63-4f67f13ea895", "value": "24576:FyehryFhXskEUzMKpuWt0yihH0LjCgwduLKUeQkAAlr0/1:gehOFFEUIKIWt0yYHBDWetlrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684076928, "uuid": "de3f45ba-ee23-4a37-98d0-f9d219e30a16", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684076928, "uuid": "7761ca02-6760-4940-a257-e420ba5a4d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684076928, "uuid": "cad83126-8362-4fb4-9498-352d8863da0c", "value": "01f957ac4729f5b08f3bee2bd059b7c81a12558e468bdecc98d6ea0e11940843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48869df6-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032713, "uuid": "6c5d6e0a-4c93-477a-a8ba-32f4e4a93521", "comment": "Malware payload (Mirai)", "value": "aa2d7fd4434d7eb7fef22a9774d9edd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032713, "uuid": "7577d353-587d-4960-b1e5-2f84b7de0e83", "comment": "Malware payload (Mirai)", "value": "036221cf21cddf10159d08fcf4856f8a92e1cfef60dcd88cc7c8f86666c49861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032713, "uuid": "b2e5511f-d557-4aea-8c2a-46d1601f8f36", "comment": "Malware payload (Mirai)", "value": "8f71a001947574b8f6f732d28ff05ea3c63d9356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032713, "uuid": "2c01c917-fba1-45ff-8e8a-2a3fc7d6bb4e", "comment": "Malware payload (Mirai)", "value": "827ded0f19144741739a1ab9f846f7e547a6a2522f23389634e9c80da0425e631154986c7a95945f7d6b724f12ec42cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032713, "uuid": "6f91fc3f-000b-4396-a499-ff4fd7b018d6", "value": "T1BC333A0172590A17D0931EB0253F2FE197BFEED022E4F28425AFEB568A36D335645E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032713, "uuid": "2ced0876-0055-4989-b822-03e1a63eabc2", "value": "768:QqM7RDwYhHNcGHEEjbY6A+Sox49piUZuRDeJQkt4AO58USIQJtv1vt:C76ScVpI+4XuIQX9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032713, "uuid": "760c1a15-fb5a-42f3-89b3-f92796483fda", "value": 52908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032713, "uuid": "514058af-ab08-4e99-a5fc-64c1f4569703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032713, "uuid": "2e07deb9-bc0a-4d78-bf7a-82e2e1073326", "value": "aa2d7fd4434d7eb7fef22a9774d9edd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c19e49-f24b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684064062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064062, "uuid": "f8d646c8-ae4d-4240-9f5a-2c91412c8b03", "comment": "Malware payload (Mirai)", "value": "0dd4eab267503551c205232b9ae6641d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064062, "uuid": "e15aae71-d190-498a-a5dd-0ddd012b5fae", "comment": "Malware payload (Mirai)", "value": "0412f9793ff956afe50fded530e604ee8109da34a41b291883a1232b9181e5a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064062, "uuid": "b3412892-a721-4e6f-9f00-975ef0758b41", "comment": "Malware payload (Mirai)", "value": "b36dd30e0c301eef3fb08fd20392e1b1415d21e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064062, "uuid": "5d438e33-03d7-4543-abdb-4235da4846c8", "comment": "Malware payload (Mirai)", "value": "667317f9fbddf56740856fad0b205bbafd64310323bddcc293bf7eb4dd73dc9536b79a85f340a65508e540ce11b16b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684064062, "uuid": "3ad2fb4e-c77c-4367-92b4-5115b99ab3b7", "value": "T1C013F1D9D4F35CB5E40B423D5C7CBBAE0D84670E79A045A3B480963A6E52B4A1F8CB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684064062, "uuid": "5a01459c-9704-486b-abec-d1bbbb754278", "value": "768:OX37YdYw/bdTLH/WMYRKz0d5zTYFC8KRceYH/JIc+PdkrnbcuyD7UVyq+:O7YYadeGzq5TYFImrnouy8sq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684064062, "uuid": "66d914c8-80d0-4aad-8bff-423d65f1c8e8", "value": 43844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684064062, "uuid": "0a4f7775-09ff-49ac-8276-3e5d0e164ef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684064062, "uuid": "170a4233-0f95-4a3f-a7d4-23c6041b01a8", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcde6d7a-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058249, "uuid": "ffeee821-12bb-457b-9872-9bc4866c1633", "comment": "Malware payload (IcedID)", "value": "1390522ffab99c828865258eb7a6aa8c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058249, "uuid": "e9e74835-a999-40b6-aa89-b7226d0fc948", "comment": "Malware payload (IcedID)", "value": "045bf7ea6ea419f43ef8cba44dffb9727e205f1b983f418acc655e66b2de8c1d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058249, "uuid": "2c9ea535-27f6-4ec2-a8b0-0d8a40cab15c", "comment": "Malware payload (IcedID)", "value": "cc2da386b0bca123c7fe5b7568ca69644ffaf947", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058249, "uuid": "0fdc5e85-584f-44d2-ac84-b26fd702066c", "comment": "Malware payload (IcedID)", "value": "15c956000086c0fa2ac53ca76859d8389e2a0df8de877874699cfb6b5a51f7bd34c213ef2f28ba416c6ee73821372b20", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058249, "uuid": "68084432-70e8-4e3b-92a3-a791ae412300", "value": "T1D6D4BF07F322BC97E54BD73789D45CA54F7E7E2D2726C74C1A4183323A4A298AC6136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058249, "uuid": "e9ef953b-c987-4ebc-b4c7-12308a88e246", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058249, "uuid": "e1cc1707-c4af-4d21-a894-73e106cecd0c", "value": "12288:ylOUH52LLvBH1f4SZ/USfXPiu1+3JxMnsBzXT80ZqC:ylOUH52LdH1gSlUsp+3XMuv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058249, "uuid": "502c6fae-b084-4b11-a2c0-b2da990096f9", "value": 620640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058249, "uuid": "8a497399-4888-4196-953f-8209b68fc4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058249, "uuid": "805729c6-32b6-4f76-a25b-575b0065e543", "value": "045bf7ea6ea419f43ef8cba44dffb9727e205f1b983f418acc655e66b2de8c1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71010de4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089045, "uuid": "69bc80ad-696e-4468-8e52-a1a5a482bb47", "comment": "Malware payload", "value": "be63349846165811da4e3444c5d15dea", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089045, "uuid": "a3c96f6b-cb9d-4de1-801d-6de27608e2a9", "comment": "Malware payload", "value": "04cdfd2f08208e2759a6cf201dfe4c5ee6f724fb4ca752b5d2b924024e661ac1", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089045, "uuid": "74c32550-fd58-48e8-ac7c-dcffaf3db13b", "comment": "Malware payload", "value": "68df1366271b3709a6afb24babb38c31277a05e3", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089045, "uuid": "4318c94b-f20d-4ad2-90de-1d2ef9d1cbc9", "comment": "Malware payload", "value": "0cf6283d66ed43ba6850528da332aca324e68a903666b5c90736acc81d2e21fb31dc9875c5d889af03537a8c5232af91", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089045, "uuid": "48b79d9c-fa28-4d52-9b80-868c75640d16", "value": "T1777523839E0AF8C3F108A33272F48E8269F25AC157D0AA2535CDB57C6FF57919814B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089045, "uuid": "a8a76c2a-199d-4047-8d36-7e3fb6134dfe", "value": "24576:p4uEJvFM5LFM7dId8bDd4wpQvbJpBfQIzjchS9awQskC+liwDzGOXZ:pr55udIy/dlObJpBl/chS96sk/QVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089045, "uuid": "cb9cdb2a-ecb7-4c74-adfb-5ab213b6c4ea", "value": 1638795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089045, "uuid": "2cc6837a-dbdc-462d-afde-af7a5ce5e534", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089045, "uuid": "580b29f5-e4f0-4e5b-bc9a-17b58a92fa4e", "value": "BE63349846165811DA4E3444C5D15DEA.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc22978-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089016, "uuid": "9f277e2d-ccef-4b9f-97a6-8e66d0ee1f05", "comment": "Malware payload", "value": "b9e392dee83d9596dd72b2739486062f", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089016, "uuid": "c649a84d-5404-4507-9a20-3410d63f168a", "comment": "Malware payload", "value": "05620032f3a2abd5ebea482b5e5d5b8ff5faa8115019736013d87f442032b6bc", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089016, "uuid": "fbeceba3-7f67-4ba3-b9b9-cf032fe0787b", "comment": "Malware payload", "value": "dca7d4258c19233e8468ba33e654b11abd9a66a4", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089016, "uuid": "8c93628b-7655-427a-adee-94bebee4232b", "comment": "Malware payload", "value": "2868a8aaddf80952ae6e78c00f4e49e5a6e57308f68ea73d29410c54737b00f3be1e95d3a1da225da9ba441c5ec1e5d0", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089016, "uuid": "2eec9f15-4b4a-47dd-9dfd-f92516fae0f3", "value": "T1A6B3E042D6C6AD07D373463DC4B6137A3372FA885228D32E01446E28AD62FE54F95BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089016, "uuid": "d0ee58f5-347a-48c4-a125-11fb536fc752", "value": "3072:nb+4j5jgSFkSgPXGUJ8/NL+q/SZXxfM23S:X5ESmeUeZ+qwZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089016, "uuid": "a3a8cebe-81cb-4e3f-af29-758eccaaee1a", "value": 110734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089016, "uuid": "2af91dfd-e37f-4bc5-8f23-d1298def2e9e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089016, "uuid": "4799b493-7589-4e61-a8fe-18c18e441100", "value": "B9E392DEE83D9596DD72B2739486062F.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b59b8b-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057344, "uuid": "d1c46ebc-8948-42f3-8d8e-674c7e54b4a7", "comment": "Malware payload (AgentTesla)", "value": "119f82623a009242c09fb50f57dd6c59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057344, "uuid": "13eb9fcb-db4b-4507-91f4-b7d1183d64d2", "comment": "Malware payload (AgentTesla)", "value": "0592220c90e6a13f0987ab600b7bee0fcdbeb2710a60b9c5bf0c260ef4f1b16a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057344, "uuid": "e39e8e2d-1e50-4ab8-95e7-38a414898146", "comment": "Malware payload (AgentTesla)", "value": "b8416bf15688ad1be2fb8c74e965d80acf0d33e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057344, "uuid": "5a70e559-d722-442e-aba8-b4958622d0b6", "comment": "Malware payload (AgentTesla)", "value": "6d0e22072fc8916182425e357522f0b7ecce6b4fce4a5ed5591ef0ea77d72320a9257ebd53fc26cf37c7de94fce83543", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057344, "uuid": "d829729b-a823-4cc5-9e35-687ef0d33671", "value": "T167D49D63F135CADFED713BA5C14DE799BE60D412E055F0A13E0A20C8DAA57E21E8C17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057344, "uuid": "ea6a9e46-a8d4-4881-b039-2f6a3d1c149e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057344, "uuid": "772e1272-1ad1-4803-a0aa-0c9264bedb3d", "value": "12288:qKakIPRUi+gf5BP2QTbz0cOdHSFJf6XaRQ+kCwNqUry:HIPz+wdoyhRQLHTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057344, "uuid": "2b294dfb-0f41-41e5-9447-f5ac9583ad97", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057344, "uuid": "9021c23f-f908-4c12-99d7-0722e0190531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057344, "uuid": "7b27dc6d-9e37-4375-9251-413fb9acdab7", "value": "0592220c90e6a13f0987ab600b7bee0fcdbeb2710a60b9c5bf0c260ef4f1b16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af67607-f25e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684072231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684072231, "uuid": "36cfba89-9712-452f-8e25-73a07a54573c", "comment": "Malware payload (njrat)", "value": "c157a6b9e72e48ce6bd2907096f7fb82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684072231, "uuid": "b3214145-03ea-47d7-ae00-27aadfaafe2f", "comment": "Malware payload (njrat)", "value": "05c00383eba2647e26d43fca841cad518b3932bb423ed39a6ac6d478c0e1d406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684072231, "uuid": "ddf42915-d949-401c-8144-cd5330982055", "comment": "Malware payload (njrat)", "value": "560025e93889c0db417fffea91c944f82ba60ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684072231, "uuid": "6b8dc13d-6fdf-4151-a039-ca7f6b02d3d1", "comment": "Malware payload (njrat)", "value": "9df28bccd7963ac0c4ea7259b851ebc782af86fc13890c62e49b629e754e5598a2d83b962d352b13e7b37ab581f7fcdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684072231, "uuid": "3808df00-5feb-456a-ac28-5346de5afd08", "value": "T19B93E84977E56524E1BF56F79471F2404E34B48B1602E39E48F219AA0B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684072231, "uuid": "67cf8cea-1a8e-410b-9532-279d7d2bef7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684072231, "uuid": "f81c73f1-96b9-42ce-9af1-36162e81f0a0", "value": "1536:Zlk1GkeUqZJO5iNSimjEwzGi1dDsDGgS:ZlPUqZJOQAOi1dyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684072231, "uuid": "06481e11-2c0c-46e9-b6d6-7348dcbc77b9", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684072231, "uuid": "6198a343-4285-4365-9169-bc6bedb3fb10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684072231, "uuid": "13e0a6a6-da18-40b9-835c-f53821abda2a", "value": "c157a6b9e72e48ce6bd2907096f7fb82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1193d8f9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089315, "uuid": "eae0b484-af6c-4747-b328-f26efe9fd769", "comment": "Malware payload", "value": "2348182a47cb16f0367c803ac5ee0ad9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089315, "uuid": "e377be2e-cc35-456f-90b2-060c0e76d7b8", "comment": "Malware payload", "value": "05f33c3d39184d80b9f56fec3c5479735b5108aafc149475afb8f504c3af746a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089315, "uuid": "56e42b07-e358-435d-b26a-a681dd396bfa", "comment": "Malware payload", "value": "71b1d38e886842a2cb58d1f6190f63993d462084", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089315, "uuid": "cbc12619-6e80-425b-a23c-9bd43e206bec", "comment": "Malware payload", "value": "9c26778eb2135e68e9e953c2351a000ffe89f520b854973016fe8fe35e11765690e01c59558498890919d161598f1166", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089315, "uuid": "bac28b31-7582-41a5-b468-81f9f4288c1c", "value": "T111A633E0B2DEDCC7D1765075AB5FA6709167D0D5C0A088B9766EAA2F41C2339A033D8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089315, "uuid": "a3229af1-6ba4-480b-821f-da1eb2f5f8a0", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089315, "uuid": "62dcfeff-27b0-4220-8d7f-4c5d12a50f58", "value": "196608:tWQO7um/GES9NWxNo6UBcn1ZXciyZig/rjUCvF:tW17V/cAqhWn1ZUwgDnvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089315, "uuid": "99bb990c-f48e-4165-9fae-ec72030fbcd5", "value": 9939645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089315, "uuid": "667594c5-ecf1-4e1d-81a0-d31ef48971c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089315, "uuid": "a353ff2a-2494-4ae8-ba4a-45d461ca45d0", "value": "Daterbares.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a15c264-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089812, "uuid": "0807c1b8-d986-4128-b45e-dcc9d70af0d3", "comment": "Malware payload", "value": "c895164e0c7e7f5e8960a16c268d6110", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089812, "uuid": "e45337c6-cc65-491d-9b64-eac0a25a2283", "comment": "Malware payload", "value": "06251abba57741843fceb43e4e8e17195df669bbabd40e85d086e02eb071a8ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089812, "uuid": "7e7468f4-9fee-4b4e-bef6-c3699b29051d", "comment": "Malware payload", "value": "b02443205d81376404e178833fbd6f2ca46c17d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089812, "uuid": "92b7e60d-4b44-4641-86fb-bc01646e9615", "comment": "Malware payload", "value": "dbe57602d4bc78ab3d241512e3bbd6b22bc2ad581b1896650d2e45a3f422a9d9eefc296ec393541c5ce882e0a96ac078", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089812, "uuid": "1b9f71ac-089d-4e0b-be8e-d4b9ae50c97a", "value": "T1F7F31D804BA4182B4B1B7F66B72C64B1EFA60EBCC258819FF42B76E972DF64CD4D0151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089812, "uuid": "316de1cc-bcc8-4fc1-9504-4a98bd80c40c", "value": "3072:oiLP6tNmdq3at8Ddfjo3lEWDapBTSIHhrd99dsrWs9seyeecEtI:oMytNmbtSGFDaHTTrsoez/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089812, "uuid": "b2a9b4c5-46ae-4ebb-99f0-731f025741fd", "value": 163223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089812, "uuid": "0ed23dfd-669b-43c9-bb3c-29495953aac0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089812, "uuid": "6bcac43d-63ab-4b72-b562-40a7807d22f4", "value": "Wudipnok.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aa7a8b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1684089637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089637, "uuid": "af59ad7f-02c5-43a7-86b3-fdd6ac176b91", "comment": "Malware payload (AZORult)", "value": "47e7946dd44a59f49e2b634cd2213dde", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089637, "uuid": "e1222f6c-4c9a-4428-a0d0-a3bbd37f896f", "comment": "Malware payload (AZORult)", "value": "06db838e36a8d9958d066cf25896c85227007059c381e2f0b4c021cef070d520", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089637, "uuid": "cde704bd-9f7f-421f-9afd-3a2df4324c4e", "comment": "Malware payload (AZORult)", "value": "055618a8d24a6d6c333781fef70a95cdd335de10", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089637, "uuid": "59dec5b7-4e50-400a-9880-597342fadf54", "comment": "Malware payload (AZORult)", "value": "abfa86fdd52bf24f6047c57d4be85c1cee5d846941e4141ba5ec54aac34b84818136362555c74bbc1252127872be059d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089637, "uuid": "5bf21cd0-a849-4da1-a156-db1b762cc840", "value": "T1B464CF43F45086D1E8F58A3124FA497F833F6F7A964B170B278CBBB42DB32125613696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089637, "uuid": "32ad815a-d54f-4bd5-8866-b4dd5339bca6", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089637, "uuid": "be98fc34-e628-4d67-9af9-c4e1067bd8d0", "value": "6144:fDpoe8dhzfwRiQ8RwwDtO2FO1ly5O/zdQKcsTYM:uzIADtO2FKly5O/pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089637, "uuid": "3b1f65ea-98fd-4182-9056-8fe0c8b46838", "value": 313308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089637, "uuid": "e5177433-f86e-47e6-8320-f105b9d85466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089637, "uuid": "587d9c6c-effc-4fa9-9945-28ab3927c275", "value": "SC90028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfd04b9-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089790, "uuid": "7ccf0596-92c4-45bc-abb6-1d370c13522d", "comment": "Malware payload", "value": "9a288b156e2d1dfc9dfe4d69f61dff2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089790, "uuid": "329e7d0a-d779-47f1-a3de-55369a712ecd", "comment": "Malware payload", "value": "07201a031d05429c37b15573328b248653fd5eb1b8616b1a181d3044ba5a5ed2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089790, "uuid": "31711803-00bf-4e79-ba94-93819432d0bb", "comment": "Malware payload", "value": "fe2983b22e5c1c2bac6d26edf0c22b3bf3aae98b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089790, "uuid": "97f8380c-36d8-4cd6-bd73-c74e083eaba6", "comment": "Malware payload", "value": "1e39c42bd0389a1d6d34ba005c36411d73232aaae10b8124a182df219ae64d87312a6db1f5a751148ae4991278898751", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089790, "uuid": "4b1e6430-0647-4cc0-a437-87b1a57d8b5a", "value": "T14ED401E7FDE2877CC307B6355C058C63A60C2CFB8CE6D45A1473684AC8A58896BC97D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089790, "uuid": "27b33c02-4d40-43ce-be6b-1efa7292f364", "value": "12288:mrvdQF/vPtkbV4ZB4Z43gu/7RL+JP0NOrKgmJ2RZg3ouE21YSuRDoI:mrlQ1tkh43L3guVmOOrrklouZ1juRDoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089790, "uuid": "2e234569-0056-42cd-8c14-3cfd21f51f07", "value": 654976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089790, "uuid": "81b69800-c79f-4ba6-bd18-d59541be06e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089790, "uuid": "ad072583-c55f-4736-9af4-7ec777f1ccf8", "value": "virusrat.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6924c5f1-f1ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684023319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023319, "uuid": "1651954a-e26b-47db-89a9-0cff2f9aac62", "comment": "Malware payload (RedLineStealer)", "value": "1e0be6fd7600c7218b3542af67ab2a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023319, "uuid": "76f5ed15-aa19-4433-b66d-cd1d2620d404", "comment": "Malware payload (RedLineStealer)", "value": "072419f50fda9e481eab0f6e5bc3bc1557ef0182b989b285940e9a978d1be626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023319, "uuid": "529c1636-937f-4db9-8d83-647396256f38", "comment": "Malware payload (RedLineStealer)", "value": "6f09be74a464f0980226370d28682a1012767697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023319, "uuid": "3b44aa8f-3d7e-43e8-ad6e-126514e04e95", "comment": "Malware payload (RedLineStealer)", "value": "927fbe1fd0e7c5f500453bd93d83b449d523a74c9c55badf0034d256b9c813d708264c4dd121b9bf39b0e011df4a51f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023319, "uuid": "3e1a95a2-9699-42eb-9aa0-5c4a48e4d6e8", "value": "T128A35D20679C9F19EAFD1B74B472012043F1E08A9091FB4B4DC1A4E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023319, "uuid": "1e651402-a016-474b-b18b-07105e6a9611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023319, "uuid": "ffe99f6d-19ff-4222-b0ac-2b78cba4b207", "value": "1536:5qsIOqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2u3teulgS6p8l:XTuOYj+zi0ZbYe1g0ujyzd48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684023319, "uuid": "83932aa6-a756-47e7-aeb7-a4e6df0a2266", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684023319, "uuid": "6276780d-a390-4629-89ef-b7715cab821d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023319, "uuid": "e95cd9a2-ccb1-48bd-9260-2850837a145a", "value": "1e0be6fd7600c7218b3542af67ab2a0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f313c7f1-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089693, "uuid": "f33d14da-590e-4d21-a4c5-7ff3b8d1c54d", "comment": "Malware payload", "value": "56cd8ac9adfc0e38496939385aa510fa", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089693, "uuid": "bb0f22b9-36b6-44c5-922d-a4b457f86acb", "comment": "Malware payload", "value": "07cc72f03d7ca465553eeac760d52a722c2ce2891cf708280b1a1d1c0aa7ad64", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089693, "uuid": "f90331ef-1922-44c0-a359-c3f430745f96", "comment": "Malware payload", "value": "a0b2c608addd28bfc0c384b4ba74c5a1eb2c729f", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089693, "uuid": "cbf83a29-fbfb-4b96-9da7-dc904f925216", "comment": "Malware payload", "value": "4ac2b80f852600fbc165b69cb349956fea7392e0f452103eccf95b71f3d235a19320150c12bf79450e2e09d93704de40", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089693, "uuid": "58b8431a-5b7d-4041-ae5d-ebce56704cb0", "value": "T1B1450192ABDE8914F5B7DB39B6311545FA39BC802501E72D0220B1ED0EBBF508F54F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089693, "uuid": "704d8077-4263-4305-b30e-347156c8d720", "value": "24576:elj/tYZHayWzVxD2N+UP3kK2gTrBZyN9WPiccZONza:eljKVa//JkX2wz2CiNA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089693, "uuid": "356f1c8d-c06d-418b-909d-8db532c7d260", "value": 1186219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089693, "uuid": "966e501b-7d44-4acf-abf9-f8cc451970f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089693, "uuid": "5f9f868e-6c4c-4819-9b99-71808cc7c4b3", "value": "SPPush1314935990854.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84dde404-f222-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684046559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046559, "uuid": "eddb7a79-38ff-4147-b710-550638ae3119", "comment": "Malware payload (Mirai)", "value": "801166971275515b01fe782ed28cb945", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046559, "uuid": "c1b11fdb-0c72-4a3b-a317-5ff39d728c87", "comment": "Malware payload (Mirai)", "value": "07fd8a170d43251efb55c366d3f26e266b10894ed8283e8ebbaa8eee958d69e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046559, "uuid": "363d8c09-5ec3-4004-8a06-3d13cf1b57b4", "comment": "Malware payload (Mirai)", "value": "7255620689d1884033f2c67170e4acec9b5129f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046559, "uuid": "26c19a97-d351-499f-99dd-193b8a0ec5f5", "comment": "Malware payload (Mirai)", "value": "3e6d7f898c3a80f2b484b830566597fbd5f2331864146b1396d0bd5cac632f1e1ab97e099bf41d36f0d9750938fb5ddd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046559, "uuid": "f0bea841-789b-4d60-9737-38316c347532", "value": "T107B2D0CC61543484C98D7C7C278D4A664FACA0D0BAED9B16E350CD9873BEA4F385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046559, "uuid": "56dae55e-1eb8-4905-babd-2827229ae514", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBppZq8Wvt:BQlS07FUXqIYSXQKqu/qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684046559, "uuid": "aaa6e19c-a770-4b66-940d-446b06e470d4", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684046559, "uuid": "b1078d84-00bd-4b72-bc4b-0542a251b5da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046559, "uuid": "9a3004b7-e19f-41e6-87cf-6d6bc204ca66", "value": "801166971275515b01fe782ed28cb945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d28503-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089669, "uuid": "d44b8b55-8876-4c1c-97a4-79b98a9935b7", "comment": "Malware payload", "value": "fe792d2772cee22f0106ad38d05059da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089669, "uuid": "3cbb03c1-24cc-4b00-9984-06f68d450362", "comment": "Malware payload", "value": "0a3b5129c8763c492b7cd42dd15c90f186797d6c3bc21282fe2b458d72387b7d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089669, "uuid": "7f80e814-b22f-4df7-9a5e-8739a810b397", "comment": "Malware payload", "value": "29308fbc0c9fee2e4ebcbd664f6b4433b585d131", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089669, "uuid": "552f7636-0e36-46eb-878e-cf720f78c947", "comment": "Malware payload", "value": "00b50e223645bf98d6c3ee286db499f52055c3cbe9b2a1db53cf3e070033dfa66e7443098ee30cebd58c898b2b15b0d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089669, "uuid": "1cccf924-6b63-4b83-91b3-9698846a8d44", "value": "T11CF3096937E48C18E67E8A76487199050372F84BCF1BDF8D4BF264E91E63381892F653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089669, "uuid": "fedff8b0-c2e9-4b9b-ac76-77180df6335b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089669, "uuid": "1c5bbc6d-a7e9-4d44-af4f-b835dc037b39", "value": "3072:uPrYC/7IYY+hi6kAQ3VU1N33Ls3E5NMMATwZxKRFgtrEVJ1sSvFnHVjMxQhn/jZv:UYehN/DRCjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089669, "uuid": "09c25f24-859d-4464-bc97-605a336ab5fb", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089669, "uuid": "26a4ef88-1d89-43fa-bbca-68be25b409af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089669, "uuid": "a6cf1578-9fc3-4b0a-93ba-03e91ded5d9b", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b36db94-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload (FluHorse)", "timestamp": 1684055857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055857, "uuid": "591a06d3-5501-4d1d-bdfb-2f7fbd763450", "comment": "Malware payload (FluHorse)", "value": "551573a666395d683be7c0ce3559a0e1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055857, "uuid": "154e0a29-8558-46f4-936c-53f55e7565a1", "comment": "Malware payload (FluHorse)", "value": "0a577ee60ca676e49add6f266a1ee8ba5434290fa8954cc35f87546046008388", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055857, "uuid": "286565d3-4569-4830-8efe-baa14c0ee3a8", "comment": "Malware payload (FluHorse)", "value": "66d502432bf9e0f36330ae443a084b6d388de4c9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055857, "uuid": "f9d02cae-281f-418f-97eb-4a98adc19ecd", "comment": "Malware payload (FluHorse)", "value": "6fc43362deb7996ae5367d82d2656161d8300eeb0fb6641a1c137610d5b258c157656eb443aabcf858225cdcdeafe8e5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055857, "uuid": "0ca3f012-4ab5-430d-a5ba-b13cb227ffe9", "value": "T10207336F0362821BEBFB153506C9C1E8DEE91A6091F097BF9E57F3D6609F7B42805260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055857, "uuid": "4d0d28cb-e630-40b3-9bae-3fd37279ddb2", "value": "393216:ICNLEMHOwEzjx8zDREUzffq5sltsakB22yTWDWCjfU5OHaHm:BNQMuwEzVHUzvljCbgqWcU5OHaHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055857, "uuid": "2126e510-aa28-4acd-9d44-425f2ff85614", "value": 18276908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055857, "uuid": "cf72f3ab-bf17-4fcd-b1c9-18a38d8a827a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055857, "uuid": "23f6513f-5ecf-4d12-82a4-a7fd1afb259e", "value": "0a577ee60ca676e49add6f266a1ee8ba5434290fa8954cc35f87546046008388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce26c1c-f229-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684049525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049525, "uuid": "c13c333f-3a8a-41d0-9b13-33ce8e6ad278", "comment": "Malware payload (Mirai)", "value": "eca1c49eb8781910c5c5f7b7acfeaf67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049525, "uuid": "b1058ca2-a5cc-476b-a6fc-afa44f5aedcc", "comment": "Malware payload (Mirai)", "value": "0b640d950dac541560f400623249486c875a58eed9b139a601fcfb0f91eddc3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049525, "uuid": "7531dd32-f8d6-4558-9d8a-45d98c4cccd3", "comment": "Malware payload (Mirai)", "value": "d62e4556f1091fe15ea6dcf8454346079a1ecf32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049525, "uuid": "4e1e2c7d-96c3-425a-a3a5-04c0a1fb9d8f", "comment": "Malware payload (Mirai)", "value": "0df552c147ca9d9db5a4aa92c9ed984b4c4365d5203f422295195724ab519ef4cb255b075b11565e8cc1b6d32a0912a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684049525, "uuid": "618f7e2c-d99a-4800-911f-a21131b8c121", "value": "T12AC32B46EA408B13C5D617B7FAAF41453322DB5493DB730689285FF43F87A9E0E27A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684049525, "uuid": "9c6639f8-5737-4729-9a79-d297c5056fe6", "value": "3072:K8PXmy9MpxJXM93N30yDShgFKeqB1+nbHM/9trM/:pPXmy9Mmb0yDShg4eo+nzM/9trM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684049525, "uuid": "dc447956-40ad-44eb-91e0-b958c56f98c1", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684049525, "uuid": "f9c0c57f-1768-4290-b95a-8d65a4e12c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684049525, "uuid": "40473690-7e27-42d3-bf58-27ac94d52f3e", "value": "eca1c49eb8781910c5c5f7b7acfeaf67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c152719f-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089180, "uuid": "5d6e8d28-f156-45a3-9554-cb3ff398258f", "comment": "Malware payload", "value": "cb1484a29bf4857eeb1bf1aa4dd321da", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089180, "uuid": "a243b529-32fa-407b-9187-511ae67201a2", "comment": "Malware payload", "value": "0b86f9732a0ccd415ab340cb7493140a588c216f5ad6264e06a9a1d214044c4e", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089180, "uuid": "637b9a0f-9118-4844-a8b7-1773c73e30b0", "comment": "Malware payload", "value": "a4f6678766674981dee91b2e764377af150e2c06", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089180, "uuid": "81c4511b-df04-417c-9a14-d6b2bc6ac311", "comment": "Malware payload", "value": "d61532e3d2532a4a5886d252aecb1bafb666496ef3362579bbcee1c901ee1da959c80ec88c50b953324e421beaea63c0", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089180, "uuid": "bc1ef74b-18a0-47d3-a333-6741d5f5d145", "value": "T1CDC2D00B8FE5430AF4735ABE19B21D446D3F7C4C587C1AFF0A6604CE4E306A48FA9A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089180, "uuid": "591cef7b-8f53-4d99-aed5-f69f83d94632", "value": "768:WgzT+Hz2dniUQLsrqReMtP+z3hFgsDRrBNTI/v1/60:Wgz6UiOrGeY2ZIV/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089180, "uuid": "b219fcb3-f888-47ef-b97e-e4c56d94b2a8", "value": 25797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089180, "uuid": "65b18137-d4e2-4329-956c-1665ad5ee677", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089180, "uuid": "7d80e10f-0c20-41c2-85fe-a35e3af0fa58", "value": "com.Extreme.Red.Flashlight.ExtremeRedFlashlight.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6eccab8-f270-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684080251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080251, "uuid": "be5facf8-bc6e-4422-acfc-8ef1e2e001c4", "comment": "Malware payload (Smoke Loader)", "value": "c1135a7a3a7d213950642e53566d6a80", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080251, "uuid": "c55bf354-ced2-406d-8020-44f378723536", "comment": "Malware payload (Smoke Loader)", "value": "0b902669e6bd4c0e77bc2ebbdea80349b68f2a12cc9e9883acba04142c2c8bbc", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080251, "uuid": "ade8d896-60d5-4a34-bcb6-9c9cacd97a10", "comment": "Malware payload (Smoke Loader)", "value": "8995bcab60f8175d00b686eee21d0d2dd0f277ca", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080251, "uuid": "8ed5e49f-dbc5-4a39-96e5-e960d877e655", "comment": "Malware payload (Smoke Loader)", "value": "030240a0820755e908f401fe2312a863abf7c13dea895ecd502a519363bc261c6c252bfce7e17ad5053a12ebd8335aff", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080251, "uuid": "899c6592-a97a-4105-8c07-ce3752293fb2", "value": "T1C7644A5366E17D60E66246328E2EC7F8F79EF5618F5977AB1218FA2F05B01B2C172310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080251, "uuid": "32692c63-a5c5-460c-aaee-5455a32be27e", "value": "605fea7870fdbb8fa25f9220a2a10773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080251, "uuid": "14250ae4-9b19-4d6a-88e5-644e3934fbbc", "value": "3072:hiz48xdmf43j86uuY+xiJ+c6EZmakqeauhjESIqClsnmQKDXs/9am7PUp7t:faIKj8p7+LAZmhqeauxrcunVP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684080251, "uuid": "54188d82-43da-4fd1-833e-afcc8a06bcc1", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684080251, "uuid": "b4c96156-1386-45ec-94ca-ed1e8f1f6845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080251, "uuid": "044493da-7c49-4216-918c-b3d55a63a173", "value": "Fridayagent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0943af09-f272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1684080711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080711, "uuid": "e95d7a42-2cfa-4208-b117-b8f4f6597fa5", "comment": "Malware payload (AsyncRAT)", "value": "1744756343111485558d87e8a6dfe71b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080711, "uuid": "d2a89f3d-43f1-47c0-936f-ac774e440f8e", "comment": "Malware payload (AsyncRAT)", "value": "0b994a5aabd30b831215d01db24dbc23ca982e0e0a5afa204c20f1a3ece61498", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080711, "uuid": "966ca1ec-f41a-4a92-9c03-ea46c7f6bda9", "comment": "Malware payload (AsyncRAT)", "value": "42646c6f516de7077ec3a6548ce979ec0b703ac3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080711, "uuid": "7567edd8-eb1e-41a5-9a39-1a3d12ed897b", "comment": "Malware payload (AsyncRAT)", "value": "fb3f307429bab597368b56080a2388de4388b3b4c601988bda07071a7d308c91eee5ca020db8309101d55b5fcab6ca00", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080711, "uuid": "4d9bc680-d87d-467a-971f-2102f77f230a", "value": "T1486319053BE9911AF3BE8F7469F6658446F9F56F2D12C95D1C8400CB0632BC29D82BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080711, "uuid": "898e7ef4-8c7c-496a-9def-7132588a8c81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080711, "uuid": "2889f954-e9ea-49f0-aff1-2cab385183c9", "value": "1536:3m3uSa/d5kaWAeuIR7RYmIFU0IVMKuJUYFRjosuDY8bKKIBtX84pPi5rWrClx:3m+Sa/d5kcKuJUYFV9aDbKKIBG4pq58o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684080711, "uuid": "d3adb8b4-20ac-417d-9bd9-88c950da42e6", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684080711, "uuid": "85ef5764-4fce-401d-bafa-f8931b90e1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080711, "uuid": "d8728eb8-30df-4c1f-a763-75be65471f8b", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d8e1e2-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089825, "uuid": "dc439a41-1951-4fcf-b44c-667610d74afa", "comment": "Malware payload", "value": "8913a9551b5895bd57370f88274c80c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089825, "uuid": "c1313fb3-0ebb-41fc-9cee-bb687aa0b599", "comment": "Malware payload", "value": "0bb71786dd42fced85fd4d47da823753e83a5cb6af260bf67bb116905c8328d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089825, "uuid": "c3b22b9a-0852-4010-9c1b-4fd09fbe8067", "comment": "Malware payload", "value": "111d5ca894dc029d576a779a4b20ee5728a5db75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089825, "uuid": "cf5b5686-42b6-44fc-9d51-c7408692c17d", "comment": "Malware payload", "value": "f5907a376fbc75d2d9cb39a1217083b4abeca1e5578b55a59e0ab9bad52585f1abacc16c01b8f0193d3be8d3a9af8df2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089825, "uuid": "817febae-117c-4b2b-84ee-5c9800133b4a", "value": "T1F5D48E22E5E04837D2731A7C9C2BA66C9C3A7D002D68A54A3FE4AD1C5F797903767393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089825, "uuid": "7ad5253d-af58-4d20-817c-08fd4019c912", "value": "30504a86732cb7421f941c222a93d194", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089825, "uuid": "49528397-dc1a-4eb9-89c4-37299fec77ea", "value": "12288:qzbDRgCdJy+vKjt/hp2JIdK6DOAj/di+I/dzAwuFQ5fC:qXVgoy+YdbKh6DOAjVi6wuFQ5fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089825, "uuid": "57266c93-6569-4025-b9a9-a77eece107cd", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089825, "uuid": "28bea432-f330-4e54-88ba-5e5741a8fa2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089825, "uuid": "10cf77cf-1946-47e6-aa57-87e425b7804a", "value": "XyU8ZgqTP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093c04ef-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089730, "uuid": "8c6fa133-03c5-43c8-bddf-1255efde9fa7", "comment": "Malware payload", "value": "7f477d9cdc98a00b3ffd5009b57733a6", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089730, "uuid": "47809565-f953-4070-898f-63ba166e4bdf", "comment": "Malware payload", "value": "0ce05f4d2f8e8c5d538726cbb67df4a8d8afa418d120a2acfad373bff9c1315a", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089730, "uuid": "bb9b2dba-00fa-48bd-b409-81af774657ca", "comment": "Malware payload", "value": "519d0fcdbf9d9ffc43702f3d4c21c1307f182f5e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089730, "uuid": "4812c727-9b5f-4874-bed6-f0471b17267b", "comment": "Malware payload", "value": "2443dbbf6e78c483b1602b4158453ff9c2ffe0d02f008a4e926ff79e724c94d592d215fc5b1262d29012dfbb066bb660", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089730, "uuid": "b3cf1e4a-36eb-49e4-a6ad-ce1b8591bdd8", "value": "T1AA552385BBEE8920F5738E726A76C090D53E7CB19976D60E1220701D1972FA40B61FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089730, "uuid": "58dcd94c-542f-4211-a962-fe0da93f4222", "value": "24576:C+D2UbP/AM6FGZyLrCEzkquuTHByWXdUtJ7O11TefmAsvY3TQvTMnyyERy3o+a3L:L2Ubr6jLrVBTkWtUn7ODg/svYjQvTMyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089730, "uuid": "32bbb6a8-b695-4fa9-88b3-54672309722b", "value": 1384630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089730, "uuid": "54e31136-9c5d-4c60-bb4d-ebb1c6b1af5b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089730, "uuid": "04d3b9b5-1c83-4112-b179-90bcbe6d6826", "value": "tigergbamarketv265.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b63eab-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684067490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067490, "uuid": "8476cb15-f637-4a9a-9a58-6f1c33a0f6af", "comment": "Malware payload (Mirai)", "value": "b5b1430dbe5f26abebb774a12fff6dcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067490, "uuid": "9a5f7179-b930-425d-81b8-1e35b590b752", "comment": "Malware payload (Mirai)", "value": "0d5c1660a22e93d8f3c487c94d2c32fd3395c4b2ff2d95027938b29dd3fd446a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067490, "uuid": "417a2749-f303-4215-9b90-f37c5497d1bf", "comment": "Malware payload (Mirai)", "value": "5826e9c3d9baf2e51be83cdfce3d07d5fe413e19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067490, "uuid": "c0c7afc7-a41c-4f3f-a185-4f5a9314dbf8", "comment": "Malware payload (Mirai)", "value": "8fa31b916cf77d43db1f2f5a4d285cefdbd05c263cc08d947f7a9c03ac86e593cd5e98412f5ddcc9b3e08f872dc256d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067490, "uuid": "d9c8889e-894c-4169-80f7-600b41057f54", "value": "T1E9C2D1E0B726FA31C4206C3EE52A4D8A3A511A7C91FF353754658C358EC265B63B48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067490, "uuid": "a09e8b37-2b3b-4cd5-ad28-a23d52e549f9", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrR9q3UELuZ:PKy4qfqoeJdXWgEL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067490, "uuid": "b029a7d6-1e1c-492c-a867-81a02f4601bc", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067490, "uuid": "e15261a1-9359-4001-ba92-f556bfc7a04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067490, "uuid": "181a57e5-6550-4ad1-b89c-54123e051786", "value": "b5b1430dbe5f26abebb774a12fff6dcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1be5976-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089583, "uuid": "1a14d057-09b4-4ed5-ae19-2efdf0d11439", "comment": "Malware payload", "value": "77bb7f86fb0ac66c97b1ab3573adffc1", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089583, "uuid": "662d5ced-e9e2-4bb6-8593-f2b5de20b0be", "comment": "Malware payload", "value": "0d9178a87e3373c979c0ded7a93728fcb4109535afda58f590910d757e4ac63a", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089583, "uuid": "242ebc63-6045-4a02-8a84-88c1e6a2f22b", "comment": "Malware payload", "value": "704db9cbbcb1897cfa5df4cdbaeb5046e735d5eb", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089583, "uuid": "47fe29b8-754a-47e6-b18a-212aacd8b4e4", "comment": "Malware payload", "value": "768b45de75c5a45caca06f0e3e86e37afb6ca7395a3ed2ae67480f1a3236d242564bab1fd88a311865c382f861ec2329", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089583, "uuid": "fdd49be2-1d99-40d4-9d6b-d55916d9ef71", "value": "T14FB52383E709D896D5A7CB32882A0452AD781C505F73E7F55A01BDBC4AF7BE0CB14E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089583, "uuid": "e4f456ec-853d-43a8-8bbf-9b66d5be4243", "value": "49152:c45uOskauOLoTLD3jXbqL4z49rc6u+gs/laVZql8JKABFdnXyOF72hq5zwBAmDWa:bXauOLoT3jmL4Cgs/laVZqQlBbnXyOFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089583, "uuid": "9399fce3-33e2-457d-825b-9e6862526f47", "value": 2481301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089583, "uuid": "d22456b4-fd87-4cfb-899e-823433a609c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089583, "uuid": "09cb4bd4-2ed7-48c2-9d9e-4e6dc7bc62cb", "value": "fakeAV77BB7F86FB0AC66C97B1AB3573ADFFC1LabelReader.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8bceaa-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684058250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058250, "uuid": "c19d44ec-b0ed-4818-87c3-b8adf15b3af8", "comment": "Malware payload (Loki)", "value": "97be841d519be72951b4aa9425797985", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058250, "uuid": "fe533931-0800-4988-b36c-26a2c6cfe7f1", "comment": "Malware payload (Loki)", "value": "0f782a18310e85fb4c6af94175693a695d75311ca863eb88382eb0ef833e3fb5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058250, "uuid": "fd5e1ba4-18f4-43d8-9175-6a9f5898c1e3", "comment": "Malware payload (Loki)", "value": "5b03bd02744e3199f97895763ade34d73eb95346", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058250, "uuid": "aa96131d-28a2-4d69-a0ee-d96e829c77ab", "comment": "Malware payload (Loki)", "value": "c62b918f2c39b7747a7e6044c7e7623e494632250d8fca4aa7430df63a6e8ed743aee5604d9cd5641f517e5aa1a2e89c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058250, "uuid": "3320c496-6f6d-4b91-9a2a-04b523a28aeb", "value": "T1D4C48C535065CD0FFE6AEBB0D1B4FF45A6F1F07360D194242BB92189CBA9F021E8D52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058250, "uuid": "8def9872-af0e-42d7-8e92-d2ab0166a2b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058250, "uuid": "dc1b69aa-690c-4eda-b629-6d5c3ba6b2bc", "value": "12288:rIA+diad4hofTwqYRFhghkAu4bxOfegQVtCb:rIxEaiTxRFiY44b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058250, "uuid": "f4c5de71-e026-4d79-ab4f-f34da68d71b7", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058250, "uuid": "ea545112-2d55-4307-8917-3c55869b9a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058250, "uuid": "f54c389a-f9ae-46c4-b3ee-da1981703477", "value": "0f782a18310e85fb4c6af94175693a695d75311ca863eb88382eb0ef833e3fb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef51450-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089713, "uuid": "87a9bd41-b998-4ea2-97bb-40fc5457faf6", "comment": "Malware payload", "value": "a19d832376ffed83ec927569337c8f1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089713, "uuid": "6b12755e-d738-49a9-8b23-d840b66cc4ce", "comment": "Malware payload", "value": "11f7125776ee5d95c9a0c2459dbef1ec2b337800fa9da13dd6e60a24fc9c8f2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089713, "uuid": "4cd667f7-839e-42f4-adce-6d2d2b7b42ec", "comment": "Malware payload", "value": "f8deeadbb68daa2f6868b988136793fc783a6a35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089713, "uuid": "b3e9653f-9e76-487e-bd90-fae12e566c31", "comment": "Malware payload", "value": "ca49ca95c59875a9c41df5441ed3f5772a0fa08fb914c675347b255fab7a46c87450df709e5c47ec796007bbb0c4e82d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089713, "uuid": "7b78102b-fd2c-403d-8314-21922d2f5892", "value": "T1834121112BF44A04F3B34EBA19FB1561843BB866AE31C61C025C429A0B73A04DE72B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089713, "uuid": "993a377b-6aca-4c3b-b703-d7b60bf00f7f", "value": "12:8n3yMfs4lFGfd9XLNE+3+BGfd9XHmRYD3OyYDZ0bdpYrn1Il+kOURbK2UcZRNS:8ifoFGffpE+3+BGffWQRdd+N6bK2/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089713, "uuid": "b1749003-8322-4d24-9bc6-798c2f77875b", "value": 2174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089713, "uuid": "39cea2df-431c-41fd-8a3e-99baefc07630", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089713, "uuid": "ba7d573d-9233-4bfc-8e7a-fda8a3d02a98", "value": "TaxUs2022.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadcf488-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103423, "uuid": "535de57c-1aec-4399-8bfb-65b32fd7b8d7", "comment": "Malware payload", "value": "463e7a3310d3b2a48f40404a0f71221f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103423, "uuid": "ea245492-ba28-46ee-b06d-e49b5d6bd8dc", "comment": "Malware payload", "value": "12283c981f8a9988f121f5752a1c92cd1d0a1dd068d9205c89fa7680c80b457e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103423, "uuid": "ed0ea4c4-ccfc-40e4-85a9-e5884eea70b1", "comment": "Malware payload", "value": "115b0a1ff11918218952cbfa4aefc6650b478795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103423, "uuid": "b26ac22a-0b1b-442c-8281-f7f618c4836c", "comment": "Malware payload", "value": "d7b26799e9b74319e250de6b8b0a1143367481aaf4142a22bd6f01726c866e29e4840f59c8848e1e92540f64a5ea6171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103423, "uuid": "35cc5374-b2ed-45c7-aaa9-9cf0ee158789", "value": "T17054129277729D18C45053725E16C6807352EC5BCEBBC3BFB4FCF902AEB6646804668B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103423, "uuid": "19a303e1-bb21-46f7-a456-d95d53851b40", "value": "6144:03cmC4WbqDNDYE2y21zhIwt9Z53Lf6x0FXnh/Ttrb:fmlWbQn2y+vZtLf6CFXh/Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103423, "uuid": "22152c17-6fe0-4db5-bd7a-468cb2a1fadf", "value": 299544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103423, "uuid": "0e834a6a-eb41-4f8f-bb0b-645edbb48110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103423, "uuid": "9d8659e0-e13d-4430-8cb9-4f367c6622b5", "value": "SecuriteInfo.com.Trojan.Heur.DP.smGea0ST7kdc.23357.19034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27961b7d-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089781, "uuid": "36039776-740c-49dd-93fc-487ed1316d30", "comment": "Malware payload", "value": "573d58408e9487a229779a358350a995", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089781, "uuid": "50a69c71-fae1-4fc7-ba63-30c054a5424d", "comment": "Malware payload", "value": "12dce304f7dd9fbe88d7d8bfe943540c3fd0121fb5fb471ea080c5b4f182d39c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089781, "uuid": "29abb567-1b62-4dcf-96d3-41d52f4b34a4", "comment": "Malware payload", "value": "beeecb5e3430d4f91ef28ed737a1c7a50b3d466e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089781, "uuid": "cb6dc0b5-9f7c-422f-84e0-dcdec2703290", "comment": "Malware payload", "value": "afd3bbc4decfeb527bfe07ad7ed5d795e0bba720cc199af657b7306a9e759405bab7712fb998676623eec7a543adebc1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089781, "uuid": "36c9e1a1-e74c-4f46-96fe-ac06c3ffd5ef", "value": "T15E373351A0621AEDE5F632358382C6308A33FC758BE2D94F827571561FD3BB59D3AE20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089781, "uuid": "e79bf4c2-e8bd-4bfc-80ee-e7b8507b159b", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089781, "uuid": "edc08637-cc5b-465d-aa7a-20b068476bf3", "value": "393216:Eu7L/D7YC+pIhQfu3DfDYQ9MpfaMPg5RdsP8Yczd0zd32:ECLnYC+WQm3bUQ9uf9Pg5zsPOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089781, "uuid": "89152c22-7075-43a1-b706-8137607eb953", "value": 22467641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089781, "uuid": "1d0737e0-d939-4966-878d-f19dda92797c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089781, "uuid": "d7b52582-12bb-4684-ba50-b86fef26d8fe", "value": "VespyTokengrabber20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb343dc4-f21e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684044932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684044932, "uuid": "05133915-7992-4378-b592-6e36170781b9", "comment": "Malware payload (Mirai)", "value": "7d5e71cdd53cee01b4e4a29c5cff2065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684044932, "uuid": "220c3b1f-d821-4b54-bbad-577f2cba5c4c", "comment": "Malware payload (Mirai)", "value": "141587c444a67faef09678959854f485ce8cada254003441f1c1ea6472d7972b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684044932, "uuid": "04c933aa-08a4-4d51-81d1-2d5e16bb0af0", "comment": "Malware payload (Mirai)", "value": "f8c03ca73e3abbae834ab3723f7334a3bd46f72b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684044932, "uuid": "5cabf1e4-dcc8-4c25-a6d9-ebad94cc55c0", "comment": "Malware payload (Mirai)", "value": "e2b5aa5c06be5f92971a7904a6058b8157172a8d56dac8b48bc4ca8bc73f1702b1dbb6f10521bc01c2e2950182d2896b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684044932, "uuid": "461b7730-4063-4215-b565-5f136bc2207c", "value": "T12FA2E019BF1886CBC832693451E9EAD21257FC71F2DDCC492540C16FF4A33A96474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684044932, "uuid": "532789e7-2419-4c6e-8bc7-b1b1caea8660", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKT:798o08kxofBE+ZkXaqGbp2F2TWul0c52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684044932, "uuid": "34869bb2-8b68-4102-af9b-4bc33f6afd10", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684044932, "uuid": "4073aaef-4446-4931-b818-2e40bb23114d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684044932, "uuid": "153ce911-e96e-4236-8ecd-606489786515", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a850e6d3-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684050913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050913, "uuid": "a3746fc7-5f1d-4163-8680-add12a26ac42", "comment": "Malware payload (RedLineStealer)", "value": "68268ad63fdcdd97e1899bf29ccbc410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050913, "uuid": "58277315-ff68-46db-9e18-893bc9948131", "comment": "Malware payload (RedLineStealer)", "value": "14c623cbdaf70d35eb08cf110d8758287d59c452c9e92655da8cdc1ed9b79ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050913, "uuid": "45954c13-96a8-4a97-a02b-35f15acf4851", "comment": "Malware payload (RedLineStealer)", "value": "419c29751ebd10b14891ea184097f5af55eef44f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050913, "uuid": "73a79dd5-f8dc-4682-9e02-26d18f544e40", "comment": "Malware payload (RedLineStealer)", "value": "6f10ee410f5fb4301ec9f48be55eb1dbf0ffcefe2fd2ad2a4d7fe7051f1f8575faf3b597c649b1a1f0a735d6798f36c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050913, "uuid": "f85ec962-fd9b-4e10-8876-2caf93fe675d", "value": "T1CB258C1F0FB0EFAAF0A981FAA26254A453F141170145EBD26DF212E94BE7ED59F13708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050913, "uuid": "16e17a29-6993-46cd-9a9b-df74da94488f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050913, "uuid": "eacccfd5-8473-45c4-8ffe-1edd91cae20b", "value": "12288:cTx6S5DSiB/9GHldgVuT0Q2pZStghnBV+oNaJJUFZRlgGMFeDNc9s:w6oV9I0oh2pEGx2oNaJJgHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684050913, "uuid": "d9831fb5-274f-40a4-bca0-0b5a6ecfe83c", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684050913, "uuid": "3df689e0-eb16-4aa0-ac7f-19ed550b97d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050913, "uuid": "6040a9fc-2fd9-4079-93fe-4d5464e85b0c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4135bd6-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089641, "uuid": "2243dac7-c410-4c3a-aa43-abffc15dc489", "comment": "Malware payload", "value": "5a5e23e86d829f4784a27b553c34d4a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089641, "uuid": "fab4fd37-4d4e-4420-91aa-7559f6c01ede", "comment": "Malware payload", "value": "14d81f82694f90eef4340a685299c2103b6964ebb28f5649b0af0fb5cafd725e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089641, "uuid": "dabcbb5e-1de4-4991-b6cb-7699af281ca0", "comment": "Malware payload", "value": "d6a6d6b2d0e998da2da40c6dfe9dd943241865c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089641, "uuid": "51fe7433-2326-4511-8c74-7cdf3d000a42", "comment": "Malware payload", "value": "6cbd2abac7da598720945165fd5591f4961439f53df8143f6f550c23ee59ea4254167794b78210f781094da6b6fcd5ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089641, "uuid": "62d832b8-97c0-433b-8515-a69c0369c8f7", "value": "T10463234C984724D950B1BB78CB8A48BAFF73417311344E81798D80A5EFB9429CEA5EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089641, "uuid": "596a93b8-c87f-48a1-93d6-c21b9b67b1e6", "value": "1536:BuRzOT02inZChRGNjSy22JJkarJG0FIZvT:Ba202nONj9zJWeo0GZvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089641, "uuid": "4d9d8021-cd2f-48ca-855f-c1c26585c3d1", "value": 72121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089641, "uuid": "bfbb2cca-545d-4c5e-83d2-4080d6121df9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089641, "uuid": "d0879a2c-38b6-4ba4-8d36-64c46eeafda6", "value": "sdadwqeq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d910d2-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089723, "uuid": "6752d694-3e90-46e8-a0b3-5c53bc82f0f9", "comment": "Malware payload", "value": "df4d435f77d8cf561c76bd439f580c27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089723, "uuid": "de1346ab-cf7d-4e42-a945-a1620f04d7ad", "comment": "Malware payload", "value": "160ce8c7ceacdf1842e3d1e72b048bf31ef4ff0dbebe612865b91371740ffd3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089723, "uuid": "067b1dfb-a0c4-4450-9e93-7adb0a264dbb", "comment": "Malware payload", "value": "be0cf2d5cd0ccca09b8dfedabc36758d779b1a1e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089723, "uuid": "cdb8410b-4dcd-4c5d-90d4-535b4bf42d6d", "comment": "Malware payload", "value": "a28d77135c453931a255ffcfe65293f87440acac7855703edd00099de568321e860c04a5871acd8b2bc44c09d02a36c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089723, "uuid": "88f9eaee-48a2-4ba6-8960-d1802642e00a", "value": "T130C20A43A640DA2EC8D2F071236A533BDD73C621611FA4019B492D71AD6C18EEF793AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089723, "uuid": "08bd0a8d-5bd5-4753-818f-3d2c28a2d828", "value": "b67c99695f81ce606551724478e63624", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089723, "uuid": "1ab99b11-8b47-4b0b-8505-f84bc1a8b52c", "value": "384:LfxuTmk4ahJHR75Xx6CI240V+U1gw0H8cxMABIp4ztFSpBqQM4Jy9+:Lfkik4UftdIFpU1gFcteSjqQMuyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089723, "uuid": "f60d65b8-dbb8-47a4-bc9d-665c288f3aae", "value": 26656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089723, "uuid": "dead3ccc-03b3-4097-8f85-09e42a974276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089723, "uuid": "9a2ac7be-4735-4998-94e6-9c89a1a67c4e", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be42e7a7-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684058251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058251, "uuid": "cade4b52-d8eb-47b3-9507-55b78355ba64", "comment": "Malware payload", "value": "9c7691ff597e9efd7f796b31accb78e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058251, "uuid": "8d83c164-e506-40e5-9d56-7d86c030888d", "comment": "Malware payload", "value": "1624af752c9f85fd117fafb28feb42a079f283dc133cdcc5799810072a95a6cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058251, "uuid": "9756406d-c47f-4ef2-af48-4372956fa0e4", "comment": "Malware payload", "value": "81bb289aa37d182b60e86990376a375de7a8decc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058251, "uuid": "5e569352-118c-4897-b0c6-629bef5719e1", "comment": "Malware payload", "value": "0dec499eb934a55a3e1214ac6b279f9151ac18811a952971ea36d86a309403fe158008b55be0cfe6c9edd038738feb68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058251, "uuid": "b33fd27d-16c6-4c67-b241-45ec86e19044", "value": "T1B83485893264358FC46BD6BA8A686C649B72347B931BC287585314ED9E9CF83CF045F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058251, "uuid": "4a7edcf2-e7c9-42d6-987d-60c3e7f1636b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058251, "uuid": "af041c6d-8035-49a0-8a18-bc88ead349e1", "value": "3072:bo98cfXJyH8Rpf1RAshsapucG/6I2VI6whmHAsEye7Zm8TPRQfSFEq8o:b2ZycrfbARZ0AsEye7Zm8TPXFb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058251, "uuid": "adb32036-2026-4493-806f-44393e125c4c", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058251, "uuid": "2ee6a963-28a9-4d3e-bbf1-702e925dac6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058251, "uuid": "cae475a0-f6e8-4288-9e3e-6af10dee371e", "value": "1624af752c9f85fd117fafb28feb42a079f283dc133cdcc5799810072a95a6cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1a6e70-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089708, "uuid": "d29b6d55-a8ef-49e4-a38b-dc8826d8f5cb", "comment": "Malware payload", "value": "b90aabccc3b95ec1996cff02163fc158", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089708, "uuid": "39861478-d0a7-4bc5-b595-85fd2716d9c2", "comment": "Malware payload", "value": "17bd06d66015b2a9ad9e9617aad0a05b102c45116de4226684dd160584e45200", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089708, "uuid": "1ee007dc-be63-4566-b47d-7bb8127a5c70", "comment": "Malware payload", "value": "8d1356338ad54ef4adb4e853ca6b83e7e0a1a744", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089708, "uuid": "019aa96b-4946-43b8-a2c6-d18a2d0fd863", "comment": "Malware payload", "value": "6e2b1f5b442541efe5dae792e48355d601b32566d4538a86f9121ed11a899d4442240d0bb17e4e158e06ea5a50ebff1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089708, "uuid": "ed9b5817-df2a-4170-86ec-e6e20eb14573", "value": "T17C4633F8467B0AB7B1B582BD732B0A4597CFA720E5CE542AEF65654BC73B3201D8410B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089708, "uuid": "5f7e3613-2b64-4f31-944a-0c2e6848a842", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089708, "uuid": "24a7e94f-3515-4980-b631-1cb70c2a757e", "value": "98304:p0q/qlbR431ONNKxXKL1XZOmqAGkwMVjP1F7IzSt91U1ZjZKzJmr:V/qz4lONExXmJWAGkwMVr1KzS/1U7Z9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089708, "uuid": "9cd61653-b9a7-4b05-8ddf-b05c76d106bb", "value": 5428736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089708, "uuid": "91cb7e32-d440-4101-9301-fed3c6e33b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089708, "uuid": "892a277d-9744-4641-a987-eadc7b14d626", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf088966-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058253, "uuid": "1b493299-2664-4705-81df-32d9ed974f8f", "comment": "Malware payload (AgentTesla)", "value": "86e0ff491e77e336e024f84fe43446c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058253, "uuid": "7e8cbe5a-c08e-43c9-a5d5-fa22eb319f1b", "comment": "Malware payload (AgentTesla)", "value": "1801352a0ee7b4e34fb7fe6b484852c57cf33a0e879701c896d442fb2bafcd47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058253, "uuid": "6529b483-d1e4-4b0e-ad3b-dab4aec8bf54", "comment": "Malware payload (AgentTesla)", "value": "936278349d8672456f57469befc8d39e9aea72bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058253, "uuid": "4985687c-6d99-4726-9ab7-a3d0232804db", "comment": "Malware payload (AgentTesla)", "value": "57f4bc9d3cc056a0912909b21ab936c034e56edfadfbe78ca12eb6009d7441ba9324b7630e725b2af013344cab8d890b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058253, "uuid": "60b3c022-e3c6-4c13-b3f2-5d01bb0e739c", "value": "T1F9F48DD42AD68BC4C037B130F05ACBF2C3D2152AE099DBE1389B5589E1D2E555CFA8BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058253, "uuid": "ae346359-8d71-4b6c-8d17-2c667f37cf6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058253, "uuid": "344212a7-8531-494d-bd41-4126ec2cde8b", "value": "12288:bs2iNRjK1NyUIAy9YlhCgkfPxzvc3hXdLY6rfBQ+j/bNIPyVgh2eV:Q1n2pZl9UPx7YhXD++Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058253, "uuid": "05ed6597-b9fc-4218-9f0c-49bf2a0a3d2b", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058253, "uuid": "b1af415a-b405-4382-b3f4-6bc8a68ae4d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058253, "uuid": "14edfba8-0067-43b8-97a6-7abe922c4b54", "value": "1801352a0ee7b4e34fb7fe6b484852c57cf33a0e879701c896d442fb2bafcd47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a21c5b4-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056419, "uuid": "f614821f-9404-4c8e-856c-350707a16fe6", "comment": "Malware payload (KmsdBot)", "value": "6098db861d0ea8c0acda7a577f48017a", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056419, "uuid": "f910228b-9222-44cd-b7bc-d5bea2c9652f", "comment": "Malware payload (KmsdBot)", "value": "184f361bcf48265e74c31adee297b0cdfb1bbc39bc58f901c4ffdb69f6b589de", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056419, "uuid": "cb81cf0e-b0eb-429f-b8fe-e49991e6a594", "comment": "Malware payload (KmsdBot)", "value": "0f7e78078126d9d7b22ab9a895204cbe2fa3b7c1", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056419, "uuid": "223c9379-67ff-4bcf-beba-61c4b48e78e2", "comment": "Malware payload (KmsdBot)", "value": "8e004de0f2f79f38281d26f91c1d156a2531df12f1cc851c52cb2dbb718d04e504e51b290e7b6a7d7ea4e3614c98057d", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056419, "uuid": "08bf5c6f-77d8-4c69-a86c-7fe01671155b", "value": "T1F6364B117F44EE6FD394223156B6C37173D6BD0482A03226BA56F31D2EBA3B59C1ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056419, "uuid": "b709582e-5864-4516-a319-4150365ac24a", "value": "49152:F3/lle6zgoMXX1gKqtBOlUoo3ZxNLhP/x/dsBMHjFhBAavm4ewr2:F3tfgk5t3xFyMrBABP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056419, "uuid": "cdcf10bd-1395-427c-b747-d0d82096f1df", "value": 5247856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056419, "uuid": "917d65da-d9bd-4828-811d-06b934520b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056419, "uuid": "2e03e1aa-3308-4417-98a3-7b03cfa7a9c5", "value": "184f361bcf48265e74c31adee297b0cdfb1bbc39bc58f901c4ffdb69f6b589de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14750ae-f274-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684081959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081959, "uuid": "20e58164-6ba6-43d6-9a60-a4295a46f860", "comment": "Malware payload (Smoke Loader)", "value": "26c4da738b1017fd4364cfb611294427", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081959, "uuid": "189a2ac6-e926-4b5f-9c35-d70bd4490350", "comment": "Malware payload (Smoke Loader)", "value": "1a14290c58f1714887a32e662aea159dd6b3035c110d39e68aeeaa1511cd1a9c", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081959, "uuid": "dfb8fa40-0550-499d-ace7-73c417d88b59", "comment": "Malware payload (Smoke Loader)", "value": "24794b4df7e39b7d181b6283eed85b1c906f4cfb", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081959, "uuid": "0ce95a5f-1c09-4fe0-833d-cad8437cfa2c", "comment": "Malware payload (Smoke Loader)", "value": "f2750974bc687efd2da25e9eaa1aea7ceb11e26838e43f6c229cf5a60d43fc58b04bf50a2ce2e2c15c066c36aef51e4b", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081959, "uuid": "501fb29b-cc35-48d6-bd3c-8667aaab0c20", "value": "T1E2643B2393E27C54E9264B729E2FC6EC761EF3504F597B6A12189E1F04B06B2C173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081959, "uuid": "0ded4012-a994-4372-a377-c4656a476c2a", "value": "7ce2ea0672659bde73ebe3337265c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081959, "uuid": "7eaa5eb3-70b8-4424-b862-f867f938d9db", "value": "3072:zpXttpaTmpL0/13oGLLhndpJ13RwS643kPZDbiA5k05DxRfeYI:x9aQL0/hoGLj1B51GRbc05DxQYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684081959, "uuid": "333a5178-fe39-45c0-8c3e-732d48e0395b", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684081959, "uuid": "87c33ff0-9b05-44d6-9f6d-9a9a450e0642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081959, "uuid": "604dfce0-e903-4cb7-970b-7dd7cab6eefe", "value": "cryp.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb92653-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058254, "uuid": "48bbfe3d-8536-43c9-875a-f678a3aba429", "comment": "Malware payload (AgentTesla)", "value": "9177be30afd7272bd8d64c6550bb58e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058254, "uuid": "18d8c461-daf0-4ad2-8349-3a40ea104671", "comment": "Malware payload (AgentTesla)", "value": "1bbecf63592c2dfbd314892848f17cda21a52520b369e2a07ed99960163a2e34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058254, "uuid": "4d61cade-744d-47fd-ab28-ad972a7faa7a", "comment": "Malware payload (AgentTesla)", "value": "306d7efb05c94b9405af9d677ba6bdaeb5b5c33a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058254, "uuid": "2bd0f1de-ce31-48b6-bcdd-747cc3b7eade", "comment": "Malware payload (AgentTesla)", "value": "f7f1fcbf7a0d2bbd26664d59d9b8791184acdbf78ae3c0a5bab359744377ea17f37d97634c813cd851cda8afd812e892", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058254, "uuid": "16738957-210b-4f7f-8b63-a86979df1251", "value": "T11FD48D63F135CADFEE717BA5C149E7957E60E412E050F0A07E4A20C8DAA57E21F8C17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058254, "uuid": "5b62b67e-9a9d-449f-9e9e-0af707572ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058254, "uuid": "ec872b0c-7157-4e8e-b9c4-91164fec2ef2", "value": "12288:MzaxOWcweaEUmdZNjNPx0cfMDCNJ1m0dv65mlYWYHq:WeXEnd5xlfmCNJ1jpYWYHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058254, "uuid": "e23bc702-8dc2-43c6-8fe6-fe1d8116f301", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058254, "uuid": "dac28375-0dc2-46df-93aa-6359aeaef372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058254, "uuid": "e71a7c79-44f5-455b-98ca-7e5c00049f4d", "value": "1bbecf63592c2dfbd314892848f17cda21a52520b369e2a07ed99960163a2e34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa509d0-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "9c447a82-769c-4cf1-bd00-4929bd533894", "comment": "Malware payload", "value": "7fea0a41bd50e10ab7110fdde6cc3244", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "efacd293-bef4-4d9d-80f0-22eb16d7c77d", "comment": "Malware payload", "value": "1cd7e3879d9ba65ef941fb3a782a7a4d7457b60b570e305261781068e9d38829", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "54c8043c-7f40-47a7-ad1d-d0c07660747f", "comment": "Malware payload", "value": "a1327e186d515b480c5f3542542dddccf785f127", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "b2341356-a894-4826-bd02-6195aec92556", "comment": "Malware payload", "value": "97c9cd2063bcd65ca0b8e0851402700a49c1f6a3279c47e42dc61b86b428fae815cacfdd95232971af5373fffb2f733e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "240311e3-ad52-440b-a69b-7b1c038a7531", "value": "T10D74AE0071849938F4E6ACB09CC5AB7159387EF1EBEF90C7B791367F891AEE53610245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "3be3d5c1-325c-460f-b19e-7593b37423db", "value": "46c74cf13312d6259105eaa206ede1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "9f7bd494-463d-4462-bbfc-2a1645e92567", "value": "6144:Q5CSgIYwDNqbpaB+eEUYkXv/ZGK+G7XwRqPTnYB8sAUaht26XZUa:QQSgb9b84eTkKrTYB8sAhAMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089687, "uuid": "3f0d7a56-9d0d-4e89-ad66-0d95fbb6f50d", "value": 357000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089687, "uuid": "71099111-2990-4e5a-8f01-f1ecc33ecc4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "0d4dda86-127c-462a-a4b0-27c1c2dccc78", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c8ba4f-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684051035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051035, "uuid": "694c43ed-bb4b-42fa-a492-2eab0b6287f4", "comment": "Malware payload (SnakeKeylogger)", "value": "60061673d3bcfa0719793cfaa3bd0cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051035, "uuid": "e16d385c-aea8-4a76-937c-24ac2eb48a48", "comment": "Malware payload (SnakeKeylogger)", "value": "1e06accb2a34f85db0c813baf9d01defb963bbc03206539ac093bc7958743ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051035, "uuid": "3c8d162e-3830-41ab-aacc-e6680394fd73", "comment": "Malware payload (SnakeKeylogger)", "value": "dd32cb08a2facfd184186997f1c4133c07a0ede8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051035, "uuid": "6e13e2f0-a44b-49cf-80a0-8d8f92a338db", "comment": "Malware payload (SnakeKeylogger)", "value": "71565d344a4fafb8ec92b72e1ff54caf5259e6c35256d3e28083a2e411c146f935afdad804f8d77ded8499e2676313ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051035, "uuid": "db8aac30-5350-4a36-bb37-c0280e0aa724", "value": "T11DC4CF49EA5BA777E2AE4FB424425D045B6C7026B271F13E6DC334C895AAF300B8F653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051035, "uuid": "204249c0-1032-4220-8fdf-0fa94d6e7691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051035, "uuid": "79fc0dca-d194-44c9-b473-e30a92e90b1d", "value": "12288:1EhKjvvwo+7LtoLXa8kItLp2WSo8b1RJgP+3p9U:Pvw+PVp25LSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684051035, "uuid": "82ab40ff-be28-4025-944d-f9dc2030c346", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684051035, "uuid": "89e291b3-7d67-4f73-9392-490cf46fbb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051035, "uuid": "1639b184-9c55-452a-aade-078d3aed86da", "value": "Quotation request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f65ac08-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089794, "uuid": "4cae8920-a561-43a1-b23d-a08e51ed42b0", "comment": "Malware payload", "value": "132ba0c3ecf8a795944c87a13b037a88", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089794, "uuid": "4297a38e-903c-4884-8a4d-fa1ff1fc2392", "comment": "Malware payload", "value": "20a5c8f44be9a51260851e8096fc9c2e1a8ee8cba17c2afc24f32c9e0fccedaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089794, "uuid": "dfdfac68-2de0-40c1-9360-c26ed282b3d0", "comment": "Malware payload", "value": "7a4c23e4d6ede7b10e1363185bf4a48434dce9d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089794, "uuid": "74a8b315-606d-4baf-971c-8202d9dc85ad", "comment": "Malware payload", "value": "0a88bea3c657cefaf4fda04488cca08e7240e80d22c7d37e69d8dd55f5848aeb9c31e84b10d4db6c9be2e4595dd7ec11", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089794, "uuid": "29a0850b-2f27-43c2-bed1-5b0c0ade9991", "value": "T1BEF41200B3E7847BD49002704DBD47E5E439FD7A7BF4A199EB955E2528B09A2F8007BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089794, "uuid": "4fa1518a-9c52-41dc-afb2-08eebf5f3adf", "value": "ccc0e829fe1206cd39d147ca374725d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089794, "uuid": "cfedfe9e-0619-49c6-ba22-120ae47ed0ea", "value": "12288:G5OVdesRaHZZEbc68kt4PpMSUcJkAhMQCSMKjPKsHf2+3Ls8QG6TboMbkgycytTV:GInRa5rHfp0oz5/Ze+3g3G64MQLvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089794, "uuid": "f58f9b4c-a49a-41d9-b32f-6a733aaa5630", "value": 755849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089794, "uuid": "0cb857c4-cf94-453f-9788-c18cd93d7f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089794, "uuid": "0db77172-8b8e-446f-ac4a-e9a482e3c510", "value": "VNCscanner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082e693a-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089729, "uuid": "3cafa4f9-4acd-46c4-aa6c-161a8125da68", "comment": "Malware payload", "value": "4f3b82c56e98ad28f9b7854640cc3521", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089729, "uuid": "3792c4e9-3bcd-4482-aa51-611188848314", "comment": "Malware payload", "value": "2109a5835b2167da4bab8098332502ba8cf5bc943ea071444cf07fdac4c9be05", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089729, "uuid": "d648303c-bb29-4fe1-be8a-2c6f0feb6396", "comment": "Malware payload", "value": "4e3ad4b64744f097b87391ef306f2204fd75a814", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089729, "uuid": "198269d0-9c03-4e08-9173-d080bed1f67d", "comment": "Malware payload", "value": "a0c1dc58ad56df2f1ffe12f5a96bd8ebc166514c17d81bc89c71409e4fb369b7ba21e39423a94a771e820ba66c0f59b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089729, "uuid": "e257264a-a1cb-4953-a26a-b76bb72c4e8f", "value": "T11F34964843A528574B2F6F66A72C54FAAF6B1EBCD2E8909BF81B7184B6DFD4CD0D0011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089729, "uuid": "3fe23fe6-be18-4d1c-80c6-926a381fa8e9", "value": "3072:8irPWdvxPT+3Lg90w8zbq9DIl3X2nLDaln5Edv8VPhRL8vtp:xqvNa3lzbq9DIl3XLln5OvyhN8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089729, "uuid": "d975bd8c-8d68-4a91-b03c-446bf4bcc5db", "value": 231161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089729, "uuid": "95fee099-94a1-4e3f-9254-3e01f7fc3bd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089729, "uuid": "4e40cfbe-8521-4e59-993e-966ce0d37035", "value": "Thurs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ae93c8-f204-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684033532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033532, "uuid": "b8a17847-513b-4735-9fb4-510abbf39030", "comment": "Malware payload (RedLineStealer)", "value": "b74f77779241e3b6e606f844ce01a7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033532, "uuid": "27aa2bea-5ae2-48ea-91a8-cb933205fd2d", "comment": "Malware payload (RedLineStealer)", "value": "219e0f9b69d87397a5deb0aabf61fb2fc0f2720b47a5b6521610f87b3b180624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033532, "uuid": "c991c99e-7a6f-492b-bed7-5a421d04ddd1", "comment": "Malware payload (RedLineStealer)", "value": "e58109804d68c5fb91c6b079e5ba2045d6d1f7f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033532, "uuid": "b640d056-48e8-4e64-a536-7e82995464a4", "comment": "Malware payload (RedLineStealer)", "value": "c2d710d07aa388bfab81700687a45157d5792b1edb22095cc1610a31d6e0feda2475a8411ceb1e4c82f7afe4d467cb34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033532, "uuid": "2d5896e6-49cb-41a2-a2e5-a9a3d44d1d2b", "value": "T11CA48E13D2E37C65E5166E729E1EC6F4A62EF9508E4937EE12146E3F08702B2C163736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033532, "uuid": "0f019ade-44c7-4e12-8460-fc131f631a97", "value": "5e886f6816f9ed7fecde723808a23e1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033532, "uuid": "163db819-ddac-4fc8-8878-e7e6c2c1240a", "value": "6144:nl9DDPhUmYervMFRwyZOTnwSeafPViFWg2LFuPTTHSyxSi+vSR:nnDPhIeQLc75e6iFWg2BuPT+o+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684033532, "uuid": "c206b34e-a00b-494d-9ab7-d62ddb4ff024", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684033532, "uuid": "0da0a460-2e6c-450e-891a-7a93c946ec33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033532, "uuid": "160cf4dd-9752-478d-baed-32dbe718d7c9", "value": "b74f77779241e3b6e606f844ce01a7b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046973d9-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089722, "uuid": "1da9022d-8524-400a-8d29-c474647372e8", "comment": "Malware payload", "value": "e0ad4a94f553b0be05a07ef99b840063", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089722, "uuid": "c5bcfeac-4030-4ef2-ba80-7036b7243c2e", "comment": "Malware payload", "value": "2214c7a0256f07ce7b7aab8f61ef9cbaff10a456c8b9f2a97d8f713abd660349", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089722, "uuid": "c490c73d-24d0-463f-854f-7f27e7fcd0df", "comment": "Malware payload", "value": "ac324bf0f18ec179bb745b34995a3829619df549", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089722, "uuid": "f2afd8d8-2ce5-4c51-afff-d971e30dc22f", "comment": "Malware payload", "value": "9b7b6433c0a4343429debdc297569658821d53876249a61a61e03e4e47f70ed980446e0f70cf25f390f83a0e3f35ca96", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089722, "uuid": "8a66d2af-7e62-4439-a636-9d35c0c03e57", "value": "T14362D183EB58834280E4D43B8A386B6FE6A3649F8D4A42025D86CC42C0F70D3DD7A4E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089722, "uuid": "08d375a3-2490-4e9f-b99e-a88416b7e1f0", "value": "192:MnAnAXGZX7xlzsqRDjfWVfrGOUq8lmbrVrDz5aOjEqTRtQ26zRLMoKPcAXOShMFR:MAnjXFlzsCCfrGOAlslvgEGzjR9w8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089722, "uuid": "8ab172a6-c9b2-4d32-baf7-4849693ecac0", "value": 14520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089722, "uuid": "2a8fbda2-07a1-4ad7-8bd2-9a70e525082d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089722, "uuid": "aa6975ab-3c2c-4d87-8ee6-4e0c2f208656", "value": "test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6590a743-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (FluHorse)", "timestamp": 1684067551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067551, "uuid": "4e19267a-8252-4b57-b51b-b97b058cdadb", "comment": "Malware payload (FluHorse)", "value": "4349aa737d9bc206bbe88f8b42b9fcbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067551, "uuid": "65358200-56f7-43c5-88c8-a7a1d9391762", "comment": "Malware payload (FluHorse)", "value": "22464aed63c863cba382ab2966c82e54be6c297d1c09afe4b32ef744e942dc10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067551, "uuid": "880d13bf-a9aa-4c1c-b9f8-c0f9861b5e1a", "comment": "Malware payload (FluHorse)", "value": "21b86fae97deb3b368027457d02af4d67440e499", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067551, "uuid": "d55e145a-2d5f-4e47-a88f-d94b63256155", "comment": "Malware payload (FluHorse)", "value": "3cd830c7b638ef35a7efd148df80dd1bb0f5164d032c1da5bce787ff73b902075be4307d94af7737ec9b73c55cbfc254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Fluhorse", "colour": "#404CE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067551, "uuid": "f939ed3b-84f3-4b1e-b3d0-dda3f91a9b16", "value": "T181F55D4E865C5F10D0EEF23D7D3C0E65E93E44B4557C8D23C62BE582F69EAB286D2680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067551, "uuid": "563ab088-f7b2-4398-93bb-0e5b5512c452", "value": "49152:RnQeezdK9lDvzRuG99LRkDSCtb/T5RqKllUf0:RpLvzh99LR8ltb/9RqDf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067551, "uuid": "fc1e1612-e9c2-4e4e-8fb0-6559a0d6ff87", "value": 3523480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067551, "uuid": "d8469b5f-6ce8-4426-ac87-46a4bde5b8f7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067551, "uuid": "df62181d-fed3-4aa3-bbc6-6dc0004a1930", "value": "SecuriteInfo.com.HEUR.Trojan-Spy.AndroidOS.SmsThief.ug.29630.28569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06b8df0-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684058255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058255, "uuid": "1d48eaeb-bceb-4d12-b01d-3ecfc4813e3d", "comment": "Malware payload", "value": "2f3c22064d252ed8e78a83a15c51039a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058255, "uuid": "5160c778-e555-4257-a8ee-e03115dd7615", "comment": "Malware payload", "value": "22c1b5101f98d21fd9a0ae69411a143416c72e595ad996479e08e48f9fe6b91d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058255, "uuid": "703da202-e98b-46b6-b6c5-758d440bf42e", "comment": "Malware payload", "value": "ab00630f36b3aca79f6749ded754bf3e5eedcc9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058255, "uuid": "0d27d210-7549-4976-999f-35fcf15a3740", "comment": "Malware payload", "value": "82244996758a0d5315043f81766667ca35296bfe9675c65d15e8ed7f55ee62e668f122ebf6cdcae978bbecf18ad87972", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058255, "uuid": "8eb06070-3583-48d8-91cf-4c6e1e108de2", "value": "T15B75129DF7648CB7ED3D4671D04BC1200230E836E56AD39A29C8BBB62D633DC5499C6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058255, "uuid": "c303f351-4bbb-42a1-a6f4-fc64dee14677", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058255, "uuid": "00e3cc75-7a73-4bcf-aa7e-2fe485d58ea5", "value": "24576:nqJ/K43wTgmQ2CjqQGCcy9KIxuYkOSfKprUG2GTi2l4c1yZw9sWISuxuGkyLA30z:zHFInGAQIwYkvKhUvsi2K9Zw9KSuxuxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058255, "uuid": "a554521b-5129-413c-8226-a56810e17315", "value": 1555968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058255, "uuid": "48f6f6f4-ecc5-4df0-80eb-6dc2b3db7d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058255, "uuid": "f2fc3d84-3283-40e3-ab6d-9fe29bb1608e", "value": "22c1b5101f98d21fd9a0ae69411a143416c72e595ad996479e08e48f9fe6b91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5a8770-f282-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684087801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684087801, "uuid": "40ac8f1b-c9b8-496e-9752-7e66f0decc62", "comment": "Malware payload", "value": "ba6136993735218fedbcda5f188562d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684087801, "uuid": "df3826bd-dccd-4240-bfaf-34720c7960bb", "comment": "Malware payload", "value": "27342a96adb1b0a66190600086a43809f0c4fe2014454aa50c636db0023b6c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684087801, "uuid": "b9e7d0fa-8643-4b18-be5f-5891f38a901b", "comment": "Malware payload", "value": "f64778765329e8b1b690a402f624d4df006bec5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684087801, "uuid": "67791f71-10b9-4aeb-8db9-52c2936ca320", "comment": "Malware payload", "value": "e5d74c1ec57d3eea82fcaa1eec25a0369fb43f4b487289a146c604a4e5db6fbc34e527dcbd384b783614a05fe4414f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684087801, "uuid": "0fc36b29-2de4-4e4a-a82f-05d793445752", "value": "T10A522B467F970CFFF2228774C4B30A46D5B9B523776262EF87A452240EA52C05C71EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684087801, "uuid": "16f7a0ac-1182-4729-91ba-3e3274b4c7fb", "value": "c278343ea71d19799459485230b15cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684087801, "uuid": "5c54b4f7-8bc0-49d6-9cb2-146fe07e62f9", "value": "192:/NBjlOgJRQyFVDKOe5QG552MOKjDGExm5+xEqcmGkcW5tfW9FAw:/NxtQyFdNG552VYw5+uWRcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684087801, "uuid": "dd3d1a0b-eb33-484a-aa6e-89eeb9d261e0", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684087801, "uuid": "1d31c0ca-51b5-4d63-ab98-aabffb19437b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684087801, "uuid": "91d3fbb2-7000-47ba-9e77-563a97c488aa", "value": "ledger-live-desktop-2.57.0-win-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1615552a-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089752, "uuid": "e3bae6b7-f062-4594-9663-280cd7890b16", "comment": "Malware payload", "value": "efdd98ae7ba8aa1a457d6938d554e5bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089752, "uuid": "7f9e5f6b-5772-4275-87cb-1a359acff3b5", "comment": "Malware payload", "value": "283f195bad35cac6e9452c2791eaeb90d9cd6d506aa16c6505247e5be74aabf0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089752, "uuid": "be294835-59d7-4336-b058-bf4b7b7ee287", "comment": "Malware payload", "value": "5adc3d12792396b569bf024676636262bcd9c7ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089752, "uuid": "16b8710e-24a7-4808-b7fc-233e4e5086f5", "comment": "Malware payload", "value": "06efbf19aae8976d27a9be723504fd1de055f9580937054893e5f769e3cfad2279a08b0332fc9b5f2d1895066d361fb3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089752, "uuid": "9c13aabc-a406-4d0d-83be-2fa4d071e3d5", "value": "T15ED36C27B3A534E8E9B68235C5511606E77378720B209FAF036046B95F376D0AE7BB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089752, "uuid": "27714a0a-41fc-40a3-94fd-512c23659ae6", "value": "852865b18a60ae32a1566570a0610b5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089752, "uuid": "8b06b172-d2b3-43aa-a78f-0d872638d8d7", "value": "3072:la0U9iSEZV1E2gK90lzIvJx1h9xgfHVpSIzM8ya9icI:lasSEZPEgGOFh9xgKIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089752, "uuid": "0549036e-a41b-4cb0-a84b-4a62d6668909", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089752, "uuid": "31fde97d-1ab6-410b-936d-b446f950085a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089752, "uuid": "901b11bd-4c60-4ebb-8f64-fda69ff3ce6e", "value": "Unconfirmed925133.crdownload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5df11c-f2aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684104956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684104956, "uuid": "b8592934-887a-4727-9042-f978247e07e5", "comment": "Malware payload (Formbook)", "value": "87117ff2b493b4eaea3e57f260508684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684104956, "uuid": "a6976925-886d-4374-b5ee-b83f61ac1ad6", "comment": "Malware payload (Formbook)", "value": "28981de1a7a9617749fe0a5d19b8e0c80b2dc082118c1ca1b95e475df34e44a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684104956, "uuid": "5b7fd827-1547-44bc-8a0c-a13b4e29350f", "comment": "Malware payload (Formbook)", "value": "db156f12eb1cb4d79087931d603cb4e12790035e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684104956, "uuid": "0b65cf21-0635-4d02-8c05-14015a4b2d0a", "comment": "Malware payload (Formbook)", "value": "0eed719ec4c9bd0b9c19a6aaa1273039ea4cc3d534d63970d58c2295b89375d0256e813bc83ceb0a4c71089b23ad2a79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684104956, "uuid": "c560c5c5-f5f3-40dd-89c9-d61badc4a3f8", "value": "T108D4E0A6D1B85F11CE641BFD1D63C4C60AF59AB57C24D8305E8B28CEDDA2E1F288817D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684104956, "uuid": "56fd3f77-80c3-4d2d-9b34-306b7fa2c57b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684104956, "uuid": "0c84cd8f-2eed-4e96-aac3-9315d15e76d1", "value": "12288:/M8whh2Y4YTk53/yxgvcFtSXB935jI9ituC9yQOQxK/dQQaI3Ve:08whh2Z3/yuU9XCwQ9K/dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684104956, "uuid": "a19505da-392f-4215-b46b-7d803f0f2c30", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684104956, "uuid": "9cca0b5b-97b9-410b-9737-36baeb4e607f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684104956, "uuid": "87332a7b-4e6e-406e-95a9-58b67c5ed431", "value": "Maynew-order #Brazil-098484OBZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10d677f-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058256, "uuid": "082d8691-85ce-4959-b5bf-2353f6759ec1", "comment": "Malware payload (AgentTesla)", "value": "d3301e432e44d8714c204e76d4ae1dd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058256, "uuid": "6bdd83d3-67eb-46b1-b446-c5cf62810f35", "comment": "Malware payload (AgentTesla)", "value": "28c3fe7155927cb7482afbe59c25193a1a34856caa296cec11f9a3404df33d7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058256, "uuid": "be6fd413-0d9e-432c-be19-b73af18ef0bb", "comment": "Malware payload (AgentTesla)", "value": "5d27d9ab29f9bc918b3a0c6ff6e395f074f2f853", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058256, "uuid": "1c6320db-e588-4752-8ffb-c0e8f7dbd3cc", "comment": "Malware payload (AgentTesla)", "value": "a23b923a250093e9039c0545d3d4083086d481fa47ad39570b327bcf496e296e818053c922d0653306cbbeadbad76b12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058256, "uuid": "95ff1da4-9879-42be-bb63-e6403c4be189", "value": "T119E4AD535065CE5FFE2ADBB090B4FF45B6F1F07360D194242BB921C9CAA9F021E8D52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058256, "uuid": "0b0d6c31-b142-46f0-9a25-1df89a28ee0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058256, "uuid": "0aa3f99c-3656-44fe-ab3d-f4479e20146f", "value": "12288:ZtZ4s9CcqGzKXjogFrxgpNAf7L7cGR3YA8FMHrsoO0GLpbhegQVt:ZtZ43cd+XEO6G7LQGnRHrsd0Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058256, "uuid": "120572b3-66d5-4914-96c2-76cf18242b13", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058256, "uuid": "8da99c4a-1fd7-4056-bf69-e4d71f5dc1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058256, "uuid": "779803cf-c0d3-430d-bdf2-c981891a9fca", "value": "28c3fe7155927cb7482afbe59c25193a1a34856caa296cec11f9a3404df33d7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421e5a75-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032703, "uuid": "9334f16b-4bde-4ea0-889d-62a2c27ff983", "comment": "Malware payload (Mirai)", "value": "7adc11da2a079540f6055fe539f177bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032703, "uuid": "9640e8f0-40c0-4fc9-b104-6e7baba048a2", "comment": "Malware payload (Mirai)", "value": "2ad43d2845ceedb5c18fda0cf5c0d5cb68972fb473485e1508d38fcfcf87077a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032703, "uuid": "702af1a9-5180-40d1-8831-146ff5607825", "comment": "Malware payload (Mirai)", "value": "bec531724186f9e20f25e41709af2d4ce6765115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032703, "uuid": "56477953-c4b3-4ae6-a46b-0eafc175d8f8", "comment": "Malware payload (Mirai)", "value": "c3b4bde8f78dcf91dc31d5c52a39abee4f907c39ae08ba21c5bfc9d1dc017256803e8fb5455d941216d869064f3e477a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032703, "uuid": "60fc0fab-dcdc-4c47-ab93-e720c6cfa959", "value": "T105331A55F8828B12CAD05276F92E599D3B2567ECD2CF7203AD122F6072C781F0D77A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032703, "uuid": "9c73c79c-7a4a-4e6f-9de0-74893c1df79b", "value": "1536:4I94BUJThUT5Y7hoYYkZf822R+2/8hRtu:4I94WHho4Zn2R+sMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032703, "uuid": "01e3c18f-13a3-4828-be9b-37bba0879415", "value": 54288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032703, "uuid": "fc3de4f8-10d4-4c7f-a383-abe103afd666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032703, "uuid": "479bae9e-a6c3-4ba7-af40-e6a97e71b500", "value": "7adc11da2a079540f6055fe539f177bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4b7539-f230-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052505, "uuid": "27a073f3-a607-4b5d-993a-d30e3bcdf5af", "comment": "Malware payload (Mirai)", "value": "1cf6496a5ce2bbb9fded6938c209dd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052505, "uuid": "b1b2be99-e013-439c-a42c-db9024bb1dea", "comment": "Malware payload (Mirai)", "value": "2b39e144fe6c0c10ca034e9d1a2256429fc96ef5e3045ba41d5184eb8f8e4534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052505, "uuid": "a299bf5e-7ed3-4d2b-9ff1-043346abb0cf", "comment": "Malware payload (Mirai)", "value": "abfc1ce2f01aecf73a036147b20f12eb459fb8f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052505, "uuid": "50432d9f-afb4-4f55-9dc1-285c1432127f", "comment": "Malware payload (Mirai)", "value": "a9db691aabb3348bc1f7eef5fa049479aafae2267fb4d30bca3cb77882026d267a093d4032310ce6b72a76dd9917d6a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052505, "uuid": "2aef760d-fa72-4197-896b-1639ce431532", "value": "T10B536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052505, "uuid": "48fc904a-2ac1-4b7f-ba0e-dd86cd50dd32", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8G:p5VHV8I9cKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052505, "uuid": "5dd992d3-5b9a-47d8-9ab4-afc89b7d9450", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052505, "uuid": "0df72ac1-e6dc-4dd5-82bd-257f9f54923e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052505, "uuid": "d4164135-8c3d-4e09-a473-5136fb9242ba", "value": "1cf6496a5ce2bbb9fded6938c209dd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d43f2c-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089755, "uuid": "981c6869-3d7d-4fd0-a305-1b0e90fa64bc", "comment": "Malware payload", "value": "2f73b57cefdc49066c3be08d13668095", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089755, "uuid": "8b16b887-9b76-4679-8e93-ef51ba4fa645", "comment": "Malware payload", "value": "2c8d655808cde5a1107bd7164150d1b7a147f977030ceb18836f9eaa780744b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089755, "uuid": "a3d806a8-bfc1-4992-8077-0d98dfa93851", "comment": "Malware payload", "value": "374804c5ac98876ca07763f0d86f74f2ab9d160d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089755, "uuid": "a12f5313-75dd-4ed7-9b57-a03e5405e894", "comment": "Malware payload", "value": "27195f4340504d3cd206ff98001400f0e2fe2d94e74729da5b40fe73e990f437d4045b5ba45deeec4b30ed6dcc32faaa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089755, "uuid": "894a7429-f4ef-4c3f-acc2-122b51b9c82f", "value": "T17DE42383548A665F5B9536AF4470FFEF242A79B03CEEF242C16961543EB752E0AB8013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089755, "uuid": "0600a94c-5f34-46a9-ae69-2b5b0494f444", "value": "12288:ZG5vpuuBRwujiocl3zn1P5Km40FBj32dgwFgm5NsEacECcH7d8+GG:E5wuBRNiRNz1Q0FBjGdgmgmgIECcmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089755, "uuid": "148ce664-c8ba-45bb-b4d6-b95fde2f5214", "value": 704587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089755, "uuid": "d4e25c19-b20f-4f21-8556-c4fb1a0137fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089755, "uuid": "be2ca661-e75b-46df-86cc-c848479e3d4a", "value": "unknown.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3664cef1-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089806, "uuid": "15e0681f-8c51-4d9f-b529-82724efbec6e", "comment": "Malware payload", "value": "50766584b40792232b604077bc2b3920", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089806, "uuid": "95eab5ff-5832-4bd0-b45b-ec63dc4d881d", "comment": "Malware payload", "value": "2cec9b371ffd366272c5f841412029939de35889f9ff35cf46aa79856ab7bb42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089806, "uuid": "ed59a22c-b938-4a04-81b0-a8fc356c1867", "comment": "Malware payload", "value": "42a05b2a739df41cc120a9c67422aa76a86a1724", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089806, "uuid": "b8e8055d-bfd6-4d0c-9e32-8f1f6d269fc2", "comment": "Malware payload", "value": "b5afaa9fbdebfb678e3d71a63532d9f65b78edc3e19261c198c5f8fc55c79d32cd47069d5ed0c3ead0d9ef2ea9b1339f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089806, "uuid": "a19fe808-5bd7-4dec-a5e0-eb266ae71606", "value": "T1DC831348D84724E969B267BADB8A08F5EF73027711344E89794D40B49FF8824CDA6DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089806, "uuid": "b71d5df1-e15e-4515-8955-2f3364b0f6f8", "value": "768:BIm8qj1PK2wPBxx6Jb9F7C3SESDDJtLgPTxG01qbi2rSphNdBjCS6NPgOzKVatJG:BuW60Jont9j8KVKJkarJg5PZvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089806, "uuid": "67c11ec0-0325-4d45-a9a0-51d392e9bb3e", "value": 88331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089806, "uuid": "b3780fb8-ee5a-4ca6-9ed3-a370cc757659", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089806, "uuid": "3a8551b4-0809-4b2e-8d5d-f536176fdf8c", "value": "werwqrqrq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfa15f4-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1684055858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055858, "uuid": "a18b8894-7041-4ac0-b518-7e483e7231bc", "comment": "Malware payload (NetSupport)", "value": "1b0eaa2c2511d5c5bf2fff542b172a49", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055858, "uuid": "5cf71582-b4d4-4bc4-93d6-31cc7d656129", "comment": "Malware payload (NetSupport)", "value": "2d16b8541eb251e09be8589e1d140a14f8392cc055d3b15936edcddad91b5923", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055858, "uuid": "6322022b-2774-4129-a02a-3aba5f97a1a3", "comment": "Malware payload (NetSupport)", "value": "bce5600d8e4bb7353b67f52a388e56063fd1ae85", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055858, "uuid": "dd649c61-102b-40cf-a8a2-0fa73d8350a3", "comment": "Malware payload (NetSupport)", "value": "c5a2b0caea204543a20960766a0e479706310c8b06368b94a0726e7260642fd20d7ea7ae52df417be9b48e0243aa3368", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055858, "uuid": "2af178b5-1f0b-418e-9647-8391473ecc2d", "value": "T113E2DDC836D2E0139A2FF07A76AEECD1E21A85055BC2150BB41C7258EF95C3CCF557A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055858, "uuid": "9dcf1d9c-a471-48e3-a262-b32d699db0ea", "value": "384:IsDLhfkGwaE6EIWNIalL+W9zCdrnQfF+M5WHZX8thvrtVOETBFtXBRo3yhuiUhR0:XMhIzWOzQfFb5q8hfjWouiwRoz2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055858, "uuid": "eb0edf02-af3d-4179-beb6-f797b2a1b54e", "value": 33014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055858, "uuid": "d01b994e-385e-44aa-802c-0b3b6bd65d39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055858, "uuid": "62ca6ef9-6189-4458-9359-b8885901f8e9", "value": "2d16b8541eb251e09be8589e1d140a14f8392cc055d3b15936edcddad91b5923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f8e6d0-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089636, "uuid": "61dece6d-f0b9-4b31-bc81-ced4c257fd82", "comment": "Malware payload", "value": "c1f9283b7ad8457160d3c189430f2c75", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089636, "uuid": "6c7e3979-b673-43c0-98be-e39745917fb9", "comment": "Malware payload", "value": "2d258710afc74a67381326bbbdff1a2fcc569fd3008398625a7d412877bf9666", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089636, "uuid": "48b58091-4d60-4732-95f9-a76f0cf88ced", "comment": "Malware payload", "value": "9eb837b2ddc15878609c5ea1786d4294caa483ea", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089636, "uuid": "22f52102-48df-417c-8cde-28a8092943aa", "comment": "Malware payload", "value": "dcbb38170c886c3775605a1a2a960840f0c8c905584cf364a04707b37388ef20f14f444d98588236e6e54a982743e102", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089636, "uuid": "76d587ad-ed01-4c7b-9ba2-c75eecb799c4", "value": "T112A4234AA5E4A405C67F2EFDF113DB27FAA433A0DF722E89C67441041861F695F50F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089636, "uuid": "1b216ca5-6806-419e-ad9b-31b1480055de", "value": "12288:eUK8CPMRAfL6R1O7Irikzw+jElraAxgyZzw3yIQ:DPAL64OiSw+jyaTyG3yIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089636, "uuid": "ce071000-b4c9-49da-a947-a3ed6e929579", "value": 473875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089636, "uuid": "d6102d9b-9557-4be8-8131-1e983c777d2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089636, "uuid": "a171b1ba-12cf-4dc2-9027-1e88f5d8d3ad", "value": "Samsapo.A.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec9bf44-f26f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684079646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079646, "uuid": "bfe84c2c-254b-4373-b6ec-fa310c3d79fc", "comment": "Malware payload (RedLineStealer)", "value": "5c0ebcb335c6d612f6c1d1e6ad241f2a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079646, "uuid": "d112127a-bb0e-4d14-af53-fd8ceeb702ac", "comment": "Malware payload (RedLineStealer)", "value": "2d39cfa12c4f0ba5c37666a8aabbe8022b19b3de2865d9e28d9ee6d9f27aa0ad", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079646, "uuid": "8937b240-f016-4e93-8c5f-94dad2ecf4ca", "comment": "Malware payload (RedLineStealer)", "value": "f694d29926cfd536edf14f7deeb1a41cb5a7121d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079646, "uuid": "b5978448-d99c-494b-9427-5870131ffef9", "comment": "Malware payload (RedLineStealer)", "value": "439f118d18d1531d1d442e174d874b598964318dffacde9665b81a7618b56201f0bfcf7ed15235574cd89c7570656bed", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079646, "uuid": "54fe8768-296e-42ce-a808-55dad75131ce", "value": "T19E452397B5D941A6C87623712CF607830F3A7D811C38666B27C998AE18323E4963637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079646, "uuid": "80aa4b44-719f-4504-88a8-3b3a0030e3fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079646, "uuid": "c0b2863d-6acb-4b73-9c8a-48423ce1f816", "value": "24576:CyFTzmUdWxAmWWFRPlemS8U+Hou9SKNU7RMsAX8f:p0Aunlel8tIu9SKiMsAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684079646, "uuid": "f3411afa-39af-48f4-bb76-15845475254a", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684079646, "uuid": "123388e6-eec5-432b-8ba3-deab0d536369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079646, "uuid": "4969144b-0380-4d8e-a88f-2c650d116fb6", "value": "NyanCat2482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2edd63a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089585, "uuid": "261fc4b1-1d9d-4ab8-a9db-348c7d0baec0", "comment": "Malware payload", "value": "ed1e0689f93b0c57e403489bb5338f59", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089585, "uuid": "7d03db72-4232-40f4-b1c5-0972accfbaa9", "comment": "Malware payload", "value": "2d9225663e69295ef036a04a9393953db0d66fd74955490566e0b099df8655d8", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089585, "uuid": "7aaf8c03-1478-4997-acb9-35a66792c980", "comment": "Malware payload", "value": "e993933010b85fa7fa4eb23cfd365240ca222c79", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089585, "uuid": "6e458ded-3bf0-49cf-82d8-7b7dbca30d18", "comment": "Malware payload", "value": "0be9b610fdb659de09d87e993e1daf5b0523a6647ee074a161537ea016761979b3f8fec7d3b6782fd8cb0cfcbe12f08b", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089585, "uuid": "91750eba-83ea-45ae-ab65-6115d5596bf2", "value": "T165B52383E709D896E6A7CB32812A0152AD781C915F67E3F55A01B97C4BF7BE08704F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089585, "uuid": "061ce137-4f42-47d9-9144-88480ef252e2", "value": "49152:d5u3skfuOLooLi3jXbqLNz49rcHuqQCGPJXB37Ck6L70dnXy7F72hq5zwa26VOle:d+fuOLoP3jmLNBQCGPJXB3ty7YnXy7Fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089585, "uuid": "ff596c15-1e04-4cb3-b4c1-3d421108683f", "value": 2481306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089585, "uuid": "a166d363-c430-43dc-a847-cba573d5fcf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089585, "uuid": "481697f7-2117-4a53-b9b2-af6a19f47cf8", "value": "fakeAVED1E0689F93B0C57E403489BB5338F59LabelReader.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1be617b-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058257, "uuid": "01195490-e721-4033-bb6d-c5addf5c56c3", "comment": "Malware payload (Formbook)", "value": "78b3cf5e92f4a7fdc41c018a2fae8305", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058257, "uuid": "37fa3ebf-cb17-4a22-98de-2b97353220ec", "comment": "Malware payload (Formbook)", "value": "2f06963075874a8b1b409c7d9fb443c4fffe7d8936936d49f00c0c5d1b71590c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058257, "uuid": "5c612c57-9f4f-45eb-a568-570b8e2c1164", "comment": "Malware payload (Formbook)", "value": "f8138b53415a4df2e61fecb2c0864ee4d9b17075", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058257, "uuid": "a9c85aa5-eb18-424b-bd37-205f7c4e4c80", "comment": "Malware payload (Formbook)", "value": "fa810a11e5718846279f9286e241857e23e03322b68d188a63e567f780344dfda7a76c3263af1e99030a04c0bac253d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058257, "uuid": "74d6ca66-bb8f-44f9-b942-f2db95b74edc", "value": "T1FF64120C3195D5B7D8526732167A16B6BDFA140948F587CF27402F4E7EB2AA6EE08333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058257, "uuid": "1591ae1f-85ce-42c6-85ac-974040f77e5b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058257, "uuid": "e57ac1ca-a2e6-4b39-960b-e36bcf6617ae", "value": "6144:vYa64VR/Dpcr+9HaLf3Q0ag+l11NnbXmIEikbY/Alhm9KD9lRbC0psaf4n:vYOVpDt96xoxrhEQwhm9KQcs64n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058257, "uuid": "2575dc58-979d-46fa-98d1-ad55bf117ff3", "value": 308927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058257, "uuid": "a0a666bf-6027-4672-ac43-61e8c4c06676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058257, "uuid": "764279ef-7466-4741-bdaf-3221913d5f05", "value": "2f06963075874a8b1b409c7d9fb443c4fffe7d8936936d49f00c0c5d1b71590c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55196f9a-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032305, "uuid": "883cc82d-b8a6-4934-8e99-a0e06ef7d1b0", "comment": "Malware payload (Mirai)", "value": "b8ac8ba6f1028d57de25b5f623d1aba1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032305, "uuid": "2d10b5dd-ca4c-42a6-81f9-a26b30c72354", "comment": "Malware payload (Mirai)", "value": "3000394baf05440426ceab7b18f203fb6fb8d98b1ee14def09f87560ea8ea9ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032305, "uuid": "29dbcc15-061a-4ab4-923b-dd380ca89b7a", "comment": "Malware payload (Mirai)", "value": "72102d929594f9226765399632b79c2d26779fb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032305, "uuid": "35d463e0-e855-439f-9eb1-a0cd252d2f69", "comment": "Malware payload (Mirai)", "value": "41cf3700dd2b1737b453d257870c3e5f720b5375f7c1d3bbce6b50285113bcf7b041a386e4947ea487b39952430d9d07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032305, "uuid": "877a4e8e-0d56-4a66-9352-94291e3fdd21", "value": "T16EC2E1E07726EA31C420AC7DE53A4C8A3A51067C81FF393764258D358FC164B63E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032305, "uuid": "58d69084-43f1-41ad-bcee-e6fbae8d735d", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrW9q3UELuM:NKy4qfqoeJdXWg7LJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032305, "uuid": "e3dd9da3-21b7-49b2-b03e-b9f01fec6590", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032305, "uuid": "bb5fe4f1-3956-4de2-9700-65be6089bb01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032305, "uuid": "62dc3749-e9dd-465c-8a0c-7361e4acbbda", "value": "b8ac8ba6f1028d57de25b5f623d1aba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd95ad6-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "0c133c0e-4f65-4d4d-9774-821317e49363", "comment": "Malware payload", "value": "895f7fff165ddfba70b7d718ac3de989", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "cf9aef9b-e6b4-477b-ba13-01c47e0a5491", "comment": "Malware payload", "value": "311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "595a2c4f-203d-454b-92f5-03ac8b8d94e7", "comment": "Malware payload", "value": "2663c2ebb853083f5cf645cdc0cce31c8ace4fba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "f7b18a9c-b34f-4234-afad-0994725a2090", "comment": "Malware payload", "value": "69b555f3b95cf32cb014f6c8c84fb2892744febaa1baea2570a8a98ea19c1ea797725382a0c2b5711226d356651720fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089819, "uuid": "a0004aa9-9fe3-4f78-9dd2-8ce68943a57d", "value": "T1C3C45C06E243A2F7D82705B0128BF7BF4630F63584129DC6B7949E5AB9339F26A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089819, "uuid": "f1ccfa1b-db21-4e49-a6c1-cdc1e7ae43ab", "value": "12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmxd:VIv/qiVNHNDEfJKHZ8mG9QeeOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089819, "uuid": "051187c0-1f1e-4387-9f8b-80e5a17bf81c", "value": 562263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089819, "uuid": "506e34ea-3dd7-4ec2-a0da-acc86d431ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089819, "uuid": "358ca5a6-4fc7-44b5-a607-ef377cc4b030", "value": "xlzyktus", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e44a52-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032732, "uuid": "01fccf67-3ff4-4094-8fcb-610a3f18ce73", "comment": "Malware payload (Mirai)", "value": "c2797d8d9e535e2dce2b9ed0aa280d90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032732, "uuid": "6b00594c-8fe9-4285-a47d-d2f3ec985cbb", "comment": "Malware payload (Mirai)", "value": "311e205cf446278cfdd9cbb97ea38731215e1a71ae5b0650ad622eaf25bc944c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032732, "uuid": "777ea47b-bf2c-4030-b04f-61f63a5de442", "comment": "Malware payload (Mirai)", "value": "d7b523d0efa3f248bb14bcd08f2927dc8e0ee0d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032732, "uuid": "d3aba888-1eaa-4c47-b338-9473b159f6e8", "comment": "Malware payload (Mirai)", "value": "f9a09ef6f5cc0974fb7f47fa9ccdf021c20952002e62ed5d7157b93e58647351954629315a51adb94b286f1e6fb54d4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032732, "uuid": "8cfa1fca-6b68-4646-86ed-f7645b36c79f", "value": "T1ED435A21B97A2E27C0E1A17A21F74B24B5F517CE2690C61E3D320F9DFF515006A63AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032732, "uuid": "37dd7935-5959-4c1a-b98b-8b25bb7431c6", "value": "768:aWouIDOmZdPg9IuI72RJ+Bz7UZm/4a5H2Eyy4/udsizfO+I0OwSGoq:aWJIDOmZdo93A2Diz7UQ/4mB5vOXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032732, "uuid": "1f3f6b78-235b-4158-806c-f47bddd1e3ec", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032732, "uuid": "16248416-445d-4900-9fc5-0f6619ce9de2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032732, "uuid": "27935b1f-3e6b-4785-a0a5-94e445db9848", "value": "c2797d8d9e535e2dce2b9ed0aa280d90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a101a6-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089105, "uuid": "22bd60da-c5c8-412e-b8ea-0c7087fbf8bc", "comment": "Malware payload", "value": "c71740ee94467ae70a71265116d54186", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089105, "uuid": "8e27db78-b49a-4d5c-914d-c5ab009e37fc", "comment": "Malware payload", "value": "319a962f486080b4a7dbe1896a4f1a345d86c5644ebedb8f28ab2b737cf9deeb", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089105, "uuid": "1425e859-8cab-4998-847b-eefdddbe5905", "comment": "Malware payload", "value": "7f292c579e49ea9b85317284ccf26d72dbae341c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089105, "uuid": "a7ab9c92-874c-4cc4-a338-5ae7e129c243", "comment": "Malware payload", "value": "17b3d9aedcb26da4c6018de6100841f3f1c860525f030a1238ad6ab8d5bb0496f3081610e2a77bb786036d5ebbfa9aa1", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089105, "uuid": "b5e4c1c2-7f4a-44d0-b018-96003025d74b", "value": "T125642226A3C3A1CEF4F70CF570BE1C91A4E54AC1B801E95E0AD07E6945F9E485E3C7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089105, "uuid": "aa795a01-d0aa-4b8a-86e4-789391723a62", "value": "6144:kHt19OceDpmLXFFbTCTPJuTg9IhL34hhVZAj78hTRXToP7Pxc42yL0:4IDpmLXnTFPehXT87PxbLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089105, "uuid": "a3dc7ede-b1d9-4b84-96eb-6d7d5a35d6af", "value": 335621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089105, "uuid": "9e66616f-b0a1-46b4-887c-4670623ada33", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089105, "uuid": "f8d59e7a-c687-4ce7-b304-ac94d07c5a1e", "value": "C71740EE94467AE70A71265116D54186com.zqbb1221.pic.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27271f2-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684058258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058258, "uuid": "b6c37e23-00f1-4e6d-9b45-8e16f7d3b702", "comment": "Malware payload", "value": "2ec877e425bd7eddb663627216e3491e", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058258, "uuid": "fc237726-a0a9-4d02-873b-35f450110e55", "comment": "Malware payload", "value": "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058258, "uuid": "1f0ad993-5ff2-4070-b83d-973031ed6357", "comment": "Malware payload", "value": "d4f5323da704ff2f25d6b97f38763c147f2a0e6f", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058258, "uuid": "07107a13-40cd-4b45-9dab-611ad342c8e6", "comment": "Malware payload", "value": "c3e9b1d4c71f0d1fc497454c81487b7320a8220e66a8b0acd9656971dbf4da5b31298dd44e6b108d9c1cbda23e1e102c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058258, "uuid": "91456d8d-486e-4843-9b7c-c0d9770751e2", "value": "T11E451206E25240B3D0E78239CA934755F7F9780327A12ADF7B6C46865BB27E0E63D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058258, "uuid": "3d779c6c-7dc8-465d-be41-348361504b7b", "value": "63fd1582ac2edee50f7ec7eedde38ee8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058258, "uuid": "c4a81f01-dd06-4334-bff1-dd78b8ccbc01", "value": "24576:/Ba8eYFtU1Djmd1Hpc+rTn/tDIniw7tfPBLhlBFQ+ZVoDI9F/wXKbKDnLt9:/A8eYFtU1/MHSOn/tDIx7tPNBFXVYI9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058258, "uuid": "44c30686-e030-41a9-b770-13553eee2ef2", "value": 1213656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058258, "uuid": "d614f555-9851-40e6-8fbf-e4cb2a1cbf6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058258, "uuid": "0476f37a-e624-42e6-921b-c5f5729c9255", "value": "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1e4147-f24a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684063751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684063751, "uuid": "73518a73-11f5-4db9-847f-d46aa99556e9", "comment": "Malware payload (Mirai)", "value": "be8d693609ae90f6298ac8c8c266de14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684063751, "uuid": "933c8da5-bbc4-4dd6-84f3-a8acee89756c", "comment": "Malware payload (Mirai)", "value": "32f235cf162849caeafc87151cbd868b3d4f9aec63a7753fff5d96cdb82dae41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684063751, "uuid": "a9d344f2-3cde-4362-b884-18033a34c707", "comment": "Malware payload (Mirai)", "value": "32c7b2736849cf611408674f9dae5b2f254409b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684063751, "uuid": "99b9f9bf-adee-42ac-a63c-7f3d1c7bd209", "comment": "Malware payload (Mirai)", "value": "970f869661bbcfee9b6e457a0823d7e4d8642a3911ed70f608edf70c589187afe17690b01a2f2f1b7ad5904f23880d56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684063751, "uuid": "1fca2b51-855f-460a-abff-77491daa4eb5", "value": "T16DA2E029BF58828BC832797455D9F5D21357FCA1F29DCC4A3940C15FF0A33A96874E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684063751, "uuid": "23d0a8b8-ce36-4e1a-959b-654817087044", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT3:798o08kxofBE+ZkXaITbp2F2TWul0c5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684063751, "uuid": "e5c93602-c831-4644-8dc7-6a4d7da8f982", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684063751, "uuid": "d81e8f54-e00b-4f92-ac6b-6b651de6afd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684063751, "uuid": "78759c2c-f320-481c-b0e9-dac0585907d5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f154d6b3-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089690, "uuid": "177c1380-0152-4d4f-b16d-a48bc84dad57", "comment": "Malware payload", "value": "660bddcdc210fa625a8efe8a00e200a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089690, "uuid": "6dbd3c5b-0cdf-4437-a33e-31caa36f6443", "comment": "Malware payload", "value": "33bd5f25cc8e42ec7a0b58cd3aaf380a04f0f0150fa75dde42c04c3092d30a60", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089690, "uuid": "f3da05e6-12b1-4dee-a3cc-be3da9ab4df8", "comment": "Malware payload", "value": "9a32d5c2a3f1fbdaecefd56d0acb3faa4d644d33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089690, "uuid": "3a5af702-8a27-47d4-b858-994d5c056cee", "comment": "Malware payload", "value": "80a4bf7a7c0ef61f49e3f73ae828bd7aac1e60818bd761379ee3548512f2000df533e42909784d2bb6cf3800cdbfc678", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089690, "uuid": "2bf35369-9465-4724-9e79-32945361daa2", "value": "T1B263234C984724D950B1BB78CB8A48BAFF73417311344E81798D80A5EFB9429CEA5EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089690, "uuid": "807a9f62-96aa-447b-b860-2855e5047475", "value": "1536:BuRzOT02inZChRGNjSy22JJkarJGLFIZvT:Ba202nONj9zJWe4LGZvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089690, "uuid": "3339cdcb-4ff1-4f11-9722-596c0f35ffca", "value": 71942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089690, "uuid": "709fa9bc-2c85-47d0-9c21-a31e04112b18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089690, "uuid": "b5f554e6-ca7c-44fb-893b-7cbd28bf61ac", "value": "spicy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4f18a7-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089678, "uuid": "8c4941ef-7726-41c7-9eb5-5133837d0bcb", "comment": "Malware payload", "value": "e4764a7594668f222b75f5e8f50d60bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089678, "uuid": "5b0ce017-e649-4342-8a79-f0f2833cffa3", "comment": "Malware payload", "value": "34490ea4c1b5e274d6d4e8b14c2edf01c6c0746613c24d14a3df192de00a3883", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089678, "uuid": "0a3f152c-daa7-4711-9e3d-a249fe9b3f80", "comment": "Malware payload", "value": "062b1cb71364e44f75a5e4c617b62c05e2e57222", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089678, "uuid": "fda654ce-ebcb-43c8-8438-4c716b315ca4", "comment": "Malware payload", "value": "c298272972e1b0afc12c2c00f2e55197d18730ca31969f90fab099645c7b657f6a2b04eb6a339b6a9e17a4237899f9fe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089678, "uuid": "235f87cc-5288-4a94-b56a-a938ac3ab4eb", "value": "T1A3C31956F254C522E49002B3A0803F72F7B5ED3416945A5BFB58D65AECB8FCBA92C207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089678, "uuid": "b6f5ec32-25a5-41ce-95c2-c9dfb21807b6", "value": "1a18b668284dbadcaf9f6749815ce74e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089678, "uuid": "37493a92-18d0-4320-9439-e3256101e51f", "value": "3072:/UG+nC2L7jzD6GgR1/ytWj2TuDVsk+f32ipMGtINrGXdsoNwTYVKjGZUK:/gnxWjNBsk+zWVGXecwTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089678, "uuid": "427b0a80-e509-46ef-8bcd-779181eab288", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089678, "uuid": "176e91dd-73a0-4868-ac21-4f719c277f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089678, "uuid": "cf7eadc6-7158-4376-a953-a36ae45a6f3f", "value": "SkuZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2c3c10-f231-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052798, "uuid": "5ddce2f9-36f3-4646-b25d-5586787772cf", "comment": "Malware payload (Mirai)", "value": "3be4c48159951b14311c8dbf861acb57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052798, "uuid": "c89090fb-e67d-4356-860d-5e4ac2528f02", "comment": "Malware payload (Mirai)", "value": "3495c9a42b188b501d941d80d90d675e53d10cf9048f257d5c96cd8287a0b310", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052798, "uuid": "73714fef-ef27-41dc-835f-b6827227a3c9", "comment": "Malware payload (Mirai)", "value": "328b958bbe35d3f3a1a0f54c7082e60f46213ded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052798, "uuid": "c6ece245-20ac-409c-bb94-e8e182e950e9", "comment": "Malware payload (Mirai)", "value": "904b32e76294de3d9330790a2d4991609481c1c0d0f474a350b6fb52d658483807fb8360b0b9f68215c72464310430ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052798, "uuid": "4bada6a5-15d4-4662-bbd1-4a34b54fc4a9", "value": "T1ABA2E118BF2C858BC835293942E9E9C622A1EC21F3DDDD065E50C06BB5B33D67430F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052798, "uuid": "eb2c6263-f4c6-4943-9775-24fe18484e70", "value": "384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXa2UbDib+502F2vwA9B1fKVVXC6Sya:T98o08kxofBE+ZkXaXDibp2F2n8VVXCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052798, "uuid": "5053031c-b95e-4da3-a219-288b0e00125d", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052798, "uuid": "26236ebe-8d45-4d8d-9ed1-d50c8d5662d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052798, "uuid": "1b542492-e057-4b22-b6a7-6112c2b836df", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ace0ea-f246-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684061881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684061881, "uuid": "8249f23c-915b-47a2-853b-11fcc9b68eb3", "comment": "Malware payload (RedLineStealer)", "value": "86d232a08372af39ee2ef042338881c5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684061881, "uuid": "23a660a4-24f5-4191-8eb4-92237c48703c", "comment": "Malware payload (RedLineStealer)", "value": "365d28bfa701268cf37a71766a833344baf2ac64320b4a21215bef8563aa7305", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684061881, "uuid": "e8c22dbd-47f3-4baf-99f3-5159390ee7a2", "comment": "Malware payload (RedLineStealer)", "value": "8edd6012e94ec1c38e4bbb06b9edea357f3a2a85", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684061881, "uuid": "1bc4ce72-c4b0-494b-99f9-a5e58bbaabae", "comment": "Malware payload (RedLineStealer)", "value": "38419788cc3550544e5127450bb39c7445ec1cef281db4a22ba4b3994e6af8034d0afda3c0ea52c2e068e647606e310a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684061881, "uuid": "0e820442-6cc3-4533-a629-8629c2ce5483", "value": "T1EE45231772DD46A5D8FCA77019FA13C30E367CA25D7C535F22AA2C0A09B2DC561B237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684061881, "uuid": "516a2f80-39ad-4050-884d-883d20eaa457", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684061881, "uuid": "88efd0d8-b84f-4489-b23c-e89c4f8e8a16", "value": "24576:tyLp1NMB7XcYMpv/NVxKwrtWmAZ50ptDlvj5N/hGyQWZaXEzF0Pc:ILpfU7MYMpv/NVxKqAwpFlvj5aYDF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684061881, "uuid": "91e065ff-08a4-48be-8135-3f96b46d6d96", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684061881, "uuid": "11f25eb6-a2fb-4368-b6ec-fd811b7d223e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684061881, "uuid": "9034db17-0b04-4ea8-ab52-713a88d788ce", "value": "365d28bfa701268cf37a71766a833344baf2ac64320b4a21215bef8563aa7305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e68536-f23a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1684056846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056846, "uuid": "cf026f4c-a5d2-4da3-9233-d2799d1821ea", "comment": "Malware payload (AveMariaRAT)", "value": "f25b7fbd7f2e7fc3d8fe3d63d5daf2f7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056846, "uuid": "2c06c40a-6baf-4d60-8172-a2732c444730", "comment": "Malware payload (AveMariaRAT)", "value": "3736badc4fddcf105a89c5cc006d2d4e248bb89ffcf74401e0b2e14cad585ccc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056846, "uuid": "496af648-bd65-4257-9021-fd8d71109241", "comment": "Malware payload (AveMariaRAT)", "value": "ced4e22cc72be8a1e2d342952bc73e826e7dc271", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056846, "uuid": "49d23ed7-9d3c-4f93-a878-950bc1e465f8", "comment": "Malware payload (AveMariaRAT)", "value": "4b30ee421b76f05b786293ff8aace754b14f5da4ec305afabe3475105dac7c8f04ffb4903cbb45f85726f9442695beb2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056846, "uuid": "63b30722-eda1-4b13-8aef-79a6d31bfad7", "value": "T1CE55CF331983FFD5EA6F0974D88615584C837CA7AF1CB3D17948BC9A75B88209A4D8B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056846, "uuid": "c3a27458-bc2f-4875-8395-d4f683647beb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056846, "uuid": "05e7f823-df1c-428d-8f1b-3073af82e17e", "value": "24576:RuEWHqO5vCZFaK5MRlKLzLg3YptuljIEnKKIXVNlWRrMbfGgxfSKEzY8:Rr5KIzFptulQSrM7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056846, "uuid": "bf5748b6-635c-4821-8ba3-010465431d99", "value": 1381376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056846, "uuid": "cf5b66b9-9335-4ee8-9463-e663d9ef8ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056846, "uuid": "a72dacf3-ed19-4a1c-9884-c8695541d857", "value": "3736badc4fddcf105a89c5cc006d2d4e248bb89ffcf74401e0b2e14cad585ccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3690ec-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089630, "uuid": "031eb210-ad8a-4759-b158-629870e12018", "comment": "Malware payload", "value": "f811ccd93ffb3f95936cb5c27fda2c8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089630, "uuid": "ffcc0036-b8d6-4578-92fd-3e3af23342b8", "comment": "Malware payload", "value": "3823c1da096ee28ebd08b28e245ca73054ae56a12d807ceb3078e4361f34dafc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089630, "uuid": "687ae063-b492-4972-84dc-0b2301d0a54e", "comment": "Malware payload", "value": "33868ea6068f0891f102fed02e2ef571b214caa2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089630, "uuid": "76b047d2-35b6-4f51-a70b-55662625a82b", "comment": "Malware payload", "value": "61465f4431945e4c68262e5e24def1c77cbc87d177f554392c6404b7079995fe00d06f8ba32e9a13e45ad3fb73049b82", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089630, "uuid": "9a84c3ce-d8fd-4457-a2c2-06f72af32bbb", "value": "T1F33612F96244375CC41A8C389033EE08A1F71F2E5BF9D5A939DBBA807F378159562B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089630, "uuid": "d5f9b430-d79d-4829-a6b6-aab59f3426dd", "value": "81b5d6c927f9e23858d4be4a6c0c0141", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089630, "uuid": "505d5cb1-a855-4b5c-b547-874e0646b187", "value": "98304:W5ewUGTeiPA3KXIRz1oWodf9egZnKJTWwO8jWU0J9i7UYKSkY/WTR:5tGf4zzzmKJzOF5cUY5+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089630, "uuid": "7dcf8542-7fd7-405e-ab90-8ddc5ecef88f", "value": 5257728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089630, "uuid": "6d574c48-0a52-43db-b459-c8afdba53434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089630, "uuid": "3c1333a5-6b25-4f34-8e83-02aa58a6a6a0", "value": "Orangeware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170f6e6a-f27f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684086318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684086318, "uuid": "4f871d57-adf4-40de-9f93-597c921e0882", "comment": "Malware payload (RedLineStealer)", "value": "7bd5488703c228603ee9af6f631ab3c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684086318, "uuid": "41d7488a-2654-4bd9-8ac4-854edcc1c846", "comment": "Malware payload (RedLineStealer)", "value": "3897e1a1c282b3363960393cd06736bec128f1cd911914124625d8f5abff3c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684086318, "uuid": "a5d4a21a-d0b6-473f-9851-3e2bdc7717ae", "comment": "Malware payload (RedLineStealer)", "value": "c10e2979662367527aba60e257ae8bea16179f1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684086318, "uuid": "1eb03b82-bc2b-41d6-a102-758c46c4feeb", "comment": "Malware payload (RedLineStealer)", "value": "16405e3e4f3c372e3a32e4e39a322f6fa57079528827dabf06f52afe24186dbe2bc9259ac382174148de1207daea602b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684086318, "uuid": "d17f3292-8e4f-4d1a-a98d-5ab0b3bdb224", "value": "T166452303CAE6D173D825273258F707D3093DBCA59AB4536B62A5ADDB0873A89F430727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684086318, "uuid": "f06d997b-acb1-4c75-bc65-fccf682c2667", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684086318, "uuid": "88d7466f-e504-4fa5-b29d-23a5d9293883", "value": "24576:qysNZSd9ni53bJ9K558tVAf/C95JiG0bk5ISpFk8:xEsri3bw58tL95JiGbIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684086318, "uuid": "388ff1d7-2e08-4562-972c-9ebf9ed3b4e5", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684086318, "uuid": "6355767e-ba47-45aa-908a-fd513f04c93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684086318, "uuid": "3215fd01-dc96-48ae-8450-358735266b23", "value": "7bd5488703c228603ee9af6f631ab3c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31da1fc-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058259, "uuid": "fa9b2dfe-44b9-4a35-a04b-532535926dda", "comment": "Malware payload (Formbook)", "value": "3fcd0821cbc88bb18a7b6e053ca107fd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058259, "uuid": "6ff8276b-323d-4a66-9841-b730525642a0", "comment": "Malware payload (Formbook)", "value": "38d07c5d734acebaac3e4882726bb9cee05a51ce0f85a79b303cb1e133254be1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058259, "uuid": "34d455d4-687e-4796-8311-c27318b92a44", "comment": "Malware payload (Formbook)", "value": "66f2541ce25b96b9339bf054c7dc6d99e51f9a53", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058259, "uuid": "10d735bf-31b7-424c-b805-15b247a0000d", "comment": "Malware payload (Formbook)", "value": "4980076e03b9486688268ee7882004d0adea2cef598e1dc2d63f444183789e4f315256c9fb68eb97c74ba1c9ec72dac6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058259, "uuid": "cf382d88-9034-4230-8f9a-edef54dcdf38", "value": "T1BDA41283A3DA5327FAF6D7B7685B84B0C3B1AA535435CC093A44007E09D3365267E2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058259, "uuid": "45ab0d84-8382-4f00-92fa-2885c283580a", "value": "12288:/LCVJ6dZnqKam0UgJHjiRPup0dQNCukXzdMj10aFGCeMLk:/WX6dZnqKam0UMGRPup0dQdk5+J+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058259, "uuid": "f304ec2e-bc02-4c2f-bbe8-e21f587b0bfa", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058259, "uuid": "81f68522-4166-4f93-9280-6148e2ac924c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058259, "uuid": "40fdd1db-4b1b-46df-bc70-d0d6e8381d44", "value": "38d07c5d734acebaac3e4882726bb9cee05a51ce0f85a79b303cb1e133254be1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302441b7-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089796, "uuid": "8b161ea0-b0d9-434d-ae7c-c7419db4d0da", "comment": "Malware payload", "value": "35fc616303d4cacc6922e4aea9713f9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089796, "uuid": "ba08a5e6-7ae0-49cf-bc34-f66813e045c6", "comment": "Malware payload", "value": "39198d3c1aa3a57c84b503b5ee22ac887e6db6c8780aa0f31adcef89b3ffa6b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089796, "uuid": "51653203-76a5-4065-b61c-1a74e1114044", "comment": "Malware payload", "value": "be09925fabc325a208ff7315c69d1fbaa570809f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089796, "uuid": "5d793417-c45d-4f1e-9f3c-3bf5095cf42d", "comment": "Malware payload", "value": "93f58059f30d0542280afafae4e9b0812f921d7f56bad19ec03ebbc200d51c801aec027f425d2b256ed94f65ae8f6ecb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089796, "uuid": "497c6120-a4fb-48d8-a052-06dc6c25df00", "value": "T17C64B03BB780C8F2C485803176996E136EF56C301625EA5BDB60DE0A2EF55E4D72A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089796, "uuid": "7095ada4-20fa-4bd9-9deb-f4f881aef5fe", "value": "a1161b9f4081312e64af594f73664c29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089796, "uuid": "10b5ef41-5010-490f-897c-3a932d4c5dc3", "value": "6144:WTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:oXgvmzFHi0mo5aH0qMzd5807FRPJQPDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089796, "uuid": "719a11f6-2ee0-4d26-accd-5658457ac89b", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089796, "uuid": "762d5b98-1f99-49b9-a80d-776111a159de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089796, "uuid": "86fba24f-951b-46f0-9629-7c35875e85f2", "value": "vundevjtbot.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e8d398-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103412, "uuid": "62c810d6-d804-4a65-8f78-da507ca52847", "comment": "Malware payload", "value": "9fd6e7d76fb8850672f7863c48d6bac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103412, "uuid": "aa36dcd5-5d4e-4f3a-967d-a39ffcd6e85d", "comment": "Malware payload", "value": "393f42a729d6e6e85554eff292393e94efbbfbf3fda1d07bbac94aa7a476b238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103412, "uuid": "716b0f1c-f721-48a1-9727-13115affe790", "comment": "Malware payload", "value": "797f1576b4e409353f18667d9305bab0b8756b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103412, "uuid": "65a3c299-3635-4953-9157-8d4ef0e43a3e", "comment": "Malware payload", "value": "f059b154dd66cecccaded0cacefe009f37c5127c277f64b830a68da7ab4cc97961ab4be79adfcb82ce20abd6b9f5d632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103412, "uuid": "89c33d2a-ca3e-4cc0-acf3-0d6aa9308729", "value": "T10F65AF56F261BB37C92316358D1B42699AE1FE102F29D9873FF46D0C9F3B6C13816292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103412, "uuid": "537a6679-b14a-4e5a-b81a-e45e65941ea7", "value": "12288:PMGsQ5FLPdmaFpCOHorQTBAhGqCUBBpdb97HzbFR89GH4mbvw+:PMxWPQaFpG8ehVlh97H3pxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103412, "uuid": "3c4fb789-731c-4061-a8b5-48ddb0eb762c", "value": 1530880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103412, "uuid": "911b4b66-942b-4aad-98bc-26655931c086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103412, "uuid": "58d32a4d-337f-40fc-a2db-de30e2d4e9b3", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.4310.19737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f08aa3-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684057346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057346, "uuid": "4019e09e-a76b-4e96-852a-5eca5d59174d", "comment": "Malware payload", "value": "b36eb78dde5b8a6af940fa8b2c82a9c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057346, "uuid": "b4b3a03f-b8c2-4189-b8cc-c231b21fe618", "comment": "Malware payload", "value": "3a786b5771461e545d08cafc0aa0a840c91dad339280c5f33dc276c8dce03776", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057346, "uuid": "3cd70e95-94bc-4f9e-970d-9f154fd2b80d", "comment": "Malware payload", "value": "085c1295ad693627d6629290ff773588359084c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057346, "uuid": "cd5f6ded-7396-4d18-9e20-a976a0c670df", "comment": "Malware payload", "value": "a7d2ae491a2765addebaeac4605ec3dce7b3b80ba58c5d6d141fa3ccb614803ad25b6d9ea59fc4371c45a3aff6c254aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057346, "uuid": "9a8fb19c-4a48-49cd-927a-688cacde6cef", "value": "T1D527297B72A482A9C15EC23EC1A38F04E93371791B32C2E7539147A91F529D49F3FA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057346, "uuid": "7da2a06d-f491-4eb1-a626-108ff6bc2f0e", "value": "49152:wmzhi2jvtVbCqjhf+DMU43FIS2mG24XqlIgFYW8izTpUaZs:wmBTdhfMMUE8ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057346, "uuid": "ade8ed01-69f8-4076-849e-04f44694c90e", "value": 21464064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057346, "uuid": "60c8dd1a-a4b1-4f75-aa7c-5f111e449933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057346, "uuid": "4fb58164-499d-4b77-8883-7a5227d5c536", "value": "3a786b5771461e545d08cafc0aa0a840c91dad339280c5f33dc276c8dce03776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8ed27e-f262-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684073841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684073841, "uuid": "135e63a6-8c2e-441d-844c-18c70d55643f", "comment": "Malware payload (GCleaner)", "value": "523db197fe60f616ed74e06306f8cde4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684073841, "uuid": "4cbfac52-cfdf-4a47-8b99-b80582b466e5", "comment": "Malware payload (GCleaner)", "value": "3b40418879968636695bcf99fdf5565346c7dc1ca92622b18dd0d6a7c79e2249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684073841, "uuid": "e83f6b25-738e-49b0-932f-3ab5003329b9", "comment": "Malware payload (GCleaner)", "value": "90a9339ffb46a6e1a3839fe1200720eb14f426ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684073841, "uuid": "96b55835-21e8-44cc-969d-9013984c66f0", "comment": "Malware payload (GCleaner)", "value": "53670e1d0587c133c9dd34aef937b9b9093aff8be099b2c471b202b18c7553b90342860a8dc408992c54d23145769bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684073841, "uuid": "e73253ac-b758-4c4f-b504-8c2c7a8e16b2", "value": "T12685CF3FF268A13EC46E1B3245739220997BBA61B81A8C1E07FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684073841, "uuid": "62e2f3c5-5ba1-4597-9a93-57c10d2e06a8", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684073841, "uuid": "8d3fd283-c4ac-4b29-b846-be794f4ddf2b", "value": "24576:s7FUDowAyrTVE3U5F/PGqKJnKic6QL3E2vVsjECUAQT45deRV9RA:sBuZrEUyjKIy029s4C1eH96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684073841, "uuid": "d4d30bd6-27bd-427c-b1c3-0eb2bbb49bfb", "value": 1766448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684073841, "uuid": "f8aa9ec9-d365-491d-be32-648f5eea0905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684073841, "uuid": "fa1bf83f-225c-4a7f-a043-7ae1a96e9856", "value": "523db197fe60f616ed74e06306f8cde4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f9e6b4-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032662, "uuid": "4263490e-ec1a-480f-993e-51d7821c8abf", "comment": "Malware payload (Mirai)", "value": "b5eecd0cf47724173682a34fde099cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032662, "uuid": "36797ce4-59d5-41b2-a006-c04c3a0dc2c8", "comment": "Malware payload (Mirai)", "value": "3b5013c96728122247ab22a21b94afc992fc8732b5a19bab97996526a0874355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032662, "uuid": "c6cae44d-6639-4333-bc02-e34a84a03b8d", "comment": "Malware payload (Mirai)", "value": "5e28c5bcc83a9268e847204289fc305db1db2f97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032662, "uuid": "2476c34c-32a7-4376-8508-0978a2a99474", "comment": "Malware payload (Mirai)", "value": "501f23c3cc8320e783d1485d0b284d98ccae8875752ef2e88fa157a4fdd92ba1847ca28411a21b314dc358d98fc1bf98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032662, "uuid": "30ad82e1-cab0-4c02-88b6-e8faf3546c8b", "value": "T141336B35E91A6DD0C1EA0274B86C8E785F33A4C4A7922EB2179287B55403BDCF918FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032662, "uuid": "cfc9ffad-7bc1-4ee5-8ffa-9cd15ea4cd11", "value": "768:Wai1U9ZdWeygj3/esLr+/2Fehz/fYAux/gEvhB8HCQRonhRQgbv1vJ:WapnAFMP16/2ARIAPoB8HDGn8gb9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032662, "uuid": "3efcbbf2-dd94-4228-9ba3-cff3deac873e", "value": 50172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032662, "uuid": "452531c6-5604-48c1-b70b-eba1dd2ba516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032662, "uuid": "35823e39-93c5-4ec2-a349-96e6bd4acdb8", "value": "b5eecd0cf47724173682a34fde099cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc07295-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089822, "uuid": "a18cc05f-f821-469d-b602-29713af0f505", "comment": "Malware payload", "value": "57a3a1d7488258dc5827819050a325bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089822, "uuid": "46d9cd12-1f87-4dd0-984e-e8429abd1e4f", "comment": "Malware payload", "value": "3c110511b6eaedfac247bd7b686733cc9ffba3c383c8906e0f883f616b23000b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089822, "uuid": "cb858e68-c7dd-40e3-a362-18e70736dff8", "comment": "Malware payload", "value": "1d633c3526a578af5ed543749a4131389518213d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089822, "uuid": "28c12c2b-5e5d-4f53-94a5-b5347dc7b2ff", "comment": "Malware payload", "value": "87a10cd60a4c00a9abcadce882833651b2ff745a449c2563ac03d811129923d14258611a365bfebd51ee60741c1be4a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089822, "uuid": "63c7e943-9bb1-4a04-85bd-7bffe56526e6", "value": "T1DC1443C84A656872475B6E61763094B9DB3D0E6082CC598FF86F31A1F6CEACDC8D8731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089822, "uuid": "ea82b040-8f4b-46e6-8459-80c96789dcda", "value": "1536:2IOeNlX9U+hDubyvBn3rrd+IcHZAIetUAgTfhwHcQ+yp011Yd3zDZLHVYfbQrNAf:9O8X6+1n3rrd+IcHZAJasp/db+cCWBtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089822, "uuid": "ba5e446c-8ab5-4a21-ad63-8ab9faded0d2", "value": 205183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089822, "uuid": "1db33d79-4497-41da-99bc-4542b55771c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089822, "uuid": "0f5f32e4-b8e6-4594-b149-bbefe1454bd2", "value": "Xuceov.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c7dbff-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058260, "uuid": "e39d1086-7736-4941-ae88-a1e02736e380", "comment": "Malware payload (AgentTesla)", "value": "9ffe57ec9ac7ef82a171d9f415ef3a84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058260, "uuid": "ac5adacc-f718-4884-a705-4ff278fcfedc", "comment": "Malware payload (AgentTesla)", "value": "3e48c872f879fc29b5440b844c42780669d2c2d3c219806d0c02c4839482c86f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058260, "uuid": "f2a34e60-4e77-47d7-bfdd-5d990a7d001a", "comment": "Malware payload (AgentTesla)", "value": "c27e13452bc84b1933a19f4188097a8a8f764048", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058260, "uuid": "930983e9-00fd-490d-b9b4-91fe8e7e8c87", "comment": "Malware payload (AgentTesla)", "value": "e74519b2990bc9e5d084a4dc53d43f4f6b740b643d23760720f4fbb04e42e94c4c55c6714a0969148087a33cd5e9a4b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058260, "uuid": "29afabe5-4779-4c4a-acb4-ed00ac06cea8", "value": "T172E47C526125CE5BFE29DBF09564FF85A7F1B07324E1E0201FB961C9CAA5F011E4CA2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058260, "uuid": "ff4f5168-1f86-4492-8a38-681a28c936dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058260, "uuid": "9621bae8-ffa0-4774-abae-ad7fbdee9cbf", "value": "12288:HJP0OegQVtCS3G1gSzZ2QNHRVAooaVpb3jTfTjrE5PhYccfw:HJPP1jzZ2QNHXAo1TfgTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058260, "uuid": "19f9a84f-f628-4726-866a-803bd27a95dd", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058260, "uuid": "688e0025-576c-42e2-b434-e0a5a48f42c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058260, "uuid": "d3dca2d8-1744-44f0-90e2-8b7f0c17700b", "value": "3e48c872f879fc29b5440b844c42780669d2c2d3c219806d0c02c4839482c86f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44f174e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089615, "uuid": "3583f781-63b1-4552-879a-57be4cbd826e", "comment": "Malware payload", "value": "ff2cbce5dc50f2554f866a88b11c8e8f", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089615, "uuid": "e5df0307-d9aa-4a39-b5e3-00ab67ece819", "comment": "Malware payload", "value": "415e22cd878f4f55cb67bd28e531783f967ab97b2313c4e62b863c3585f51c53", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089615, "uuid": "573041f5-b162-48a1-a4e1-b44e61502fb9", "comment": "Malware payload", "value": "35e916d266be4ba8dc1d0e15915d68f63c978222", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089615, "uuid": "963f5e50-7958-467d-87c7-b636eabb9293", "comment": "Malware payload", "value": "12d91f17813242bda945cf4e930889a37b3dd6a9e30a35869e4e39a93696db01ff371ae9961bbfd3a34c4888e96d2767", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089615, "uuid": "a5e30c19-60e5-4605-a2b7-b9f3b3edcde1", "value": "T1DE44D09277EC5D26F5F79734AA719280AC7EBC812912E60D0140714D1DB3F94CBA8BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089615, "uuid": "f04d94cc-ea20-4d12-94aa-41ea35515bbe", "value": "3072:SVTkZoQLQxD8BS3HSRJbL/arWiNc1fwRN5OO82Y7J6Ei2lEEVMHBNBLmA7uKymz9:gkR8PHSyhowRNjY7YHU4NBaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089615, "uuid": "66f5e5a8-3506-43f5-a3d4-a5e1012a073e", "value": 255113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089615, "uuid": "5092a300-b75e-45d1-aa27-ef309cc7dc49", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089615, "uuid": "f258de53-07db-43f8-b3d9-366c88989737", "value": "FF2CBCE5DC50F2554F866A88B11C8E8F.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c1651a-f264-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1684075101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684075101, "uuid": "5c913ded-41f4-4edc-bcd9-a4f25432993e", "comment": "Malware payload (ArkeiStealer)", "value": "6330864da59c02a1f1b1f115b2ef8f03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684075101, "uuid": "f6ccbfaf-79f6-41e6-888f-ae7c5c2dc262", "comment": "Malware payload (ArkeiStealer)", "value": "42ca92c215455e91c46822836f698229868e12f1fd1b855d4e886249b61d0d22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684075101, "uuid": "705c1e23-dd30-423c-b225-0b9772df68c0", "comment": "Malware payload (ArkeiStealer)", "value": "eb36dc5c79253265a1dce2ab2a0589328d634fc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684075101, "uuid": "c24cf2e9-3e76-44bc-9cac-ce892edce3af", "comment": "Malware payload (ArkeiStealer)", "value": "318ed7503910d861446eebad0a3e6a7da01dfc8faff724fab33c206c980853add5a1df18265127a064624531b860a313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684075101, "uuid": "f947bca1-6dc2-4d07-ae2e-6ab4fafe342b", "value": "T139A5CDA993DED26FE94C1272EC7695B207319F8C608EB496AF79FC0635FF8835405098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684075101, "uuid": "ba620fc4-bd4c-4e6b-90de-0e597b238f24", "value": "55e66cf7b1d18be6c0f75bbeb93d5f93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684075101, "uuid": "b1624b49-65e4-40e3-961d-d145802e5393", "value": "49152:Mb1fiyaG8JXSPn+FJLV1xjf9gfOYpwFIsuFhUiQyZqsub36k:MbXLpwB1xRgPM7uEiQOqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684075101, "uuid": "e28c67b0-b859-496f-bcdf-9895a8e0f616", "value": 2178800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684075101, "uuid": "3215e609-34d8-469d-b8ab-4581034b500e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684075101, "uuid": "55ed149c-d09f-4450-b31a-bec28f235e8e", "value": "6330864da59c02a1f1b1f115b2ef8f03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b76c72-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684067550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067550, "uuid": "1fc2d4f9-b798-4329-b0a2-e4a597b4070b", "comment": "Malware payload (KmsdBot)", "value": "11ed1148379b39729802d71653e8953b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067550, "uuid": "423393c1-8637-4dde-be59-f55648826146", "comment": "Malware payload (KmsdBot)", "value": "4347c8cefad4d369fc3a2563fa311f8deac0d08d7b660835d523b1d072f191ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067550, "uuid": "cfb3d5f1-14e9-4661-9b38-bb357f393acb", "comment": "Malware payload (KmsdBot)", "value": "09a0bb7a35de0c842f80b99dae57edc1b691214b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067550, "uuid": "5900b3a2-adc8-49de-8eca-1f61d58afdc3", "comment": "Malware payload (KmsdBot)", "value": "e9014be51af18ae278efee2beebc3da786d3f5caf97b3b246697d57d16fb4feedc12170c2ad0ad1e192d5900edc28bdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067550, "uuid": "b84f7d6a-b47e-4e05-a7fc-01034024ee14", "value": "T1E2F56C13D4F68362C876F335BB8D4134697634450B36A6DB32AA429A3EFFE9182C51F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067550, "uuid": "3c9215bf-1575-46d7-82ec-156365a19020", "value": "49152:dYO0Yz/pwuHz0l77WKuHuc0sBKfMpSrQak76kOUB1l9YNp4mKvjpovJ:dTzHz057WKHfMpSrvnUsKvjpovJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067550, "uuid": "a033b0e1-f685-4da5-b5a7-d3d3f03a7161", "value": 3507016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067550, "uuid": "acdd09a0-441f-43de-bb00-69059e9a0db7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067550, "uuid": "74f03857-8d7f-4b96-af6b-d657ed7d8f02", "value": "SecuriteInfo.com.HEUR.Trojan-Spy.AndroidOS.SmsThief.ug.14934.31932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a673c7c6-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089565, "uuid": "1c56aab7-8e7a-4f07-8b0a-858a12257fe3", "comment": "Malware payload", "value": "f8a6f3de5255ae3c6750c256559887c5", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089565, "uuid": "92334e40-d354-4d13-af72-6c877d9fd465", "comment": "Malware payload", "value": "4353add9045678acd4e4d7bc4c322518ce4b5c2f0694a5490c9d74a22c3252ae", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089565, "uuid": "e4d70416-154a-48d8-93ab-c61fa3bfb782", "comment": "Malware payload", "value": "426f501c28e6c24d755d71c07561ebf7f1aba5fc", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089565, "uuid": "2951f813-2f97-4f84-82fd-b6e1b2a0e818", "comment": "Malware payload", "value": "472703e56296f8384bc7a803d77f9e3f63ffdcfb03560687939aa7b5a204d4e2cd590f0a9793a22865c3fc594b3936d0", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089565, "uuid": "89e36009-974e-4de8-a8fa-68517b8b4533", "value": "T1A7A633EFF7C85990E1B64F314230506274B85E255A01F5AE713EF9AA0FBAE418258737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089565, "uuid": "7d4c635e-a855-41a7-b2e5-927e7f4e53f5", "value": "196608:ZDdM9AQhf98POROA45MFeOoJ65YJB32wcD7z1KsviHW1Ob:ZDdMXfdx45MFgQKJB5cD7zt2eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089565, "uuid": "d0641901-ca4b-40dc-8fe9-ddf42308a66b", "value": 9718837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089565, "uuid": "2374e994-f882-4bdc-8a78-7368bda04066", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089565, "uuid": "a6704a7e-b343-4694-a572-2a2b608be17a", "value": "F8A6F3DE5255AE3C6750C256559887C5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c161621-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684067482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067482, "uuid": "572e71c6-f8a0-467f-9b9f-2ab07941b3d6", "comment": "Malware payload (Mirai)", "value": "060280152ad785b28f55917bd16044d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067482, "uuid": "2a999c8a-e984-4f38-95be-ae3299122701", "comment": "Malware payload (Mirai)", "value": "454c5f5cffede0dfb9230d536f91ad1e32d51350f8dc1f86c010944c7758f49f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067482, "uuid": "089c2026-a171-4eab-9f82-c0eabc45f0bd", "comment": "Malware payload (Mirai)", "value": "cbdff050d7fad6ce2f7c10492c4fbc21e734ab2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067482, "uuid": "df5c25e2-d24f-473f-9de2-81653fd1c599", "comment": "Malware payload (Mirai)", "value": "e11b5d3c77ab8afe873fcaf684c613b90e0169ccb93c8add471b7780dca2b20cdb9028100757c863f0666b8259b7e763", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067482, "uuid": "eabdd43b-1759-4187-9eb5-66569d5ef770", "value": "T1F913F130F6ED8ED4C3AB33B354E647E177E24A542323D7176324AB1140A2B36E26E5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067482, "uuid": "d5ced1c0-7e38-40f3-832e-a195312ef124", "value": "768:3xMDfrFJX4/Bc0JneMAQEhxevAwxA6Dc7BQ6ZEB69SiD270k4uVcqgw0RTWXv:3xMDfr7cJMJhxFwxAFeB69Z2Ak4u+qgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067482, "uuid": "defeedac-5f33-4046-91a7-8be104061e46", "value": 43840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067482, "uuid": "767b2a29-4fa4-47b9-bc0a-2bb101fc1f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067482, "uuid": "fd25703f-0f97-4e88-b3a4-ca956ea45bbe", "value": "060280152ad785b28f55917bd16044d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4781eb2-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058262, "uuid": "8efd0f4c-ed3a-49ab-8a83-6d4d33b95e99", "comment": "Malware payload (IcedID)", "value": "004ddd044033d43da09ed712172050ae", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058262, "uuid": "7fff3d91-399d-4720-a11f-42898c64204e", "comment": "Malware payload (IcedID)", "value": "4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058262, "uuid": "7324d4dc-9ccf-4892-aee7-3625d7d94ab1", "comment": "Malware payload (IcedID)", "value": "06c7386fdc09b49d015e6b80040366bcd79f9064", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058262, "uuid": "81d0f469-a603-458d-a9c2-41aa58e5711c", "comment": "Malware payload (IcedID)", "value": "bb20f05a6dd2c70a82953bc544f04536d3f44c4bb4715e61e2173e402fd0de732bbe1755a551c9b12192d5d7e4024a40", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058262, "uuid": "29892e67-147e-48a3-a0d5-7a9f18574376", "value": "T1DFD4B006F3327C57E64BE73785A458A64FBEBE2D2725C74C1A418332394A2D89C6137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058262, "uuid": "f37a23d7-757e-4fd2-aa77-c99e486345c6", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058262, "uuid": "df7fdbe3-0d75-4fb6-90e3-3c11e9c88930", "value": "12288:/T6pHPYXMRfXSVGVb8meK1+clygE6YSUCNOio+iI7xM1:b6pPAMtXSVGlGnCFo+1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058262, "uuid": "dc4c4b12-065b-4ea7-a67d-60aa59a31920", "value": 619616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058262, "uuid": "91447424-1c93-45fe-9852-83c0e3a0e299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058262, "uuid": "a31d5c22-b1a3-4cc6-ba06-efadc4b23fd5", "value": "4640be3b45d5600049276a5a5d57bfd880d224d3628edbc16716f17abb6383aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb77aae8-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103424, "uuid": "5200e684-b88c-4434-82d7-e36adcb74a45", "comment": "Malware payload", "value": "bdf01c341202e9ea81643699f1930dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103424, "uuid": "55e4b4e2-aed9-4e78-8413-8725458a97ef", "comment": "Malware payload", "value": "46ce89752bf42e8a7419d9b8c8079d1d2509daaa9e76f9f018223fb9d13f02b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103424, "uuid": "a7ff7a23-4a7f-4243-a2d1-cbb81d7169f6", "comment": "Malware payload", "value": "cfdab0d1153ac85a089d2ba6b083f05883957c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103424, "uuid": "8300d7ba-f296-48ee-aa78-5918a17e1ff6", "comment": "Malware payload", "value": "575006fdaa18f00a21795bb1c8788dc8a57598ba804300011d9bf2f2622fc9929fb10650c92713ac6ade7d8d503d213a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103424, "uuid": "662fb9f9-07a6-450d-a804-d233a1c0f59c", "value": "T151537E53FDE088F6C060CEF51C1C821CDB273A30BE792465DA9F4ADABC792815E2D295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103424, "uuid": "20a449be-34be-4945-8d3e-12e7a9089cf4", "value": "384:tDK3hODUNIxW+mDIkyurqJRteylP3v8ieHOAY8mSnnrwHj42za/EuKus+wNoeL:hIjkWBDIdDZ3EieHOEnnD/Xts+OL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103424, "uuid": "257a976c-69a9-4eee-82ea-a654c7fb46bb", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103424, "uuid": "e10dff33-fa78-4258-ba0d-5a9e4f8a1d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103424, "uuid": "66c9aed8-db84-4bc9-957e-50b047c44d80", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.7126.7787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0c4986-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089579, "uuid": "ffebe7ff-2762-4501-9008-00b2d57b3910", "comment": "Malware payload", "value": "1e178e501b41659fface85153615dea7", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089579, "uuid": "02e3acf7-a2f4-43f5-bb95-ebab97a0b178", "comment": "Malware payload", "value": "4a1a0f578187343a34b4e739b6bc9ca6a7660719a95a42af4abae991ef57d196", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089579, "uuid": "daf39714-82bc-44fb-bbb2-c73b53735505", "comment": "Malware payload", "value": "363b4d06490735cecba252c8c0fa259ea99a9ed4", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089579, "uuid": "d3572773-252e-4e64-94b3-79a84488df1a", "comment": "Malware payload", "value": "22fd3715846a1fb55e5da091ad97897e14991ece30980839ae4d2dfe37bf5e6dee5596ce2bb4adc835b7e8f5a0ffe79a", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089579, "uuid": "b263cf48-aa45-44e0-8ef8-c3f9aeb45238", "value": "T1ECB52383E709D8A6D5E7CB32802A045AAD781C605F63E3F55601B97C4EFABE0C715EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089579, "uuid": "57ab1f69-1d4a-497f-94f0-04861eaa5aec", "value": "49152:vb5uiskGuOLo/LP3jXbqLaz49rciuKgMLF+xtWZs9G0RUdnXyWF72hq5zwVMobio:vbHGuOLob3jmLa2gMLF+xtW8hR4nXyWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089579, "uuid": "2767a0d7-1ef6-4e01-9bb2-f90a6b0572c0", "value": 2481299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089579, "uuid": "bd472ff5-294b-44f6-aade-47893459290d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089579, "uuid": "289cfe77-cc78-46f8-9eeb-27a8196ef853", "value": "fakeAV1E178E501B41659FFACE85153615DEA7LabelReader.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5378ed2-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684058263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058263, "uuid": "85b7fb9a-f83e-4456-92f2-828d75a0616e", "comment": "Malware payload (Loki)", "value": "19457db0af3139cf602708a929705ce8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058263, "uuid": "dc76990c-e63d-4d79-a614-10ac6f27c652", "comment": "Malware payload (Loki)", "value": "4a340ed2bb2fa46a77fa5ef392bfe250651ae9dcb7e63a47b3c4cbc901c1818c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058263, "uuid": "9c438197-8113-492b-83f3-dca8dc8906e8", "comment": "Malware payload (Loki)", "value": "1178dd34cb408cf85d542bfbb55ab66df7964f50", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058263, "uuid": "aa10f33d-f2d5-42c4-986e-3475cacf03fb", "comment": "Malware payload (Loki)", "value": "e10b5dc4e35ed6cd2cc59b8f6005163e69a8e9780fb0b062e90b0c08f04a0c9457acc614b5bcb3db02a422f9dfbece55", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058263, "uuid": "0f8d3730-fbfa-4e79-a8ca-041098c5b53c", "value": "T1D0C49D525065CD5FFE2ADBB0D1B4FF95A6F1F07324E190242BB821C9CAA9F011E8D52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058263, "uuid": "2276e69c-81da-4c50-802a-b5d31a71bee6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058263, "uuid": "98f8f3a2-6d3c-4817-9318-d778998c1743", "value": "12288:qBz92bBxDEnrtDT1IwhlcwtVAzaHsRTEegQVt:qBQKnxdzVf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058263, "uuid": "14b220a0-8bca-44e5-b358-c8b81128be84", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058263, "uuid": "9d2d2903-ff81-49e0-9005-6e3cb039f4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058263, "uuid": "939b5a63-8dae-4e63-a237-d7f3229a5bad", "value": "4a340ed2bb2fa46a77fa5ef392bfe250651ae9dcb7e63a47b3c4cbc901c1818c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4255419-f214-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684040598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684040598, "uuid": "66a0d0b4-718b-4e92-85dd-4f5839e7729e", "comment": "Malware payload (Mirai)", "value": "b5fcdbd341e1461bd0893d305ada2c3b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684040598, "uuid": "f35cbcdc-0e63-49b5-a426-9ed753aea151", "comment": "Malware payload (Mirai)", "value": "4a8b09557c61dfc2e7a850b1b2c5c81f3edcfb9f194cccc587b61bffa01936cf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684040598, "uuid": "fc0890ff-37c0-4edf-a095-e2fcdfd054de", "comment": "Malware payload (Mirai)", "value": "c864e86cfffcd571c1908b2471c600d13399b183", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684040598, "uuid": "da65f2d5-dc4e-4c9f-849b-a292dff6fe54", "comment": "Malware payload (Mirai)", "value": "72d83980f15c59075a9c009999f76d1f104d33f755ef886a1ff0ec5fd13bac738bd09260b754e787b0bf4e619dcb9cc1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684040598, "uuid": "1b5f4bf3-7e08-43c6-838c-e6ae3b187a6f", "value": "T128631807F98281FDC18AC1740A6FBA3E993275FD0229F2B67BD0EB263C95D210E19D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684040598, "uuid": "286b243f-2520-46c2-8852-1ad06723f7f8", "value": "1536:bkXA2MEnzb2LxKJ3BffwY9MiM3o5fmsrLG+L1mWMj:YXHMEnzKdKFJIY93M3oNPLZ1mWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684040598, "uuid": "a4269a1a-c612-4b8d-acbb-43e6f49c4c1c", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684040598, "uuid": "0c973a41-3995-46d3-b40f-60cb2cd472ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684040598, "uuid": "9e3f9019-0b7d-4d18-bad3-f5f5f6dc3aac", "value": "b5fcdbd341e1461bd0893d305ada2c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268405b6-f26e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684079042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079042, "uuid": "8e6b02d1-145f-4b54-9c19-74d1c9cc373f", "comment": "Malware payload (RedLineStealer)", "value": "437fdb36dce7b12a0b529dfb47f9f0a3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079042, "uuid": "642a35a8-0ce6-4d12-a88e-d733ea6124f2", "comment": "Malware payload (RedLineStealer)", "value": "4ad4bac65df4e878861e091a29ef69ebd3f17564b658a0bb0fb5d53aae4a00bb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079042, "uuid": "fcc0ef2f-80f5-4ab4-8dc7-2ceb85cd3251", "comment": "Malware payload (RedLineStealer)", "value": "afa51067a97ca9348cb483db7b11e427b9fd47cd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079042, "uuid": "4f1f9469-ad4a-40e5-b065-cdf8b866dca4", "comment": "Malware payload (RedLineStealer)", "value": "fc1c6362b087440430a9263a7ca7c82a95b6dc45a26ca17bb00a3b3665e23f214612bf15c1cf33f759458401417227ed", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079042, "uuid": "d91a08ae-7295-4a06-adbd-ef551e7c2b2d", "value": "T1374523425EE984F3ECB5273199F712931A34BCCA6DB4C3EE274668582C72594FA70327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079042, "uuid": "916e898b-e312-4faf-873b-4dccb56f7f01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079042, "uuid": "aabb0232-dba6-4925-8d4e-ce83013d76fb", "value": "24576:By/Ut5Ku4oDUO+5NcTjoPvh5KQ5cFDoihR:09u4AoP5V5YD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684079042, "uuid": "39982289-9cb1-4b7f-8e70-d7f2e37285cc", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684079042, "uuid": "a4b18468-dc79-4899-a1d5-64a02ece6ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079042, "uuid": "3c521334-189f-4d0a-ad34-36a9a819c3cc", "value": "Ninjaapp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3de21d-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089683, "uuid": "21db3bc6-7cff-4baf-8048-04d949fe874e", "comment": "Malware payload", "value": "f2ad5567d45bb9ee8471413558a5d70a", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089683, "uuid": "a6d47bc4-fa21-4f49-a719-bb548033e1fc", "comment": "Malware payload", "value": "4ba5fbd9e65570042f2418c751e81b507955ca9d23a3cdf9475c78b04470d596", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089683, "uuid": "dfba4eae-a5d5-4fe5-bb6f-d9a69c3ccceb", "comment": "Malware payload", "value": "e99539db3dce2ee20ff4a53d3a8c8a58c59ce6f1", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089683, "uuid": "bb2a9f70-3501-488a-b375-2070b525aeb0", "comment": "Malware payload", "value": "93c5b643174be853a412ceb6684cfb6866ebe42fb71bf845f013463650ebb2eae31c48b8b62bca5384b2cb7028181c37", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089683, "uuid": "3f0d1838-5cf9-4c85-b15d-ffdb840a8fd3", "value": "T1F50412BD9BF75042C9E7A6B22D70415B9BF9B1CE2762423B584130A84CB1E7C730DA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089683, "uuid": "629e4ef2-44f1-40de-a236-89390b2643ac", "value": "3072:v/cSkAtGg+ru8jqcbMshVIcwJipe17hiPPGThHFtMhE6sudaGwn2EqYb/:sHAtsasqcA1ZFtGE6s0aGwnpq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089683, "uuid": "99a7a209-594a-4274-80fd-449fc3c53897", "value": 175787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089683, "uuid": "743f15fe-0332-481b-a257-c663ff788165", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089683, "uuid": "a65aaff7-2be0-4964-bf33-ca79c258b9d2", "value": "SmsThief.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e28ff75-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089470, "uuid": "c18f7421-0aac-42e4-aa93-ecb0b518fa1c", "comment": "Malware payload", "value": "ea80ae4c4a17e8608e0fc7d6e34bf37e", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089470, "uuid": "196ab016-0273-4cf6-b154-e126a10ffa7e", "comment": "Malware payload", "value": "4d200dd35a8bcf122ea682f2e65e6a3170b7c3cab4871ea2786a29e0049c6601", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089470, "uuid": "1185655d-f01a-413f-a614-ba0124687dea", "comment": "Malware payload", "value": "1317d996682f4ae4cce60d90c43fe3e674f60c22", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089470, "uuid": "9b3c19f5-0873-4493-a97b-e3ef1e9403eb", "comment": "Malware payload", "value": "2ed8ad8ee99cd6f36d57c15757b294e6cb6db5c23d7efc2476ebb89f852a900483f1dacd126c300cd656a51b13bb2bef", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089470, "uuid": "7a3995e8-d28d-4d1b-9a5d-69bc128959b5", "value": "T1AFD412C3EB4CF890C416D836527A1592BB3E2DB4E540F7CB6B86B4BD4EF3A00551978A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089470, "uuid": "72d608ae-9b33-4ed2-9b5b-8d3a277b6734", "value": "12288:1jV/H78N7nbc2XDHWIJJHBLo8oY9RHzWtVjT8NxSrqJ9uHsZX05hcek:zHg7bjz2IJJNoWRTWLT8N8eJtZX0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089470, "uuid": "49a5107c-f2d7-4d7b-aa9f-fb2460340fba", "value": 652033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089470, "uuid": "12ebdcaa-43ac-4bb8-bd4c-9e2fb59d0df1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089470, "uuid": "fed387ab-0151-4669-bce7-1e3cc24b3484", "value": "EA80AE4C4A17E8608E0FC7D6E34BF37E.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec0fcc7-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089793, "uuid": "48e6602d-82f6-41d5-a56b-b7d34920de97", "comment": "Malware payload", "value": "9bd4a85e35b4475961827a4b06e6cb9d", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089793, "uuid": "08b62137-9d9f-4fb9-a677-2a11bea882b4", "comment": "Malware payload", "value": "4d2f6e63d4fd2ff4c068535d0d8b1ceafb75eecb0c31cea637dfb1727cb695cf", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089793, "uuid": "0c8a7d66-b91a-457e-944c-3a236c7505b0", "comment": "Malware payload", "value": "e019f4cd8d60d94a6be1215d0434640e6aa067f0", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089793, "uuid": "b25f2a8a-cdbc-4e72-a121-138569b45558", "comment": "Malware payload", "value": "9c1ef866400b2ea27f3d704e62d6e8bbd9ebf33e4a27def17ff1526b0e575db6c0e04567bf902e4f2049079bb8f78000", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089793, "uuid": "7edeb7a9-6a25-48e2-8832-782a3064c7f4", "value": "T177D51233F7A04437D162267C5C6F93AA68267E101D28A44F37E47E8D6F397C1352A2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089793, "uuid": "7a5531d5-dbdc-41b1-a101-dbc28735dc69", "value": "61a969b6362c5a896bbd9ca2a9ad934a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089793, "uuid": "1f02365f-9131-4fe5-bcc5-96ada25ba788", "value": "24576:R1bMBOkwzvArWmlsnleB19HAmEKg788be4cEzjbW7GnuLqa0724mA/7FTbjfaQpp:R+0Q07uiM1ZYkXJD4Rw0n9kXVSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089793, "uuid": "30b4d340-8740-4789-aa87-762c5a3b076c", "value": 2941528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089793, "uuid": "cd6b08d7-330f-433f-98cb-c8c639736bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089793, "uuid": "4836b9fd-da27-4014-80d9-0a0bf516cd18", "value": "Visualizarprint12052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5f2b92-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089499, "uuid": "86afd45c-f1bb-4f6d-bf15-05300088dffb", "comment": "Malware payload", "value": "0765ecf5c45c2c2b070ca1b50cca26aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089499, "uuid": "c5f18d42-cc3f-4a77-a0f7-fc090d800643", "comment": "Malware payload", "value": "4ebd7f785c9338dc55c705c1e346f2a28a8ed00d67b0b7c2ec0cc80a0e343e3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089499, "uuid": "64ff907b-5e85-4437-83d5-77b2132cd487", "comment": "Malware payload", "value": "46b72840981aa93b14676bf58aa1d673456a860b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089499, "uuid": "b0df6341-198b-4bc8-8002-535095e116e4", "comment": "Malware payload", "value": "0b123be1b1607316794dc3e0b8e9e8d5bb6e0f22f5c1d2e2a6767aad4ed215d27abe24f9d6260aa73151afd9cc20326d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089499, "uuid": "34181ad0-bf8b-4ce4-82a3-f55a427a8ddc", "value": "T1E275127A7F9A8DD0C8DD83F214B9274F6F704196A294D311A6B10BB5CE81BF22416F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089499, "uuid": "637482c7-0334-407e-bed7-dc933e1b148f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089499, "uuid": "407e4942-f544-48dc-8601-52e3a0d59bf0", "value": "24576:EQmDVaaIQT8M8gtipv/L5fdLyKeEJdCcYpoz/CVTF8e7W885X4D8SA1Bj1HnIcvV:/sV5gM8gk5VLqkTYmz0TF8eCH7SmFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089499, "uuid": "7166fcc9-6069-4463-9c15-12ad274f7a97", "value": 1594896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089499, "uuid": "87eedd79-6c41-48dc-9069-a9c83e04c0a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089499, "uuid": "ee29fa11-b721-4165-8024-fdd66d1eec61", "value": "ExternalFREE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53b1600-f212-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684039741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039741, "uuid": "973ca193-1882-40f8-b363-e1d78306d638", "comment": "Malware payload (njrat)", "value": "0f1cf6c5d878b48a71c98096c0b0ea31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039741, "uuid": "70caf7a7-0e52-404b-988b-0d2313366eed", "comment": "Malware payload (njrat)", "value": "4ef7ee5df78517c2442a3837660e16b9cd2b9f6d1fc37c437456a6aefe02ab52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039741, "uuid": "a7e86926-3717-45a8-ae70-f2d9b97d074c", "comment": "Malware payload (njrat)", "value": "7a3c00ec887c4d862522ae98334e53b165a5ecdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039741, "uuid": "60cc2c1d-6753-49a1-837f-f73f503aba32", "comment": "Malware payload (njrat)", "value": "12573046caf69e67520f27a8df429b06aa5db8d377f4a55ef906c0606f66e11f3d58621af81b9d6834d916b01e9885e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684039741, "uuid": "82a86209-0f08-49cc-a947-d02d47e06363", "value": "T13E247C3D6BAA6C62CD9C8FBE88B2170E537CC8159497E3575B4094B24CF3EB14A42C97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684039741, "uuid": "ab3c70df-fac8-4b76-969a-7ef35a58da6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684039741, "uuid": "3dd5d09a-e2c5-4663-91fb-36841f926363", "value": "3072:wUOI0xj/YzOOFX/7KvIwJv/rx2T6be1IcmXwxWtX5T76RE1eKwGnuaddc4FDdFQb:wUQSM5TuOwGnuajQS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684039741, "uuid": "a7c395e4-acdb-49e8-8667-020a599bbe43", "value": 219168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684039741, "uuid": "a83b502b-3f80-450e-baab-09ed01337235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684039741, "uuid": "29b1df1b-65d1-43e4-86d5-3c4890a0ba59", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5faa3be-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089671, "uuid": "766cdce9-4a20-4a7e-87a8-e58070db993c", "comment": "Malware payload", "value": "3e8f31c9ada58db95f26731d42d6cdea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089671, "uuid": "6783c216-44e0-499c-b548-be2d55f048f0", "comment": "Malware payload", "value": "502f13f594b8c7944807bb4193e3f634f0801ffd3c0667e85b4157ff9057080a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089671, "uuid": "62bc1f4d-c63f-4ec9-ac25-76ee3dab3dd4", "comment": "Malware payload", "value": "ca01fe4ed34a3c9b2898da80f889d7198b7f045e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089671, "uuid": "7af3265b-ed6e-4a43-94a3-323a437f292f", "comment": "Malware payload", "value": "57a373314041a56fb21fd9a449b6c8feff2d83831a2205414e5c275d9cbba23d8e6cc4d212f0ffefd12907fe77a719c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089671, "uuid": "e47ee317-8df5-4497-a520-93e5c2f6092d", "value": "T1699412BA93C29087D48535F8360F0F4A5760FD47DE261B53614CA7FE2C2AB278AD1B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089671, "uuid": "7069f2bb-f1ce-416b-a8bc-f3b7013a7a1a", "value": "c1b3e25907b370e02285383a3edbc75e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089671, "uuid": "87c4244a-fcb2-418c-8c8e-1b4ab0f83b00", "value": "12288:fDlSxfXu36j8K2Wv/OcmagFiKlPtVb+HyT36yk1aY:fDuPDRe7uyT36y4aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089671, "uuid": "b60f9707-7adf-40f7-9d10-a5a64a7579c6", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089671, "uuid": "e32c4588-7907-42a4-9117-97eea401c244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089671, "uuid": "f7753a1b-adb5-4274-b3e9-dfb8375d9cff", "value": "settings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae2d33e-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056420, "uuid": "3cd7bb5e-d93d-41cf-b473-35cdd1300ebe", "comment": "Malware payload (KmsdBot)", "value": "8f5c7bc09df0e6ede20c3697abf635e0", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056420, "uuid": "988a239c-2457-4b4e-ab74-8f61797d7673", "comment": "Malware payload (KmsdBot)", "value": "50afbf471a92acd1a0a6a2ffe199a52881eb80f683d95273302506194b2cd6ae", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056420, "uuid": "b0b50787-3b40-427f-80b5-11c45c609c3b", "comment": "Malware payload (KmsdBot)", "value": "ea509f3b420d78e881b38701ebfb0f06f271003b", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056420, "uuid": "4065d042-66e0-4157-b46d-82e6c82a253c", "comment": "Malware payload (KmsdBot)", "value": "fd3f436a9a3897aaf9a0ea349572a400ad2231a31a9395bc8953992827cca7a16f162a2b07c6a3845b6ea607ff6dba45", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056420, "uuid": "98a59705-2faf-48fc-9ac2-f56a736b9819", "value": "T11A266B57BCD18987C4E4377BA8BEC1C433636AB9978663175D05EE383ABE2990D35308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056420, "uuid": "a0546eb3-ddf1-4280-b4bb-cedfc5b65b41", "value": "49152:/+AZV73YjhjnEM1nZLgBmPN8gkmMQOZRLF1oG8HuWPUPD+w9Z4mpZ/L:2AzDINnEM1nZLgBmPN8LQVG8O4UL39L/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056420, "uuid": "7507b804-26ba-4f82-9dae-8ab8768d95f2", "value": 4544877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056420, "uuid": "a2752cc5-e08c-42ca-90be-57af76d819f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056420, "uuid": "53f8f2c1-8296-4a8c-8aa0-2d4f4857b749", "value": "50afbf471a92acd1a0a6a2ffe199a52881eb80f683d95273302506194b2cd6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c279e29-f250-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066354, "uuid": "9c19c1e5-9e36-4855-86b5-1f0da73dcdbb", "comment": "Malware payload (Mirai)", "value": "5244aac9c9900c4f4c5dbed79ab21294", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066354, "uuid": "2dcc0604-cfb9-44be-9464-1754e8f557d6", "comment": "Malware payload (Mirai)", "value": "5137dcf5939eb65d24f827da50783394b80b062a4c29fd39a721c7415e54a588", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066354, "uuid": "74b550ea-773d-4799-8993-d4cb04f7aa93", "comment": "Malware payload (Mirai)", "value": "c06c6268d7ce05f99e21fe0b9000eee34968a4ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066354, "uuid": "203afcd3-bdea-4bb7-b283-dddb71b7f648", "comment": "Malware payload (Mirai)", "value": "1bf0096972e711008943d072abf5fb31c355db4e282994f776fa990cd818160cef414a24c7068c6778ad2525bd045bf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066354, "uuid": "6fe6f005-b4b6-44a9-bbc1-2194fd9de253", "value": "T11E23F1D0C487ABE614F69838EF180046CBB95FA7E1BE792613E24AE11247DC073B4759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066354, "uuid": "22fcb403-6029-4848-8a3e-7f9e0c49f65a", "value": "768:VkGRT2BXM3tNz2E7J3CSYB8O4vR/LxOO70Lerympq3UIxt:xp2i9d28wepDsQuer2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066354, "uuid": "af696b30-594b-49b2-8d11-7925638c9485", "value": 49100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066354, "uuid": "76d9b887-8e6c-4ebe-b179-12954c246104", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066354, "uuid": "7a851978-8b7f-4e50-9abc-720518ec37f1", "value": "5244aac9c9900c4f4c5dbed79ab21294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6174ac9c-f230-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052512, "uuid": "d94c28db-049a-40cb-b789-58eaa9c2190a", "comment": "Malware payload (Mirai)", "value": "ae6835208002b8c2cbc8c479cc7c624b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052512, "uuid": "2431b152-e657-4529-8e4d-623b229a1c53", "comment": "Malware payload (Mirai)", "value": "51d86ed69a082a570107e73862f2926b37c05bd96b5c21aa7fd652fd04642e36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052512, "uuid": "16b9f0ee-82f2-411f-9a4e-75814c28b140", "comment": "Malware payload (Mirai)", "value": "8f9eca426d192f6ceb5f44c5d51cdc542713161c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052512, "uuid": "35f83463-9f56-47ff-af07-75489486741e", "comment": "Malware payload (Mirai)", "value": "2f7360e657dacc8310d30eedad79407829f76603916bf5ca87e6251b10191e193f342e573f833651efc6b23e8c0c55ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052512, "uuid": "4433bdc0-6090-4bf1-a5fe-f6d666791fac", "value": "T1E2B2D194DB95A607C2B0B076E37C8F925A3B45A0D1F63926272097BCCA8649733FC5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052512, "uuid": "e5ad5383-b64e-4dc5-b4e2-95a77fc7d223", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BNIaUQhymdGUop5hu7s:4GHKQFH0rs3zWoDDRsjt7LB9U+BNIesd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052512, "uuid": "e19d2db8-e20a-4bc4-ac5a-e6121e5f4476", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052512, "uuid": "d78c22e9-e54a-4317-a8a8-9c0550e943db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052512, "uuid": "db87b7de-8921-4efb-b537-d257f1a672b1", "value": "ae6835208002b8c2cbc8c479cc7c624b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fa0671-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "4f571a4f-7c06-4061-b808-932d64457377", "comment": "Malware payload", "value": "c4139041cd580c9754436db554745f65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "61a5de6f-db07-4a85-b9b8-82ef9005291d", "comment": "Malware payload", "value": "527facb42baa92c40a81d2755b450a2fcd0142148b19834ca960325c15dd7507", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "c754059d-0790-45c8-a59b-45ce9eb29d42", "comment": "Malware payload", "value": "33161ddc67b50aac4c2416b16517624c45790594", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "87ab2f33-9a46-46a0-8ef5-b49c3c84147c", "comment": "Malware payload", "value": "2e7cc307d1ee5d1bfa952c4bf20eaa3512bd59b869b91dfc3fc381926c04a1ea63a040816d72610a1bed8701fbb8e7e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "08183e0d-59bc-4d83-a943-356100831a14", "value": "T18B93025FCEFCC9D6D21DD0F2B9B0A13E45295D85B9594022C62A9E8838AC2E6333DC58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "e4168b76-432c-4394-8be8-28bbbfdbf067", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "7baaad2e-a4a7-431c-8686-5dc273b9317b", "value": "1536:7zehy6nHsziokHlzV8iaIk1ZmI76211D/u5FH3zcu:7SxM2hZ8iaIk1Zh711Rcz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089809, "uuid": "29708908-3adb-49b7-b2a7-71a0f59f41d6", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089809, "uuid": "24cccc90-b8bd-4371-a8ff-419435f839cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "fd358b36-c8a0-4505-945c-3229ee8f1332", "value": "win32snd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9d331a-f22f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684052078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052078, "uuid": "d2b68d9d-df15-424b-8134-8f4f7d159837", "comment": "Malware payload (Gafgyt)", "value": "df675f29c13fc4d0145c586c41e606e8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052078, "uuid": "69656750-321a-4527-9c32-ad1c21723061", "comment": "Malware payload (Gafgyt)", "value": "53a79c48d79a2fd115cbfab0980e2c957c33111bc2b7e35edcc726af9e4ceee2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052078, "uuid": "e6e87b0f-fabb-4670-a27f-19689e7316d2", "comment": "Malware payload (Gafgyt)", "value": "45863887a9335a6543719d38a1aea89d4d4a6fd7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052078, "uuid": "a7f50d23-628e-4626-a01e-f194ca46b9d4", "comment": "Malware payload (Gafgyt)", "value": "2af0ec913893ff43789c7d87af7fc49b0304170c9f78e148cd073aebf1ca69ab487c9746b51e9a3cf2ac88bf8079d909", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052078, "uuid": "10dd2fcb-c111-460c-806b-aafdd0b6dae3", "value": "T10A534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052078, "uuid": "5a78edc8-3f2a-473e-b771-01386a13cad9", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQvLiKimfFoktCe3fYRMs:WShU3q7cEDlCK/0DX9i8Fok06fYRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052078, "uuid": "a0a4c1ad-ba39-4f6c-a045-3160403e7465", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052078, "uuid": "df13c55e-2cd5-4d69-9ee5-a4e3c59ec400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052078, "uuid": "9ba93e4b-749c-49a0-908a-2ec6859f27f7", "value": "53a79c48d79a2fd115cbfab0980e2c957c33111bc2b7e35edcc726af9e4ceee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bad1c21-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056422, "uuid": "29d7a282-b970-425b-8037-8c8f25b7616a", "comment": "Malware payload (KmsdBot)", "value": "6685095bd788bca5187611059f857f86", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056422, "uuid": "566e343b-7d6f-4f98-91d8-e116bb832bd0", "comment": "Malware payload (KmsdBot)", "value": "542791cf2dde1f449629b03ef95d3c2e0b2f98b1143d619232620d7c9459706c", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056422, "uuid": "cbbe97c8-d608-4b73-9f26-bcc06c5c586a", "comment": "Malware payload (KmsdBot)", "value": "9e9d502965e421eea0a8a12a56402ad51e2eefe6", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056422, "uuid": "b02ed2f4-97a1-4205-939b-1ed168e9a343", "comment": "Malware payload (KmsdBot)", "value": "d83ceb260e6d986aa3680683f47be193528aa37cfb7873c727bf8436f9ee83490c02889fa25bfeac7809da36fcdc7fd3", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056422, "uuid": "42b9582b-1790-4495-843c-8640d43d4c19", "value": "T14C366B133F18D71ED76423340DB1CB94AB2A7C5542D7A917B281E31DAAA21BC4D6EEF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056422, "uuid": "39fd4590-35a7-4822-9c07-8a336deb57f1", "value": "49152:f3hZoaMiqC0IsEwFs/JiZtJZUnOP+zdwxZ/TeIPOfTaYiQlJuMoB3:f3zZimtifTeQOfTaYiQrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056422, "uuid": "5bf39d1a-a40e-4d20-9d9c-04afd49b77eb", "value": 4895667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056422, "uuid": "0ebd2d56-32e8-45d5-bbf1-22b033c4635f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056422, "uuid": "50ceaf46-846c-490c-be91-fae8b8108cfe", "value": "542791cf2dde1f449629b03ef95d3c2e0b2f98b1143d619232620d7c9459706c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e67e51-f22f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052095, "uuid": "2416392b-d9d5-4480-84ad-b5dc64db8348", "comment": "Malware payload (Mirai)", "value": "3b1687552eca3d0ef35808632d1547d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052095, "uuid": "b1d28356-d658-477e-bff5-5ba07db3a69e", "comment": "Malware payload (Mirai)", "value": "554b4ffbb1e9b98c3f3cd1f354e88b0d350dd38e999bc63d6d98e730eea4a904", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052095, "uuid": "2c0fde68-598d-4a06-bbaf-88b4ec9090d9", "comment": "Malware payload (Mirai)", "value": "e4b2d9575c1e738a7d16e3493f46ce17471d9229", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052095, "uuid": "30eb721b-b8d7-4439-a262-3a6eb8dde817", "comment": "Malware payload (Mirai)", "value": "0cf0741cf77a10d100eb24cd70e2a0052ed5ae026ebe8e5ba6ba50079ea8afe34bce8450de73ce41a5a14a861c641f1c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052095, "uuid": "76319c33-2578-40c0-ae74-be9cc08e2ef9", "value": "T126B2E0740A009CCAD69ED2729EE603F72A2103B14143FC06764BEF468E816FB58D37C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052095, "uuid": "bffe3c09-23f4-4b6c-9605-429ab3b87705", "value": "768:8RbQNzmYqGCsRIS97nJRj4BMIDRTd7JgGlzDpbuR1Jr:oO8GhnNQBM+TjVJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052095, "uuid": "708e4037-548c-4ef3-8abe-a00e26c4d8a9", "value": 24696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052095, "uuid": "c7b77db3-7a98-40c9-b843-4afd446980bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052095, "uuid": "878792d6-5186-4a67-a454-dd4257f1ce78", "value": "554b4ffbb1e9b98c3f3cd1f354e88b0d350dd38e999bc63d6d98e730eea4a904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ae533f-f293-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684095152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684095152, "uuid": "8fad2209-994e-4146-bf67-7c99d58a0cb4", "comment": "Malware payload", "value": "3700693805b655c65fd248bcecb25de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684095152, "uuid": "24a3d238-2376-42d3-ad15-7ee7c943a2ae", "comment": "Malware payload", "value": "5618be4b10205d3fb67baf5dfdfd2d8089b0858578b59e06bdc9e98dfc164220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684095152, "uuid": "0096c42a-9b00-48c5-b0ce-97f91fef2c26", "comment": "Malware payload", "value": "cfbec034e8d78bb68702c0fb5d92887fd2a7193a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684095152, "uuid": "ebeb3701-34b4-4aed-b5ff-2d893234a053", "comment": "Malware payload", "value": "be1bd9b624fc77e6e4f04b18b49dd602ee9a31e6e94a2537843fee129a99d4a8b8bdad790ad86d41bffb3ebba202d2a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684095152, "uuid": "26a6b5d4-fa8e-4051-aaa7-863d68eb249e", "value": "T10E9415AC725076DFC85BC472DAA86CA8EB6074BB531B8203906715EDAE4D997CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684095152, "uuid": "101bbcd6-75ac-4b6b-8201-b8d3bf34ed5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684095152, "uuid": "785cd05a-b379-4fd5-9cce-b10353b5a105", "value": "12288:V8fXfIAPtRTZt0SgoMj0s6ttVtny+IgQeyDRUI0eUuXYbiim5tjNTyyzdiekiKNx:V8fXgMVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684095152, "uuid": "ebca5652-c546-49ee-aa09-78d641b48fec", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684095152, "uuid": "84e38319-0d6b-40f7-bd52-d31c936d0dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684095152, "uuid": "10becbf7-d0a9-464e-8e0e-dc68bb54c307", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233c764b-f1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684023631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023631, "uuid": "cdcebcc6-8e9c-4fe1-a192-97e5acf98df9", "comment": "Malware payload (WSHRAT)", "value": "83e53f9ad2731814e1dfa36d113169b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023631, "uuid": "c2046c2a-ee74-43b4-8af0-923a4a52654f", "comment": "Malware payload (WSHRAT)", "value": "56317cdb9e3688fb9c7bcd37f5ef6c435e5d06a64d46c35dfe92a92821750fc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023631, "uuid": "0f1b8ebe-5b7e-49b9-a347-7f3933b4dbb9", "comment": "Malware payload (WSHRAT)", "value": "a662fc33582b46b0408eea740201b526baeff18e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023631, "uuid": "2251b8a3-ce39-496a-ba31-0a0dbc83783c", "comment": "Malware payload (WSHRAT)", "value": "2b8475f228a2d99023fa662aa8c7cc1e04c29480f608040ea38ecb1af24c731c17f14ad4c0c535a9a519f6d618c3aaf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023631, "uuid": "6e411449-3270-4b55-855c-9e83ad127fe3", "value": "T1FD452313E9F45076DDF837B424F606D3073E7DA14D6887A62221E49A19B2EC9E4703BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023631, "uuid": "e4847c4f-90a8-4d6a-9d97-2395204ad767", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023631, "uuid": "3bab3fa1-6e49-489f-a6ba-885c5a4ad4cc", "value": "24576:SyUNGLWEIcboDfPCA9jTxETkq9FX5CvGVzcKXoddyKQ:5GGLWEobD3UkqTXEG11XodT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684023631, "uuid": "4c6d9a9a-0f5d-476b-8b8b-15bc0f2a3b95", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684023631, "uuid": "90ba7ce0-2b8f-4545-aef8-1b5bb64aea08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023631, "uuid": "a8279cd2-c253-49de-8c3a-36c0d17a92c9", "value": "83e53f9ad2731814e1dfa36d113169b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5ca564-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032341, "uuid": "78a725e6-85f6-4f5b-9805-ffc1e552adcb", "comment": "Malware payload (Mirai)", "value": "ede9ff43fa7465b07ac5b703f238a08f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032341, "uuid": "8a1dbb83-995e-4f3e-9b1c-b81b74450eeb", "comment": "Malware payload (Mirai)", "value": "57715d44e0e7b09add135c9e47ef60a266a28807da18716b71568f5f27e73feb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032341, "uuid": "a5fadd84-a196-4ddb-9a90-bcd262cb0b00", "comment": "Malware payload (Mirai)", "value": "6fd89bd6c35e2b32ec2feda3bef6b8f3a8df5e9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032341, "uuid": "6cf94f96-4fe4-41d0-941b-73d5ad6693f5", "comment": "Malware payload (Mirai)", "value": "2c835eae950d30eb035de8c707fb57e67ecc16f0496679b4c9dd73b5d22f89502dfe2208403c5905a9a95cd35e148ed0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032341, "uuid": "dc006908-a47c-4b1a-835f-44b49b81aac1", "value": "T19AA2D029D345AEF9DFEF9C9452C1D2C277E547C62B8AC8E340EEAF017506042B788D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032341, "uuid": "066e7582-a0eb-4a06-8ef6-cc4f1e3c0d10", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5ywGaM4uVcqgw05VxJS:MRxsSVsMD6xiJJE5zRWNAh4uVcqgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032341, "uuid": "692727fc-2ea4-4a27-8602-0c68b51fc237", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032341, "uuid": "b7d33fbe-a8ee-421f-abc9-750088d67a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032341, "uuid": "77f90442-0944-4d33-b6d6-c7cea01a8884", "value": "ede9ff43fa7465b07ac5b703f238a08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d3f107-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089810, "uuid": "b18e26ec-e919-41f8-ad6d-266daa4300cf", "comment": "Malware payload", "value": "7df01b30ea626fcc27e3696d724de705", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089810, "uuid": "db8ef5cd-5887-4e3b-b702-59ef28619747", "comment": "Malware payload", "value": "57be1c79a193f22eb63337a69a13e6d65d10fc8aa13938358047da45650e17a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089810, "uuid": "ef8cbc33-7dc2-430e-be71-362f97958b50", "comment": "Malware payload", "value": "c4f356ce3c459fef05ad42dc79f35c6a41a400de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089810, "uuid": "0c5d0673-c113-4f39-8c7e-0b7176565b74", "comment": "Malware payload", "value": "86438530c516e7153bafc0987e398ac7767d33730bc1cd9861d0aa9147b4434c939d578a25b7f5ffd8f54d5e78bf364f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089810, "uuid": "2f0ea4a0-1791-4ee1-b9d7-692e0d05a39d", "value": "T1CE72C003AD4454B3C89C20371338B23AB75FB1044B749FA33A67D62AA5AD9FA4D36275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089810, "uuid": "705988ac-9110-450b-8bad-f18680bc6685", "value": "58bbb0cfbec0d9ae70d4cc76b11dc597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089810, "uuid": "8f81f7f1-1182-476a-a305-145204e54364", "value": "384:kDpbvTooB5CMCIHzFK4ICwbS4udLZ7RBMCF:W7To6fzQlFbSjLZlBMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089810, "uuid": "225d63d8-e883-4c60-abaf-d3a822dd8323", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089810, "uuid": "8f6d631d-a90f-4baf-a906-91660a94f7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089810, "uuid": "25684fb6-b6fd-4983-9b02-403ae5a66b26", "value": "Wisdom.exe.bak", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e91d53-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058264, "uuid": "c7e72b9e-3d12-482a-a1c2-7c55f6850fde", "comment": "Malware payload (IcedID)", "value": "4b0253b76194f4c2d010912d3b2fd624", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058264, "uuid": "c6131c61-3815-4da3-b9b2-5f42de0ac4eb", "comment": "Malware payload (IcedID)", "value": "593888d68ed49a0cdd9f39f0b691a2f28c62e06f7dfdcad18ae26478381cf703", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058264, "uuid": "21838fdb-a437-4ffe-b59a-5f2e79862525", "comment": "Malware payload (IcedID)", "value": "9602070ca68cf5ad19f97935813f98412f15a25c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058264, "uuid": "aac1393d-caf5-4bb6-ad6a-332bc8b809c9", "comment": "Malware payload (IcedID)", "value": "c88635ce33e1e74edae06e3f58710e826ae857e69bad0b0719677459ee1cc37c0fa0e1daddd77f42bf5c328ea7609a29", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058264, "uuid": "609e9ef7-391a-4cc0-8cc9-a0871a74474b", "value": "T1C2D4BF06F3227C53D54BD73785A45CA94F7E7E2D2726C74C1A4183323A5A2E8AC6237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058264, "uuid": "583eee59-dfc3-48be-9e97-7035c6888378", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058264, "uuid": "c71fba7d-13f4-4bc8-89fd-06f496c0ef36", "value": "12288:vJCm6L5GVXKtDm6aNpb4i35M6ctAJoQtgW+iMvVbNLp5KMuCQB:vJCm6LcVcDSJ35MZtjWIVhTKMuCQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058264, "uuid": "c1964b49-86a2-4833-b506-ae5a244f3863", "value": 618080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058264, "uuid": "753b07eb-536d-4dd1-85ea-204af91d8e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058264, "uuid": "db7ad97c-c870-40e1-b532-94a16745377a", "value": "593888d68ed49a0cdd9f39f0b691a2f28c62e06f7dfdcad18ae26478381cf703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c89ad2-f26e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684079088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079088, "uuid": "643edc2b-87e6-44b0-9a35-4a3ec8909fc8", "comment": "Malware payload (RedLineStealer)", "value": "bfe99d6c6f96db5edb469f59cdb0ae08", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079088, "uuid": "16ca0c97-0d7d-468b-bd4f-9bd59192e2b6", "comment": "Malware payload (RedLineStealer)", "value": "5b57d68e8c680a68a0ffd3510f282d7f931a9672d7c04d76db2ff43ff3fdc80e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079088, "uuid": "c296907e-42f6-44b4-8f57-b3745f5f3fa9", "comment": "Malware payload (RedLineStealer)", "value": "f9cd8313e552adfe1d64af02509ca1730862f3b2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079088, "uuid": "1b024a22-a820-49e0-a982-e6f8fdf48ce7", "comment": "Malware payload (RedLineStealer)", "value": "5dfc7a414fe559e8dcdb62999ba6a610c11da714b8d1d11c218d5028516d508ff4194985d244ff4d0c4ff229ebb2271a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079088, "uuid": "16eefa31-1c2d-4d88-9fde-89a74c63035b", "value": "T12A4523529BDA8062E8B117B50CFB4BC30B367DA6493C436F575B6C8E1CB36549A3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079088, "uuid": "209ec386-bb21-46be-a75e-b3aa33f1bd3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079088, "uuid": "358bfd09-2635-4065-9002-3a3d65af5db4", "value": "24576:qywdwoD5ziYlKSZM6AOZjua/5K3Z6kEuCPBznidb:xwHzXImhjHVkEuCPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684079088, "uuid": "ea004fe0-3e6a-4ffa-8eef-efcff7f22943", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684079088, "uuid": "0f25c3a3-a42c-4fed-a61a-7a752d01b92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079088, "uuid": "a7bf18dc-fbb3-40f5-b735-d865e5649970", "value": "SHakeRfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c964f1-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089800, "uuid": "1f74d574-c861-4cdb-b400-74ac38a5ad56", "comment": "Malware payload", "value": "8da35604db8350a0bbb7ac41e0609bb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089800, "uuid": "42c47b10-65e9-40db-9acb-f8609396acc7", "comment": "Malware payload", "value": "5badd8294b5ab8aebdaef9cef14176ceb4765f170414042e828903e092d93686", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089800, "uuid": "ed430377-3fee-45c8-a881-f778889ee30e", "comment": "Malware payload", "value": "6160e62c45e1fe8028da7aa8b9f5c1a4d9bf22c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089800, "uuid": "7a0e00be-b179-408e-bf3a-210d78e0aae6", "comment": "Malware payload", "value": "859ed866b5b06056b30dcd7adc51e54c49b0ee8f26912d770204c62d15cd209c9c64b0df4f4c724f679b573499f5aef5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089800, "uuid": "a7f9df0a-b82e-4e74-8b14-98aec0f4e31a", "value": "T16D56DE2135863ACED416DFB649F0AD1D6BF734233A028CD85897427A2D3FBC8791DA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089800, "uuid": "bfadb180-4c2f-4a4d-bd25-c80ac7c45e86", "value": "49152:mTlQjr91BV/MWMtZ9f0o/pCMcmkgvgplcvflU5tKE0qrwJu8W/9eL3:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089800, "uuid": "e191a1f9-d38b-49b7-b336-f512d64f247c", "value": 6223568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089800, "uuid": "19f7963f-ff9f-40ed-ac01-e22537448552", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089800, "uuid": "f70a25bb-70be-48a6-83f5-46be26253762", "value": "WannaCry.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266c4ad1-f288-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684090209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090209, "uuid": "4f6c3003-d9e1-47de-a012-6921032a0b56", "comment": "Malware payload", "value": "d2c7adbddb633fb852a7f2fe08ff092e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090209, "uuid": "2b706b16-d743-4c24-910b-afdbe30b9e5b", "comment": "Malware payload", "value": "5bc046fff04575fd5a47acb9695246a08c4bf692355c20007d887cd2a00ff216", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090209, "uuid": "19887ce1-2acd-43f4-94d2-f8ea5fa2d76a", "comment": "Malware payload", "value": "9c3ef70cd735abb131e31aa72897c4c531a080cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090209, "uuid": "825d227e-6f62-438f-b0a0-f21a0f838d76", "comment": "Malware payload", "value": "8601768c22aec5fd58201a14096e06ff3cf23239593b45fa3e344f725d25e8312a424e10f7e031e96d8fe5f60b5db361", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090209, "uuid": "6ef4796c-aa11-4544-9d85-425e4438f698", "value": "T13C32F701ABF4A336EAFE07355CB353410636F5949A63DB2F4984A52A5D323948EF1F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090209, "uuid": "654385c4-d0e7-41df-8056-7401730f49c7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090209, "uuid": "90535230-a784-426a-94d3-e5ef1a2cedf8", "value": "192:1PWoo3yrC3siB5EzBYN6Wz153PnVLeaKC:1PWoctsi4Fy/53dMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684090209, "uuid": "219a80b0-9035-4962-a1a9-7d57f06b21f3", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684090209, "uuid": "59a62180-ec2c-4d7d-a112-0c7403ae0062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090209, "uuid": "a061378b-c40f-47ca-afc1-ae6d89580eb4", "value": "5374d22b-3167-4fec-bb72-b8474c01e190.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c416c3-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089644, "uuid": "1abf8dcd-99bb-4a63-a10c-0004b5bd7c5d", "comment": "Malware payload", "value": "615fe78f3a644cb63df8b7918fb8d503", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089644, "uuid": "3a296970-abfc-4485-a903-2522671e8066", "comment": "Malware payload", "value": "5e29d42f94ef0332223f4e7d149bc6f6f954114d8220edfd88200c4731a0b868", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089644, "uuid": "9689fe12-179d-4f57-945e-5b5702b82251", "comment": "Malware payload", "value": "005d5f6e94321de473d62706a94fbecf67c9f5f3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089644, "uuid": "0c773c7b-e18a-42db-aae5-e0971c2659c5", "comment": "Malware payload", "value": "608746ed0d44fa38fddb09514c589656e69aa02d259d4068f3535246d51b4c3b77ab2c6c5f2d58440e2c7d1d38a79be4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089644, "uuid": "a8a73c0f-4869-4dfc-aa2c-06a2589fd74e", "value": "T11A53F163E2D9B43CF2FB8B35176101421D2CA64C2EA1831C4E64E00B9DB7DC9AB957C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089644, "uuid": "b3418664-c596-45f7-8e22-dfbf53f8e1fd", "value": "1536:WidikQPgI0VLzFlWS8Er/FrKJabgURX1gy+18objnlUYtrm:WDFgI4HN8EUIUW1dufeY1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089644, "uuid": "7754306f-0d34-48c1-b0b0-8edc46e42559", "value": 63580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089644, "uuid": "f9e26a84-928a-422a-874f-2f1d612d78cc", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089644, "uuid": "85bea712-94ef-4666-be3a-2072b9300df9", "value": "SecretSMSReplicator.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c63148-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089642, "uuid": "49407907-f0d1-49c8-965f-4d30ded3614d", "comment": "Malware payload", "value": "26ae1ec8eef41b0dc8eb40b51aad633e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089642, "uuid": "cb152c7e-0d19-4ba6-9d9b-12e7207a64ff", "comment": "Malware payload", "value": "5e380bd207d42975294fc93f66bebe3ead34b29249362bb88f4dda57c34f8ac8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089642, "uuid": "2c3bd22d-6bac-48d9-a20a-b1dfc230ee6a", "comment": "Malware payload", "value": "31c8bd21fff04f233e0f00e9c8007bb37c567544", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089642, "uuid": "baf5f3f8-ef43-416f-8dce-4e4b531ee5e0", "comment": "Malware payload", "value": "9b7d2c704d889e2ff2b93190d452ca2ef08ce5861b23e88dc1c59e67016311877d504261daa60ca1c1d960b3c4b37da7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089642, "uuid": "7a6cc401-0c30-4128-90cd-57ededfedd90", "value": "T1053523B753EFEBA6F22B973669344294F56A7A60D611F6DD5108F0210F376003B0EE29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089642, "uuid": "6a8fac58-e9f3-4664-804c-29631c8a3332", "value": "24576:SDMQutqpdn87bteU3edhzIJOLvHR1uaMPS0Ex1mSfy/0mLk:SwQut4F87bteJz3TCPgx1M/0mLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089642, "uuid": "4d46c51d-9692-4e7f-a069-0115033ae589", "value": 1082051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089642, "uuid": "8c569691-7d53-4f61-b845-f89892cb9cfe", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089642, "uuid": "2a6ad1dd-40f9-473d-bbeb-6f0f4d92aee2", "value": "SeaBall.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d336b68a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "ac375e29-9738-47e8-81fe-479240d3373a", "comment": "Malware payload", "value": "d20cb0bb5d87bfc8394bda0d8964d663", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "23479eb0-81d5-48fb-82e2-2669edcd0ad4", "comment": "Malware payload", "value": "600515679c6eedfaee28280a7d140de2f8d302e14a613b5ac0e26533ab62d7ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "d28e3c82-13da-4a5c-9e90-4ffc1dda3526", "comment": "Malware payload", "value": "0edec59577b19533005301c4c4cb6fdfd1625509", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "0c16ce5c-f0bb-4ef1-bdea-ef4f2b4cb094", "comment": "Malware payload", "value": "2cda0dc83638a7a3d2d9eebd75e367651b7123a1909296e84b3e76a3ca5bcfacb0963a8b5523a6bdfd7c51be476ab383", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089640, "uuid": "6ab56766-3486-44c7-8b5a-0151d69483dc", "value": "T16FA5D00299B32D96C5E8E2F0C3E690BDF2743EBA6512C1477F77A7E9017F3801664698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089640, "uuid": "a4a9638e-1e07-42a8-8eec-ca02aa7ab9f2", "value": "49152:5iLg9yPExWTo7oTalMXe5gLQ1qj4JuncNChSdAr2Rkv6FGH8pODYVK/0/EPWxgL0:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089640, "uuid": "f043653a-bef5-444b-b4b5-ac98efe7346a", "value": 2142282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089640, "uuid": "2e37ac97-e20d-42c4-94df-06d1951a0e82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089640, "uuid": "56a19dd0-6d2d-48f5-aca2-107f925ce8c7", "value": "scavir.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3347766-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103410, "uuid": "182c9deb-826c-4e45-bda9-087a059df8dd", "comment": "Malware payload", "value": "7f3ea1ca4766cfa0b313822454625826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103410, "uuid": "2be72341-ef71-498e-95dc-84bdc6fb56e4", "comment": "Malware payload", "value": "60738173234ef1c7e06e573e47ee8e89da96151bbf376a5d8ee8e582620b88f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103410, "uuid": "5955f877-8ecb-4937-b21d-e7f0c17a3105", "comment": "Malware payload", "value": "3c3e343b5e0ed55139168c2bef5473e439571070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103410, "uuid": "07456a28-7e61-4e51-a5c8-d6ea18ea1647", "comment": "Malware payload", "value": "eca36c5cad3293cdfe9bf867c67821ce8910633dec4795a2bfa8686767d9b1c1a7182d5105348399a9d596d06b66d3c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103410, "uuid": "8c0febc0-a5d0-4c38-96da-3b522fb95138", "value": "T19073EAB1E677E8A3DEA80F7CD24367848DDF9823ED11CCECD04A6A49EDE557219010B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103410, "uuid": "38abb1ad-5d5d-47c3-ba0f-0636ad69ee81", "value": "768:oqMKJ7iMz0U0ZkqaMicuH0fyPJ313QyXHIxrviRKIsul6gF:jMOiMzfcuUm313QJrtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103410, "uuid": "6200cf2a-fbca-43e7-9f37-15cf6c05d4c4", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103410, "uuid": "083f02d7-1bf6-494e-b667-8ab5aaa73f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103410, "uuid": "f5c769fc-4b15-4226-8e8a-e6237fc488d2", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.17084.32521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3a9919-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103422, "uuid": "5a49d51a-c10f-4d80-9e2f-f2a7947d26e3", "comment": "Malware payload", "value": "4c78e1039e51c0cfd4b7ef04f8276afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103422, "uuid": "6321c9e1-8400-4033-b1fe-a05f1ba93855", "comment": "Malware payload", "value": "60b5adfcb14fa2e2b804111c2d2b52017bcbb11457044110947b40f869815c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103422, "uuid": "6e2fc5ae-c500-473f-80f8-2cdc09764001", "comment": "Malware payload", "value": "d096d3ff5fb9c7184b802b3f011ff0ff466350d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103422, "uuid": "830839a3-5f1e-4a41-ad3b-3d60e1571dbf", "comment": "Malware payload", "value": "923a9e5430fc2c7ae85d52d35372b8010fecfa95169e69f67156a4e36fb9eb0e80bf1439fbc8dbd02fa4a6d5b691c952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103422, "uuid": "2552e639-77db-41d5-97e2-774e1e8c256b", "value": "T12A5423F896AA42A2D34D3732E46F902DF2B375215FAE9CC1C580430B2D87FD425E95AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103422, "uuid": "5fa0d620-db0e-460c-99a2-cac0efb33fc3", "value": "52560fc1eab52ff4011d3d7eb42c9301", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103422, "uuid": "b6c06e00-3b3c-48c8-8c87-7054ade7f948", "value": "6144:cPyC4A3sH+lCN+TO6Kxet90w4GcmS72roH/bgGsdMEe:cX4A3sROeG4pDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103422, "uuid": "00ede1ca-221e-4994-b944-ad7ca915d2b8", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103422, "uuid": "92ae3360-9292-4d24-a752-ff2738f0dbe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103422, "uuid": "ac5dc999-b89f-46e1-b860-47c4023ac861", "value": "SecuriteInfo.com.W32.Downloader.N.gen.Eldorado.19425.26014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1846a21a-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ToxicEye)", "timestamp": 1684089756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089756, "uuid": "27c05d65-6243-4e81-9d1f-feacab9efac3", "comment": "Malware payload (ToxicEye)", "value": "f6f686df785d0abdc66d1f90fa508c4b", "object_relation": "md5", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089756, "uuid": "b1625189-2d2a-4f13-a458-df07c532ba33", "comment": "Malware payload (ToxicEye)", "value": "61b52af14fc66126a4e7f09b3cff7d3c09e5ad35acf23fb9ba43293fac0c995f", "object_relation": "sha256", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089756, "uuid": "47632cfc-a3f4-42f7-a21f-401a89fffd25", "comment": "Malware payload (ToxicEye)", "value": "75f348132001df30cbad9c7cae2e2072fcaca38e", "object_relation": "sha1", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089756, "uuid": "36fe9835-71ee-4e5e-8b2d-81f58d764ba0", "comment": "Malware payload (ToxicEye)", "value": "561d13749f8ba4fb0d2d98e7b795e2be2d9f82c1086a7ccf3e13c67cb9905499e88f9fc439414745d7dc24127168d454", "object_relation": "sha3-384", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089756, "uuid": "c6ff3592-4bf5-4497-8482-c0a9943c2174", "value": "T11CD3295C77FD4A14F2FF9BBAADB511194B31B817E931C71E08A154DE09B2B808A11BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089756, "uuid": "8b6fd6d8-560a-49c7-a871-500948d4f0ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089756, "uuid": "f5b2ce27-e6af-48c5-b7bf-469baaea77e7", "value": "3072:tZOttVZAEA6JebPQbKkGuQuxoCrAZZM6Seb5G:twttVeEGbobLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089756, "uuid": "75d8df59-c834-45ff-a632-5765968648bc", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089756, "uuid": "62b72c20-1316-42eb-a6f2-8641becc22fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089756, "uuid": "33bfb993-b26f-4dbd-9b94-13a7cefa1c6d", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e199c46-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684056479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056479, "uuid": "7bfea499-4c99-4438-988e-98aa4320240a", "comment": "Malware payload", "value": "2f45aae417e26540117cc5af48b3e4ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056479, "uuid": "73106b6d-e5ae-4e9c-a677-1f49bffb052e", "comment": "Malware payload", "value": "62b1e355a7e4c850bb0f03c7f182f48f0ebaafa07ddae1fee599a78772d149f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056479, "uuid": "6d48f6f1-5d1f-4e31-8412-6357639ea5c2", "comment": "Malware payload", "value": "b5b76265da8fbf012507b2521aded67e071f49b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056479, "uuid": "65bbe1c0-1af2-4fa6-8120-378af1821789", "comment": "Malware payload", "value": "54414aa2136020de3354507cfaa691987a419803f7ff52407cc2737aaea5d3dcc4911649a0f965ff8f48a03af2ffa066", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056479, "uuid": "d1ced85a-f71e-413c-9295-0bd54052c962", "value": "T1F807339CF1D20DBEFD17513ED09A4421E63A29AD1F32DCEF8AB008A56F43BE06B55251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056479, "uuid": "eecf5404-811b-466c-9faf-f7458cdd48fa", "value": "73e11ff6ddd3f1acfa3606a55c6f8a23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056479, "uuid": "2eda1794-4758-4e50-a7be-d8d8c8ba6737", "value": "393216:XltUS8r6og45gRb8yF71LPCjjgyiEVk/q3x4pbsfIFvXYuLo:XwS8rVg4M8yFpL6HHioXx4pqIRXxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056479, "uuid": "d4274f7a-3a78-4dfc-b84d-7c067f7814bf", "value": 17469440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056479, "uuid": "7ac84e0e-1629-4998-9836-3062548fe5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056479, "uuid": "19c6f30e-dc14-48ad-9e47-a59cf53866b6", "value": "62b1e355a7e4c850bb0f03c7f182f48f0ebaafa07ddae1fee599a78772d149f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93232a1f-f203-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684033268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033268, "uuid": "24182010-2729-4f5b-bc85-1086ccb93e12", "comment": "Malware payload (Mirai)", "value": "6500535da245217b75b3ca12005220a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033268, "uuid": "59cae446-c4ff-4f11-834f-80be51bf0332", "comment": "Malware payload (Mirai)", "value": "65cfb2e56647138a8413a3204b54dda88fbd055c6f015a848f7da3043772f21c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033268, "uuid": "fb419c0f-4e78-442c-a9e5-a57339ba290a", "comment": "Malware payload (Mirai)", "value": "cdf2bff2f769ed4401437191ff8fb3b916f89957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033268, "uuid": "9b60466f-0d05-4519-a783-7730d7db3e08", "comment": "Malware payload (Mirai)", "value": "4fa90e743a6ac8d5d62fd937743bd9439006958ff6c6ba3d24ee5e2311405a8be4027fe272b50e36e056aa0c35a1f252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033268, "uuid": "815c3fcc-e713-4ab9-b800-225a1f7d3123", "value": "T1C843F8792949B3BCE9F51078F00324A62C620B98379DE5D372D3647AEF70B0D3569D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033268, "uuid": "f6a65545-66c6-4d45-9ce0-40b01625e322", "value": "768:WUxZRssg/KgNiJJpqZS/QG6fRQml9xn6DfVeMPG8HQH86jw41I:WUZ/rLJXqZlLn9xOVeMXL6jwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684033268, "uuid": "4374836d-8575-49ab-934c-65b0534c46ea", "value": 58776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684033268, "uuid": "30d19e4a-a682-4d38-ad8f-4837571cce27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033268, "uuid": "1e32d28c-14d0-441f-8ebc-d69d0a965b77", "value": "6500535da245217b75b3ca12005220a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80b1638-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066884, "uuid": "eabd56ff-9d4d-4d0c-9389-8bb647a8c6ce", "comment": "Malware payload (Mirai)", "value": "dbe4bf39d6a635f3939a02951fc1b919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066884, "uuid": "e2e6e3fe-2ac0-48fa-86f2-494044e5db36", "comment": "Malware payload (Mirai)", "value": "660c9e56ddb0a050861a9fb86d0731539a5d39e10cd80c87724533e8a5b7780f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066884, "uuid": "15ade5c7-51b7-4c59-820b-39ff631bef70", "comment": "Malware payload (Mirai)", "value": "b4611ae0cadf1895f0534979afb312133f1ed087", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066884, "uuid": "b9b5cbdc-f986-4e44-8afb-737d805610f3", "comment": "Malware payload (Mirai)", "value": "1b6fb287a3ad7fc56d13e8c0045cd865b298141a805194b71379331fb4639810a71ceb8e67d2bdd98a4ff7f632c41537", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066884, "uuid": "fe476441-e400-4f35-833f-4069ad5a155b", "value": "T16F336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066884, "uuid": "0234a774-e4b0-4413-9274-3d975c057555", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066884, "uuid": "90daabbf-0463-47b9-b30a-da5b9bbfe26a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066884, "uuid": "213bd078-0322-4523-9c51-cf42d7d743b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066884, "uuid": "97322f1e-27ef-433a-9455-d18fe3111c9a", "value": "dbe4bf39d6a635f3939a02951fc1b919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c97bbfa-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684055859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055859, "uuid": "59f58896-d7fb-4509-bb1b-8a405ce644d2", "comment": "Malware payload (Mirai)", "value": "c85c0c0eed208a7c1d522b98f4bf9d37", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055859, "uuid": "2d23b626-c92a-4746-90d3-4e515feeba9f", "comment": "Malware payload (Mirai)", "value": "66c7efdb3377e982ccfba7de73f60b92ff6061a2738c583e7b6e5b91987ce347", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055859, "uuid": "8cd1281a-0554-40bf-bc28-5cb0987254d1", "comment": "Malware payload (Mirai)", "value": "4bea5534c1e95785d3af25df6425ba848b3d964a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055859, "uuid": "e83da0be-6641-4d8f-946f-5bedf1894de6", "comment": "Malware payload (Mirai)", "value": "d74cb8669ea859227e889bba68d6a62e36c40a7df41740a8589643e4c9c9429477dcc60fca671421ccb69aa0670bb5ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055859, "uuid": "2a4ed0ec-7430-4fe3-abe4-6f889abffc67", "value": "T1DDE2D12D4F122812E935DA7A42FA0B165FA40FEF7E52C08511FADA979582838756CE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055859, "uuid": "5ba0d5db-e392-42d8-b461-8eaae5736eb5", "value": "768:DR5+iG5yI2mgNERp0YjWHzDRQFWXAgkbuAFTJgGlzDpUYsB:F5eAImN4iDcgCVqYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055859, "uuid": "8a442692-f89d-40e9-945a-986fa71e27f1", "value": 33456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055859, "uuid": "28172635-cab0-4298-86f0-c7a441fc302f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055859, "uuid": "5eb6479c-7f20-45db-bdad-2586c10b07ae", "value": "66c7efdb3377e982ccfba7de73f60b92ff6061a2738c583e7b6e5b91987ce347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ed3dcb-f23a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684056848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056848, "uuid": "6d3ebce1-0249-4815-a6f3-1ecafb90bb88", "comment": "Malware payload (AgentTesla)", "value": "64d64ed466d08c188f49c51c30c66b4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056848, "uuid": "03f9d37e-59a4-451a-b583-faee06df6d54", "comment": "Malware payload (AgentTesla)", "value": "66f6bee1a68cf5d42bad745dac3f3c31fbe2dbe0582cf1da8429e18b1659867d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056848, "uuid": "c5446878-379a-4483-b6de-ad4abf6714e4", "comment": "Malware payload (AgentTesla)", "value": "6afc7c9b059aec742550109bb0b81ecb21a0232e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056848, "uuid": "b0c1a05f-d621-4536-9a88-423b956385e4", "comment": "Malware payload (AgentTesla)", "value": "be048c66970e8f1035deb00f41d037095f1be25c0cfca33a6f272959d338323e517d03d5faee52918c212ed54d53ef25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056848, "uuid": "8382421b-9891-4f4e-8d6e-8bf20d24a4de", "value": "T1E5F4E011712AAB27D7A843FE0918458913B4BB16FD67E23C2EDF11CDDC26F114A22E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056848, "uuid": "b2ced97e-7a1a-4508-9bfb-c4773da16703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056848, "uuid": "13623688-06b2-4bf3-9dda-08d8f463107a", "value": "12288:YoYZfTWwTL3hF8CrjEDYTLXtNWQwz2k7RjNThXC/yCaCNsHBEuvFxFtz/A:VGLHTLxNKGJNbK2kPhgNCDvFxFN/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056848, "uuid": "15e3c183-8a52-496b-b0a5-f43052ac46b6", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056848, "uuid": "869297b6-c29d-4973-b3f9-85bfd06c29dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056848, "uuid": "5da58e21-b358-4eec-98c8-2671b4e28b82", "value": "66f6bee1a68cf5d42bad745dac3f3c31fbe2dbe0582cf1da8429e18b1659867d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677e353f-f229-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684049516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049516, "uuid": "22dde078-ab3e-4d7a-8eec-62db2da11b9e", "comment": "Malware payload (Mirai)", "value": "6ac238ac893d5f5d2419e2bb4bcf4469", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049516, "uuid": "7ab3c26f-d5a6-4962-b890-06a0774dfb51", "comment": "Malware payload (Mirai)", "value": "680182eceb88adbdc6f1fc288ee27ef8124c231802dee7943d21205cdaffee34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049516, "uuid": "dd4a7d44-ef02-4b3b-8106-f220d603beea", "comment": "Malware payload (Mirai)", "value": "d13b02dfda75a738ce06ba2ae2057dc476e4794e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684049516, "uuid": "89f6ebe7-9a3f-40da-9073-a4b4019ad770", "comment": "Malware payload (Mirai)", "value": "db15831665af579982f26a03a2abaedd8e1738a07ffd35ac75cb2d850a8bd1e1b9e928169dbdea09e52db93b8c89eacd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684049516, "uuid": "106d109e-203e-4f69-a20d-ce924c520512", "value": "T19463A50ABF214FF7DC5FEC3745A91B06259C640A21A97B397E34D828F64A24F19E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684049516, "uuid": "249f5a99-8e04-43ca-8a3c-5d50fb75d050", "value": "768:pxNCJ0EYlDYhHuv5qsFSqwLX3U6OEAN6PNoUyO05jheleWTeKrmoNDpkdJLXirMv:pxNCJBYlpkqwwcAwP8O0fEfT9rmXLZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684049516, "uuid": "1467ec50-ac64-40cc-b3d1-91fa5fa1fc3f", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684049516, "uuid": "3a48d5d1-a0c0-4ce1-a6f2-980421971ebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684049516, "uuid": "063c16db-a5e3-4d18-9a30-51c25e92e4e4", "value": "6ac238ac893d5f5d2419e2bb4bcf4469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86926d24-f262-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684074049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074049, "uuid": "e07f38aa-ba48-4e8a-a19c-fa2ce1e7d742", "comment": "Malware payload (STRRAT)", "value": "d9aa050304fa9613c4c5b8b6eaa89937", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074049, "uuid": "ab961b8d-4d3a-4d0f-8824-cfafffa2f27d", "comment": "Malware payload (STRRAT)", "value": "685dbb25d706b37207aa5e0f901228735c45ea423ac508700dc7fabac08aa8d5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074049, "uuid": "d3a8f23f-b7a1-458e-9944-7266e32e2beb", "comment": "Malware payload (STRRAT)", "value": "f2e2a4d3ba0adbc5027ffeb463bee298ae255525", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074049, "uuid": "28f0b129-3091-43e1-8be2-e07dba3d473f", "comment": "Malware payload (STRRAT)", "value": "b5bab2f66eb5bfc1da79034ad20e6b11b68ab682516a7ce65190ac793fdf10a5c6881f31fb549138a18afe2a4fda639d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074049, "uuid": "26fc18c5-ed06-44df-b184-64d1c1d1085f", "value": "T18E5401AF3AAEC1FAE007417693009677681D06C6C0D9D12766FC39660934DBA1E16FDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074049, "uuid": "330a3542-b7d9-49e8-9073-f15591e3a7d2", "value": "6144:cjCBoEWA8e1mR+xuVJ8L+iqBleOz1hPkoVsdVhacijU7:UAb1mRiuVqL+vBnzLZydV7gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684074049, "uuid": "8d356659-f238-4fbc-9950-afa2f6de9f1f", "value": 281027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684074049, "uuid": "abb9bfdc-dfd7-4731-a03e-6372959039ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074049, "uuid": "384762bc-629d-4f37-900a-9826d341d622", "value": "Purchase_Order.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8608efb-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089621, "uuid": "2fc609bb-2941-41ac-a817-dd2c4f25d933", "comment": "Malware payload", "value": "19f85a45de2dcfa8a2dbb016c3421582", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089621, "uuid": "40c8786d-272a-472c-9c97-d6441cc0b1ca", "comment": "Malware payload", "value": "68f78c6fa80a3643dc8389008bb8e3632ef1ddd9927ec079a09a5a9a773d26aa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089621, "uuid": "245c3ba6-094f-4079-842c-f1fb175e1175", "comment": "Malware payload", "value": "8ad9f66e29cb988e98132f64b6d045bde4bee501", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089621, "uuid": "069b70be-36ba-41f6-89a5-8c30c4f43300", "comment": "Malware payload", "value": "93395404759b217efaccadba407d0c8e0acb863e84643b5d4fdf53441597989ea6f36247528e737fb43a19e94c3a3eb5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089621, "uuid": "3093f61c-a18c-4f62-aa25-cc021af51b16", "value": "T1FAD4F16EA3CC8597D5687CB2B383110CE52F0E9FD6BF32155AA43E7CF86DC608520669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089621, "uuid": "d369993d-327e-40ee-89f8-1c3a01c6013f", "value": "32a31fbc8bf28db3ee1293055ab37840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089621, "uuid": "50ffdb7a-810f-486f-a403-8fe2a0c7907b", "value": "12288:RT/3xaMs0/jfPxGpCZcgdD4qd0oiYlkZxmfCh:RTUUTxGgL54qyovODU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089621, "uuid": "360b4fbd-1ee0-404e-a29a-6c9ff8de4504", "value": 624272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089621, "uuid": "18cf54ad-e7ba-4b0d-bc44-5942b2b8b9d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089621, "uuid": "4ace86a4-d1b4-41f7-94fb-15d3aae16114", "value": "keygen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73231a5-f26f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684079714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079714, "uuid": "c4c82885-9714-4446-98d4-452c8b4cae81", "comment": "Malware payload (RedLineStealer)", "value": "a52631d8856e5106cfa191cfdacadadf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079714, "uuid": "cc74526a-2b25-403a-8eb6-f6b2184dc671", "comment": "Malware payload (RedLineStealer)", "value": "69773c7ac4d23937adf4a7165069a019724edea45442a46229d4e1b8e0ee412b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079714, "uuid": "9d669ca3-8b37-4b55-a526-2f5ed83200a6", "comment": "Malware payload (RedLineStealer)", "value": "a03e6e3908e8c0554beb163ad9d7a506028f9101", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079714, "uuid": "617b6275-eb67-4ffc-a1cc-d852fd7b2946", "comment": "Malware payload (RedLineStealer)", "value": "318d8579d7fd930bcd8c5188e5c71c457a0f0fc06da4c5faec4d21da53d1fe52f56071532d9b232054e102da8ea4bfb7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079714, "uuid": "9cb59732-1773-4833-9a5b-4dfb0855430a", "value": "T14B45230359D184F6EAF81F340DBB03E74F36BEA15D71962B6345196A0C33694AC7236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079714, "uuid": "f7fd617a-7c0a-4974-9490-f3fb4da5f503", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079714, "uuid": "54627797-f94c-428c-8dc0-c3df42af327c", "value": "24576:fycTWvi/tx1ZsVyH/X0fLUNE5Ure4oUs3lXz:qBWtx1ZsScfQheTUs3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684079714, "uuid": "db510fcc-97e6-4209-96da-494f44560b73", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684079714, "uuid": "902d5d60-e7b6-411d-a065-e705c501f88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079714, "uuid": "5fbeecd6-26cb-4d3e-95dc-625c31a7614f", "value": "SongFriday.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f4e3b6-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103420, "uuid": "a9d21adf-7ac0-4022-b84d-358345b8ef28", "comment": "Malware payload", "value": "63f6f847a806490fc9732aa078b509ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103420, "uuid": "20c5fd2d-56dd-4a29-bf05-eb795273a29c", "comment": "Malware payload", "value": "698b1039f42c6af5920490922ffcfa6113938c74c2fca8a587ff0d2f9231a3c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103420, "uuid": "325b1752-37e3-4138-aa64-67521758dc2a", "comment": "Malware payload", "value": "38e34ffc00e38bcf13b0958be3006926bc3cfe6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103420, "uuid": "b49b502c-301b-4760-bbc2-1db92f3520e4", "comment": "Malware payload", "value": "82931ed16e4a4b474ad06594e07e2ccb30fb318e4849db30dce749fba2257d1fe946a77f6193afa0e348fa7c6b1149e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103420, "uuid": "15abac7e-8e6a-46cf-99e2-542c8f387fee", "value": "T1F3866C26B291983BF1137634DE1BC6B4D935BE006A29544B7BB43D0DAF3B6413B29393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103420, "uuid": "1ebafaa4-60dc-454c-87ff-7f9a9bab6408", "value": "24576:yJYEkmJJhLyEIVMi866BjYT+VovCIaJxlpBgebzCX/mJ74MWeF5yqKiGdxNbCzwL:ymUJxyJM3BI+zFxlbyK4YF57GbY0/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103420, "uuid": "2b90b688-ea18-45dc-8065-24409426488c", "value": 8389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103420, "uuid": "a8e9d23b-2afc-40f8-864e-fedf3aa24d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103420, "uuid": "5190e83d-f0af-412f-87bc-5c0c62635cc4", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.29310.22201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59840c0d-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032312, "uuid": "16409459-6b88-4957-a7f8-7691c1bd16ad", "comment": "Malware payload (Mirai)", "value": "5610e890f1d7fed8813581c9e3f81da3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032312, "uuid": "50f09ec8-89ba-44d7-b514-8a3d46253712", "comment": "Malware payload (Mirai)", "value": "6aca418824bb000ecc6871beb184ddda5eb3543b89667ab4b968a80c005e84e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032312, "uuid": "7d74ae62-4bf1-4cd6-bf5c-067168efe14f", "comment": "Malware payload (Mirai)", "value": "b175f7f45bb99de1d006f01ed804132cd1456c9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032312, "uuid": "ee287aa6-5864-4ade-8660-164fae173cfe", "comment": "Malware payload (Mirai)", "value": "3a03cf9fa7839dc5ac8cd8f454304c7dbcaf3520214c11d48ad8bd6042fe084d7ef4272ad2867ee18ac4c527b7a36d8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032312, "uuid": "bdf2dd16-103a-41b8-ad9c-2de08f2d2a27", "value": "T167330A8EB8029D3CF90BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032312, "uuid": "9091a86e-4e54-4e2f-a909-749f7b0b30dd", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGE:r/hqaJMeteqK806MHdkfQX6HuCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032312, "uuid": "8816025a-86a8-4f48-a870-998d0ef68ce5", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032312, "uuid": "dc0be76d-6cf3-4223-b8c8-2b6acd356b56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032312, "uuid": "805803ba-73fe-4398-9ac4-c76edbb085de", "value": "5610e890f1d7fed8813581c9e3f81da3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc020c7-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089734, "uuid": "9fa65f9a-bf07-42d5-bb15-7de747686a2c", "comment": "Malware payload", "value": "21513b5044ffb1aed307d1d45a93b968", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089734, "uuid": "8bd36de8-3756-40d5-a5a9-93fd34d0355e", "comment": "Malware payload", "value": "6bbfe6d2ca7241e70b06e47f8866d1256de832141b6e5fb6a2019e2f7099d263", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089734, "uuid": "569b4c2e-0f56-422d-99e9-8cd5dd042cfd", "comment": "Malware payload", "value": "a58772db16fbd89e84fd9f156a6c0950f78bf129", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089734, "uuid": "07364da9-5fc1-4933-96d8-005958309e1f", "comment": "Malware payload", "value": "dd1e4290d2c0e967d7623fb228b2e48ee4aa867d8aee7401ed17f0f581d2eaa2362f822701d5583716b56c5cd8693dd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089734, "uuid": "2c446093-0786-40fc-8c1e-65cd39d98747", "value": "T1F5C5334D978859CDF2CDDAFA1E99CCBA05976F382911D92848D7AC83B87332849D3473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089734, "uuid": "76725eb6-5684-4ab3-9258-73d1fb2fa712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089734, "uuid": "ad3b9525-39dd-4138-9a5e-a8b94aa68470", "value": "49152:M4NipEsPd2Sq2jbQ0p3N9b6wMbAkVgIYXmTsWfE5zDmK5iEo/12LeedJyc0:MBzVz3X6TbDT3hE5zSKsxtoJyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089734, "uuid": "8b492c0d-1c53-45cb-a43a-71afc7e015ae", "value": 2737152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089734, "uuid": "2b0f0f32-9a9a-4194-848e-aea8ebc8bc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089734, "uuid": "c7388dde-6eb2-4d46-99b6-fbe3a5e64a0f", "value": "tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68cd0bb-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058265, "uuid": "fd4dbfcd-52b9-4ab8-8c3f-25ac81f8a5c5", "comment": "Malware payload (Formbook)", "value": "032ab9ad28a312035bcde1c5e22e6b35", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058265, "uuid": "c3a3142d-7dde-4720-9067-2ba55653cf72", "comment": "Malware payload (Formbook)", "value": "6dc913ef49ca51e9d02d49319a9b0f0fa2d6e5dec0c281e849e6965b10dbf0d6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058265, "uuid": "9799c75b-81d5-42fe-8075-13a5ef5f8fc9", "comment": "Malware payload (Formbook)", "value": "d1a1de3a143910d658e882f67c4bdd7dda6eba76", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058265, "uuid": "72ddf0ad-377f-4fef-be21-01fa38802220", "comment": "Malware payload (Formbook)", "value": "cca1d62fd31613b31a656f87f54cbca54b5966d544e994a141e052992fddf94d5b013fe692b9c2f6f173143b6dca4cab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058265, "uuid": "b80cdaee-e77d-421b-92bb-025bf56423e7", "value": "T106F49D2E8E14C2F5F67C07B5D0D37F292EA809A647D2851CB87B61C63B85B895C0DA4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058265, "uuid": "5c2f7925-32f5-4f94-8a77-491c0cb833b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058265, "uuid": "a46e8150-a24a-4362-8522-ea61d42a6e4d", "value": "12288:8wFZk4SN2iNs4z+EpWhHkGLP/RNjJ3lxRp3EhIr:8wFZMN12C+EqkEPjnp3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058265, "uuid": "cdb4e7b3-19d4-4baf-9418-2e3cadf0f03c", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058265, "uuid": "a30193f0-297b-4f49-98e8-4c5eb5974640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058265, "uuid": "9b002411-08e2-408f-afc7-b1a842b5250d", "value": "6dc913ef49ca51e9d02d49319a9b0f0fa2d6e5dec0c281e849e6965b10dbf0d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becaa6b8-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066842, "uuid": "d41602bf-8ff2-4aed-8c02-805f829fb4d8", "comment": "Malware payload (Mirai)", "value": "a3e81d69ce3b2b03ac63edcaf8ac88a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066842, "uuid": "384857e0-31e8-4403-a06f-0112b663917f", "comment": "Malware payload (Mirai)", "value": "6f1e8227e1ae7594b176a514f58bd5db7d0f450838a1263290feb129f910b66e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066842, "uuid": "f0b5c800-c284-4035-8ff3-3b150e2fff8a", "comment": "Malware payload (Mirai)", "value": "b0325d7e9ef87b186fbd4e6af2b3e63e3f07c7eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066842, "uuid": "82b28238-ecbf-43b8-b5ec-82edad0faebf", "comment": "Malware payload (Mirai)", "value": "e67b8e5eff30713247fb6d0c25b7850c96f29b9b23df34e279fae7db049dcf51783e91da57b998571905a7aaea202952", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066842, "uuid": "e034dcd1-2b31-49a3-9224-10830adf1634", "value": "T1DB6302FEDE4861A58DB13E399D3BC40562410525D4EA2BB33B2B19BA20474CFA8754B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066842, "uuid": "d94df90b-97cc-49b7-8151-9fca0ac38cd9", "value": "1536:iYyz8pDSKqaqkxzSQP5IMKgPmwVs5pq3FvdKura7yhFY6q:ilmDSKqaqenP5tpVUq1v3FHYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066842, "uuid": "98fd0768-0855-4996-8aab-276b542ee582", "value": 72048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066842, "uuid": "c9ac6228-2477-4fa8-94e7-b0548516235b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066842, "uuid": "005204d9-5380-4540-968a-2cc95a7739a8", "value": "a3e81d69ce3b2b03ac63edcaf8ac88a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7887a38-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684090023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090023, "uuid": "373d41b3-3606-459e-bdc4-e4511c86e2c1", "comment": "Malware payload", "value": "0515099c507984e91c3923b76c2a695a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090023, "uuid": "1ffd8382-92aa-4166-8b71-6adf59b78dd6", "comment": "Malware payload", "value": "6f4b9844aadeb85452f40329339fef9f01a03be6e981b427d30e8dc2b22c0174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090023, "uuid": "b761aaf7-ed50-4aae-996b-a1b413a3d47a", "comment": "Malware payload", "value": "56cfd6cd1b0f0071666a9e27af2c1b8fd7d2feda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090023, "uuid": "82369463-40ac-4a6a-bb5b-e0cce484c2c9", "comment": "Malware payload", "value": "f2c412c865498a14d888785229b366a027029fe4087c491b8045b0e274099000b4fd9354682232276cb459e38762024f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090023, "uuid": "4951e6b9-5740-4575-985d-1c540785cc5d", "value": "T1AA45233276D98033DCA327B258F603D71A317DB299388A1B2215EC2E2DB3544657777E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090023, "uuid": "234aff4b-2be7-41d1-8ea7-6bc9ff8b9adb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090023, "uuid": "6916de0f-1e9f-4661-9618-4be6d4091729", "value": "24576:0yPqyxdAMBXNwLYNKfk+BmPX6yo8J7y0BFzJJdCQIYQm:DBdA6XNwtkjo8htP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684090023, "uuid": "b24c71c8-c427-4d75-8d80-69d784863006", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684090023, "uuid": "239eb8aa-53ce-4fd9-93d2-03c03a8eb1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090023, "uuid": "fea9f687-2d07-4ee1-8519-279736f281e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c3361e-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057348, "uuid": "dc2b3a24-34e7-4849-99f7-973d449bb76d", "comment": "Malware payload (AgentTesla)", "value": "d61d2dd6df28f48ee8bd91a354f0ea75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057348, "uuid": "938a7d54-6704-4bf8-a99a-ca469dc1bb81", "comment": "Malware payload (AgentTesla)", "value": "6f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057348, "uuid": "c74deef8-86b6-4fff-8201-4e1e4ef40fd3", "comment": "Malware payload (AgentTesla)", "value": "f1b8861cc5fb41b4cba92fd56d33662a7bac5c29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057348, "uuid": "710e4832-d248-4442-b7e2-a2ffe2ab9df6", "comment": "Malware payload (AgentTesla)", "value": "11a5717d84774460f97a8676f8e13f6ada47771a17e55853bfe21e4f2f3a0877059168b6b28b9a5f801513b5b5f663b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057348, "uuid": "4c05a121-97b6-4ad9-bb99-0af62522191d", "value": "T1F3D49E63F125CADFEE713B65C15DE7567E60E412E050F0A17E0A20C8DAA57E21F8C27A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057348, "uuid": "3c8fed4c-1b2a-4741-a7a5-fd73bd74aaff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057348, "uuid": "5db32ae2-8bc2-4fec-b560-d9035c945924", "value": "12288:07a7Kdqsfri11yT9bTPwEqG21tQ6BbtF0lJ70L7/MEg:tKPfri1YNvt20s2wLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057348, "uuid": "64a6e3c1-abb3-42ab-95e4-d2d203d7a44e", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057348, "uuid": "4c8b1e74-e16c-4fa9-a291-b0a682f1fd4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057348, "uuid": "bd3bfca0-d105-4abf-84b7-3956979826b2", "value": "6f6635f95155f37d66c295977e973d28b681fb57fc50caf361e5e13f1037008a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740b8380-f223-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684046960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046960, "uuid": "e863ef82-0528-464a-be39-12bb770cbc2d", "comment": "Malware payload (Mirai)", "value": "3a9d23ae74771f0b81c0cd6d6e2767d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046960, "uuid": "f81e3d31-2911-46bf-8cc7-84a024737678", "comment": "Malware payload (Mirai)", "value": "6f73f7facf459eb09171dce70e2fe7c8ce3ae7cc6d3c5936f79be43d354db146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046960, "uuid": "792c2cf9-4e07-4ec1-890f-c6806e8e0962", "comment": "Malware payload (Mirai)", "value": "9e6c59756e2ed87a065a1f0c7edb0568b8e003b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046960, "uuid": "b1481bbb-a2ff-48d6-ba5e-3c485ab03fcb", "comment": "Malware payload (Mirai)", "value": "dc30bef4a379032aeab9d3927727835a3db31f990364b409f83398f3c842f39c12d6668a0e2af791da3d6d018000e94f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046960, "uuid": "7adf7cb9-9c6c-44b9-8173-4ef46d43afc6", "value": "T115B2DF3C1B111B98DE1EC0BE839C1B603DB81B2591429D4B7207AD97AF9A8747453FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046960, "uuid": "8b0cc3dd-506a-4cbf-9b33-ffc5657d27b3", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui4mdzJgGlzDpH7uNj1JA4f:neD8ZSWvZHZbs1row697qohQvg94izJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684046960, "uuid": "ddca117c-cc6a-4ba9-b2b7-f7087d1cfe98", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684046960, "uuid": "cdb55382-fe6d-4af1-9f46-ffc033c4b692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046960, "uuid": "a1d0ad37-ab3c-4f7c-8500-f3a21042f748", "value": "3a9d23ae74771f0b81c0cd6d6e2767d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9943ba4e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089542, "uuid": "686fef2c-3844-4242-953d-0e9ca856cf9b", "comment": "Malware payload", "value": "f553af81e238fcde1a22bc70bc28df86", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089542, "uuid": "c1de682e-7f23-4d4d-b4c6-a86466644854", "comment": "Malware payload", "value": "703ddcd984c50571fe711a97523cebf061e49fe73604d651de1766d16856241e", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089542, "uuid": "578e8e96-33ff-460a-801e-cc660c853a7f", "comment": "Malware payload", "value": "ffb0ed16f241af3f88ced0e91ad47144fb273de7", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089542, "uuid": "65671932-c2f5-4c02-a6bb-e173bcda01e7", "comment": "Malware payload", "value": "fe49a7cb917986a0c2ffc673631218cc25cd7d730ba79bca57cc42de1624cf259e993c29346c663517d445c3cdbb7c46", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089542, "uuid": "49471baf-833a-425f-b7c5-84c0fa2c6f6f", "value": "T13F9523579F16F892F588A53162A48E8619F66D8503E26F1D70CDF2BC9FF0384980877B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089542, "uuid": "013145fa-a9c7-4d25-ae64-0784ce7f0086", "value": "49152:Ql/y2IYRi7K5Mu7Iy/dE5btpFl/GhSN0ukRwBHBRVK:Ql/RIWi7HRl/WQcsVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089542, "uuid": "5ec6fc85-c244-42e7-8ac0-2394224f9b34", "value": 1906411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089542, "uuid": "abb095b0-5af6-4a1d-bedc-db35b19e5b9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089542, "uuid": "fb6dfc32-710e-49be-8a0e-053946150717", "value": "F553AF81E238FCDE1A22BC70BC28DF86.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b93029c-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089385, "uuid": "a6a4b526-cef9-4f4e-a7f9-792bc473081f", "comment": "Malware payload", "value": "e0dd14720e4fef02d29a4b027536d273", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089385, "uuid": "fba4bec7-c7f3-4520-8f1f-1ee65c45b8a2", "comment": "Malware payload", "value": "704736950ba26c887484c211282b905ad103094a9a2027fd323e65d73f10e652", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089385, "uuid": "fc47ba02-5336-4aba-80f7-1a8eeefb520f", "comment": "Malware payload", "value": "e5c82f68344913dfe3a04a9cd71b1c5a3aae4d3f", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089385, "uuid": "d0ebb0e6-b1a6-4522-a045-501d38f50478", "comment": "Malware payload", "value": "43f89f2709e001aec55afff12b25a39d7780ae9f2af47ca2d805b03ebc1bdb44aa1971fc20d6aaf3e4ad06795015e6b4", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089385, "uuid": "9b21e01e-36fe-4531-99d7-02acd428e14e", "value": "T1EDA523429E0AD883F914A13276B14E827CE66DD502D2BFA571CDB1BC9FF6781890473B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089385, "uuid": "65094ddd-853e-49b3-92b1-203a8166f36a", "value": "49152:lfkD0B48mRDuCiZVe+Y5euzIy/dCzbZphl/6hSJgikRkhn2Xe:6K4FoCsVj7Fl/KEsu2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089385, "uuid": "7ef59dd5-f3dd-4ede-9a14-57b351653767", "value": 2089774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089385, "uuid": "22abdf25-86eb-4b39-9b72-1baf4affcb15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089385, "uuid": "3ece2a36-5d25-4851-901f-8386d99782e3", "value": "E0DD14720E4FEF02D29A4B027536D273.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6dc59a-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056423, "uuid": "cfcb0ef5-5640-4da6-b4ae-e1523cda8685", "comment": "Malware payload (KmsdBot)", "value": "56b621c794cc3f808959604de397ce88", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056423, "uuid": "e03ae207-0d03-4595-91e9-fd5ea102aa91", "comment": "Malware payload (KmsdBot)", "value": "718fc249bcd6bc37ad229fb2d8c4037dc8dc8f4555d01934266d1a0c17d676cf", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056423, "uuid": "00fb55c6-01a2-462c-bbfd-a48853d9ccf9", "comment": "Malware payload (KmsdBot)", "value": "b2cbcf098c6d9121d7a3f563e3365ffe530141ca", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056423, "uuid": "a4ef7e2e-8978-45f6-a8cb-7d66ed060e47", "comment": "Malware payload (KmsdBot)", "value": "4c3c10a5dd9cc5a5e0e12a20ac22c4b8779b4cf057388057f7a58b0e66b93f85d3cd44ed5c257417918d01b422579197", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056423, "uuid": "fb3aa3b9-8d32-4da7-a324-ec749a6d26f1", "value": "T11C268C20FEDB40F6E6431E3154BBB27F67316A054725EBC3DA586E26ED7B2850C32219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056423, "uuid": "34f84505-28fe-4d1a-8e7e-d31a258b0e0b", "value": "49152:Ms8SH197Je7DIg87wK8X9sqmxQzeOsDOxIM73RrF1SGP9rGKGJJkRHQRgZVU5rCo:eSVFSsBxQzeOkGVyK+JeKYW5rCQIEDSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056423, "uuid": "12672aca-7f67-41ec-ac5a-762c7fb1eeb3", "value": 4542600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056423, "uuid": "ac380fd1-a05b-4403-8656-5d117fb9b599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056423, "uuid": "d040b5c6-c318-4e76-b796-c007baa6207c", "value": "718fc249bcd6bc37ad229fb2d8c4037dc8dc8f4555d01934266d1a0c17d676cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5269d393-f27a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684084270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084270, "uuid": "b9a7c6cb-49ee-4919-8849-283593be762c", "comment": "Malware payload", "value": "06707603ea2a5aa4a13c4873e67747d7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084270, "uuid": "77125a1c-d866-49ef-9672-971f29d54c5a", "comment": "Malware payload", "value": "72c83c7b3d29371e93c8180520c25ca54da0cc661f37cf7a44f54990f21effe6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084270, "uuid": "cba46420-49f3-4778-bc99-6c6501330090", "comment": "Malware payload", "value": "be9b6ab3bcb9c7fb1b8db3d328e3812ed631ac7e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084270, "uuid": "bbbcacd6-9fe7-446d-8c80-fa647f611031", "comment": "Malware payload", "value": "d22f83f8717f3550569150908e0a7e92cf2cd060c5d4a9b373f9c57899d50fe0610c37970e33966e39a33e125a4ee0be", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084270, "uuid": "532888f3-999a-409f-9260-68b3e4e94dc4", "value": "T1EE7378B613804BB6E3C54BD04218B11B0DF2E16B3464299DDBE259DFBC29EA37938572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084270, "uuid": "51bb373f-ff16-4315-b189-9fe57603d0d9", "value": "768:0jBC1/U8SEpqGy9LznrWHtf1ILDE0K1N9HMWagGPkFsDZieQK4PsMHy8K:0jBCZEznqtPHbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684084270, "uuid": "68bdb6bb-0223-45ab-8a97-3066c1beea5b", "value": 80503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684084270, "uuid": "48fce6cb-c66e-46c9-bdbd-4032e5e8e8d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084270, "uuid": "120a8e9f-1d0b-418b-aa39-c26e6ba8bed9", "value": "vidyud_jpg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4c48b9-f273-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684081255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081255, "uuid": "b6774423-50fe-4ff2-9a08-ea45b3adebbe", "comment": "Malware payload (Amadey)", "value": "36a92a00c6d4ae2399107c3aa44d24ab", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081255, "uuid": "85c3bbf1-34c0-4c0d-a19a-695623353b2b", "comment": "Malware payload (Amadey)", "value": "7328b3bf74e4c6e1ea8f8a05945948dfaa05bf3124084fa652a4c62889dff2cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081255, "uuid": "deaf6cf3-0573-4b7a-8747-42f24dd1f3eb", "comment": "Malware payload (Amadey)", "value": "bdc4c59f6988e9339c5e7d29bff6af9fad8655fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081255, "uuid": "f2447fc7-176b-47a3-9231-68a9e32f5c21", "comment": "Malware payload (Amadey)", "value": "b887881d0808e36894694dbcf3dec75d029b60ce26659ea55e0360837b6bea2971bc2b9626947918323fd89efa772107", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081255, "uuid": "fb81750c-19a2-4695-bfcb-f8cbce2258e0", "value": "T160645C0363F57D60E6694A359E1ED3F87ADEF9508F4937AB12186A2F08703B2C172719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081255, "uuid": "32dc5199-96e9-45bb-9686-a47e297c937b", "value": "3868a5143720e42c9b8ae5f884162a43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081255, "uuid": "b074bd27-c3b5-41ab-803b-e166d87e2d5f", "value": "3072:5Pg7Y/C4ZtCV3fmZboHGeM9YRSSPMOLQO/zkaCC2KvHkvAIehFiGvecGXyx/95Jn:57F/Ccbtzi8GUqkafZvEvAI4sas+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684081255, "uuid": "4870ee36-cb20-4561-b7ea-f00bc63f718d", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684081255, "uuid": "14e9c739-51ca-43ff-afab-9c4401a413c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081255, "uuid": "9634d374-9aa5-4a8c-843c-a8b0709f07d2", "value": "invonce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edceff5f-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684056613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056613, "uuid": "f84b4388-a1cb-4bd4-a4bf-88da1a42492a", "comment": "Malware payload (RedLineStealer)", "value": "c1fd7689d29854f5c1a38a8c3f82b078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056613, "uuid": "52d00d11-188a-49d1-a8d0-908218b8d68d", "comment": "Malware payload (RedLineStealer)", "value": "73e321c28c62a7d3be481a358f4832c84e13e1a52522593755e4c24f6a0f9364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056613, "uuid": "1f4d2d83-686a-4965-8969-ffc614cf7fb1", "comment": "Malware payload (RedLineStealer)", "value": "46d90c37a88a871306ad59b7bd861f1ba1eb4f93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056613, "uuid": "28b94cfb-e87d-43f3-83d8-e3f1b6beb52b", "comment": "Malware payload (RedLineStealer)", "value": "7823bf2e0b5979cdedcc57ea8732759107bb97cb5caca7f226d544912138403437d6bb91a0de23ea5a1df0a0add33ded", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056613, "uuid": "41b04f7a-8bea-46f6-bea5-720ec6ff1543", "value": "T1214523A19EF19036D8B007B54CB703A32B3A7DD31D38665F2397A85A0CB35C9A47136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056613, "uuid": "fbf1064b-9ec0-43bf-b2e7-dbe1372b954a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056613, "uuid": "d3ba3947-2e89-4571-8d9f-000883d78eae", "value": "24576:8yzkBCXcMUXAhYXc7p+apvCc5qyALlSP4yzvZ7JM55GGqLop7K:rz+CXcvM7p1pvGV4H7JKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056613, "uuid": "6181220e-8d32-413f-832e-760dfa26e413", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056613, "uuid": "eb8cfe70-40ad-4d41-a6db-da768ec3394f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056613, "uuid": "a6fb3cf9-cada-497a-b202-e5cd23480f02", "value": "c1fd7689d29854f5c1a38a8c3f82b078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470cb838-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089834, "uuid": "42611fa6-0401-4cd7-a3cf-55a191cff9cd", "comment": "Malware payload", "value": "a87313278b5feb8f8efc7a940281c08c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089834, "uuid": "f22bbe76-457c-4861-a40c-48ded3b5c26a", "comment": "Malware payload", "value": "73f6e4ad2bfa006d63d9804ea1f20b9066e6db9f4f234e028e97d31407f9f550", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089834, "uuid": "0f05c989-9396-4fbb-a5c2-dbb73fc0cdd9", "comment": "Malware payload", "value": "7a9f74eb77c12b94242de660106fbc794b86034b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089834, "uuid": "5690e070-8b72-41a0-9fe1-de102a72eccd", "comment": "Malware payload", "value": "8eff0c59cc742f9e03c48010d22120b8f45f24bd4ec7632c0299f98e09c5b2fbbd8c40eea25b48908e4e1af614d57cdd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089834, "uuid": "74289aa0-55e5-4873-91c7-05a248a6975e", "value": "T155C47C56A2E801E9D1A7C17CC647C613E7B6B05913509BDB13E4C67A2F23BE16F3A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089834, "uuid": "10a45f17-960a-4b8e-99d1-ac4490b7728e", "value": "e8bfbe423cfbfcb9b3017d141ab83089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089834, "uuid": "cd86e405-3402-4c2a-934a-c4bf3f4b71cf", "value": "6144:QiWzIfEUKzP08sPG0IREtk6qBVsdaImCZrhlDZLw2dn3B7pb3mvCBkhqv4cb+nfR:awovy+sXmCZrhlDO2dn31pbWEkvXifW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089834, "uuid": "9333e45f-1dbf-4d37-98c9-a6aa58147cfd", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089834, "uuid": "b2ad2482-0e71-471c-a561-8893fcbca8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089834, "uuid": "3a41e7d8-40fe-44cd-98f3-4f3a7bcf0b8b", "value": "zicce.ccwoofer1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef61590-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089364, "uuid": "7e74065c-f097-449a-a21a-146f90439f4c", "comment": "Malware payload", "value": "9f972dbe36d4ce709aa21c291d632d31", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089364, "uuid": "8f2b6202-bce5-4db9-874c-6e53f4cc9682", "comment": "Malware payload", "value": "741684cfcbc861b076bd7561be29f8bd3f1814b9049034a0412601f786f0f0f0", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089364, "uuid": "268d46ab-761a-404a-b04f-0a891be9c664", "comment": "Malware payload", "value": "2bfeeeacf67b2c7668684595bd6bc28bf4483848", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089364, "uuid": "72e7dd29-19ec-4e46-8ae5-5c10ee2a26fe", "comment": "Malware payload", "value": "e9d2222f81e0b7564db4770ad96e59f725cc46aba2f4cd7482bc44ae289f26fcf963e4a35a066123a5936925d758cc69", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089364, "uuid": "23aa5f2d-c8f6-4235-b886-497332ab9c58", "value": "T11103CF92DBED6481F0FB5CF57036118434F635C07A45EE2E0AA16A3958E8E066F353B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089364, "uuid": "8f47a03f-3579-4fe5-8002-5fd44423096c", "value": "768:WNC+zVgpQfomNawN4N5N3NAC4IF2CCx2fkVt4CmGM:obOzdN4Q2DxvVt4C9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089364, "uuid": "337990c8-0e64-4213-aed4-fea4fe8adb4f", "value": 41086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089364, "uuid": "c46c09e5-7899-4e81-8fa7-1557a7f7e00b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089364, "uuid": "3159aceb-cf57-439c-9d33-b9b73422501d", "value": "dropped9F972DBE36D4CE709AA21C291D632D31a33.jpg.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73beaa3-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058266, "uuid": "99b108ae-8f2a-45b0-8147-158c4740fcae", "comment": "Malware payload (Formbook)", "value": "d9ce51f30059c00e6f558a6f8b9d55eb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058266, "uuid": "e49c1c4f-b5a9-4682-8337-84bb61785cff", "comment": "Malware payload (Formbook)", "value": "7428f76122fbba77322e7338dafb21a613cbcc104f5af85c026b350c2d426f23", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058266, "uuid": "40ae6f75-48da-4950-a016-ca003ad8a380", "comment": "Malware payload (Formbook)", "value": "3894709ee5d71f04612c2a383e9827ff1c4866ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058266, "uuid": "be0a3377-e29a-44b0-a712-d3c45ea8721b", "comment": "Malware payload (Formbook)", "value": "4501a6ab74e517c5aaabbb2643956d76c74a7549b8b3dc285d078c934a2975d24ed0c384442ddd8e8fb8c36fe77ef3c8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058266, "uuid": "157866b6-f5ab-42ec-81b9-6272bba714ac", "value": "T193E4053C49BDE22B91B8D6A58FE1842BF310E56F3115AEE6ACD747518316E4234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058266, "uuid": "239ac7c4-b39b-4e91-82ab-b5d904be13ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058266, "uuid": "61c4cac9-0abb-4532-8d69-c00dcc98389a", "value": "12288:5CQM53OyNS3SFd9HejtM3i1RCdD5ZltAEIXY0SNNAh:w5Dzm+y1gddYI0SfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058266, "uuid": "b514831b-1753-43b0-a891-002fce0bf93e", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058266, "uuid": "3a54ae8c-2423-41d1-ad1c-b9c2c1d76922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058266, "uuid": "566da73f-8d59-4126-afb3-e784f816f122", "value": "7428f76122fbba77322e7338dafb21a613cbcc104f5af85c026b350c2d426f23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d404046-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684055860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055860, "uuid": "77fb985b-43f1-448b-baca-3b9e1a876c4b", "comment": "Malware payload", "value": "c29215ddcd02477252e96e4cb33bd29d", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055860, "uuid": "c780acae-180b-4bff-9d95-5e1a1eca497b", "comment": "Malware payload", "value": "744c97471d9e15867e3dfea12096b2b7b03a98be224a741fd760a3001620feb2", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055860, "uuid": "a4c23baf-b7c6-4c06-b410-1bdd49ca8081", "comment": "Malware payload", "value": "324e2386ea58643c2fe67e4cf706acaf9d0e9ef0", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055860, "uuid": "65c5ccff-06a9-48fd-8165-ae3c4650d8b1", "comment": "Malware payload", "value": "319230bd9c8615a57ea6fe8e4d4a6ec3efbc998186c5e7df8e5c953ce01cdb4db531d98e3164101d755ac7803fabf904", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055860, "uuid": "04184dc9-5a51-4394-adf2-bd122ced748d", "value": "T13AB48DC9E9918A41F75C2E3580AF0A24E7A1F753F2F3E30D1E582ED55D52AE24887EC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055860, "uuid": "0510d55e-39d8-4b1e-8be2-eb9eae3aa883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055860, "uuid": "3891aa15-20cb-48e8-aebc-e11a27f067e9", "value": "6144:H45V3Zdqx9S/MNYzZWtIPTqRaQju1bVdhI0H4hpiekNUYHER7yBS1QPWv5or:HyV3ZMXSk6OVPa1fd4zYH8mBS1QPI2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055860, "uuid": "eee7a866-d097-4194-b2a4-b8e600038481", "value": 531376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055860, "uuid": "728e7c60-53b8-4cad-948a-9a07e61b1a0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055860, "uuid": "44df5419-b8a9-478a-ab1e-63736db43da6", "value": "744c97471d9e15867e3dfea12096b2b7b03a98be224a741fd760a3001620feb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6fbdf5-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066863, "uuid": "2280a419-102d-4e55-a6ca-55703fb85227", "comment": "Malware payload (Mirai)", "value": "2a76ace9d739aaa6800d21cfde633454", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066863, "uuid": "9112393b-f7c1-445f-b110-eddb608d96fb", "comment": "Malware payload (Mirai)", "value": "74504ec2e10da2c442b64104191b277005a588bcfedada8a3501ff5a5ad7608d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066863, "uuid": "2e3c7069-52da-42f7-b49f-d96453a5e1d2", "comment": "Malware payload (Mirai)", "value": "2d100760c43885ef9c06f638fcfad93e9310337f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066863, "uuid": "1e442edc-1986-4ad9-a993-54a8b59d8a1d", "comment": "Malware payload (Mirai)", "value": "067f5e4ab1496f787cf251bebdd6014c71830014a355ecd94d1dd7ba711ab45053f86937e69d526caea7239dc0bd70c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066863, "uuid": "dd37c6e5-e0f7-4b94-ab88-f1c8a2fb4142", "value": "T155230271480A9EF125703C32DB95A393B6E129B1C6673123C62C0B386FB57131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066863, "uuid": "2351e9ae-03b6-4029-a81a-a47c04ac3acd", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3769q3UELbUXfi6nVMQHI4vcGpv+:DECFd+A6YHAxTLRQZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066863, "uuid": "22ee99c3-087b-42a3-aa41-d1d09f641d89", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066863, "uuid": "958210fe-7ac5-486a-9359-02a17ed20a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066863, "uuid": "8cbae00e-79e1-4589-900b-63999625d637", "value": "2a76ace9d739aaa6800d21cfde633454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7321568d-f22f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052112, "uuid": "2cb72037-378b-45e4-b6de-48a93369686c", "comment": "Malware payload (Mirai)", "value": "c367e3e446d3b96e4968a3358f2e53c3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052112, "uuid": "8f25fbfa-c129-4e3f-b148-f5fe52c85657", "comment": "Malware payload (Mirai)", "value": "74546959f0ac470265812ed94586103402c81263c36fb1541e3a36b627761a00", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052112, "uuid": "e1fab38b-1fcc-4196-bfb5-09478301c287", "comment": "Malware payload (Mirai)", "value": "426550fbeeaa15327ce48f80f6dfea9a633cb665", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052112, "uuid": "00e2a763-cd20-436d-a02e-f48362862bc2", "comment": "Malware payload (Mirai)", "value": "919f6d08a564acff3b2503a688fb0ccf2b0a651fcc5df910042e71ad78780fb0574cdde7e4fd647d5e75e0fa80b7d1aa", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052112, "uuid": "4b543c8f-044e-414e-a54a-9f6c80dd36e3", "value": "T1B7534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052112, "uuid": "f0f9c865-467a-4c28-b1a4-0d3aaab45c60", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/XDiQ/LiKimfFoktCe3fYRM6:WShU3q7cEDlCK/XDX9i8Fok06fYR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052112, "uuid": "2c93487c-a5f8-41e8-9708-0fcdd43262ac", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052112, "uuid": "fc123f83-bdc5-4c71-9e24-bdc66d48f392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052112, "uuid": "f4a71d4e-c775-40cc-b586-51a451428d75", "value": "74546959f0ac470265812ed94586103402c81263c36fb1541e3a36b627761a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054f9da7-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089724, "uuid": "71862c79-3a61-4f96-be27-d0ce46a28b46", "comment": "Malware payload", "value": "db6c443e3a44bbe7b46dd1ab3150ecdf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089724, "uuid": "df37b6d1-5eb7-4d13-b62c-1788afa650b6", "comment": "Malware payload", "value": "7479ccf8751d4a54ff49a96e2bf526b4e9dc2eb4910fb1c00759fd59fec9841a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089724, "uuid": "6b423e41-17bb-49d1-aae2-d6eddde67bb8", "comment": "Malware payload", "value": "3d2c39401c5cc3cfc859e9c743e849e10ba0bf37", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089724, "uuid": "d8e9834e-efc1-4aea-a0ad-b0983a76a246", "comment": "Malware payload", "value": "b9ea73237425c2c6df192444df0a22192a49e7baed8732d5a8fe09cf995ee300db590825dfc4947638f2b2eb0e49d9fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089724, "uuid": "109afc96-cc5a-4e86-a8dd-09b8f13203d3", "value": "T1FEF3ED88476128674B1B6E76B63894B9DB7D0EA482DC449FF46F7180F6CFE8DD0D0621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089724, "uuid": "33834172-13b7-431c-ba0d-0a8b0c37aaa3", "value": "3072:3qkbH/H2hkZO9uR8hrRINo/1njM0L3FqCVUnAOOkytJ:3tbuaSh9HjH3Fq9r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089724, "uuid": "8e99373b-548f-42b8-b75b-2ac2cca2a52c", "value": 165342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089724, "uuid": "7a84b06e-7004-4cd9-b3ba-d31720d83722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089724, "uuid": "b5fdabd1-2db6-4de2-8a1d-d00784edbe8b", "value": "test.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1730d0d6-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089754, "uuid": "878f27b3-9a5b-4db2-b6d8-09b4a2484666", "comment": "Malware payload", "value": "2ae795a2cfb22a87bebd713bef1ae78d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089754, "uuid": "3799eb7f-27b6-4aad-91c7-3900442c57b1", "comment": "Malware payload", "value": "7634559c1f31d02170001101a08597f37d49f99dbb6a9846739b8c50d12d6553", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089754, "uuid": "dc962b76-b2f3-4b66-9643-1f57282fd43e", "comment": "Malware payload", "value": "52e9a119987808da541fefadad34fa25c1fc78f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089754, "uuid": "18ec4202-7813-42d0-9889-3dcd15afb67c", "comment": "Malware payload", "value": "b7ee4ab856bf5a2f7eeb717464f870a2133ffd9b73927c7c2be84ffa1b2beca2a15f2c169a551ed36c295faedaf9a948", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089754, "uuid": "1f80b62e-ca14-4011-be21-d208e7eceea6", "value": "T1B1147CB6B39044F3C492003164D09B369ABEF9301B7D8196DF90DA5D7DA5AF2BD2A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089754, "uuid": "ecc6705e-4adc-4edd-a7e4-5a570685d3ec", "value": "7c79a6c939917f4d3e5e71240b362de3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089754, "uuid": "81dc88a0-6bc0-495a-9e50-2a9063bdb960", "value": "3072:ZAh4Zz+c4JDP9QqM1r+DF2onZyGHN8lM30sbrslHfL6Uc1lcB06UoL6R:zz+ccP8EpZLHNeM/nsFL6UX06Uo6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089754, "uuid": "cdcf78bc-d57c-4746-ac6f-251fd5be9f7e", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089754, "uuid": "54ec73f6-9c88-43d8-9ec0-181c77553de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089754, "uuid": "b92c994d-bb60-45cf-8b0f-d672e98ef888", "value": "undertow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc341338-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684051054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051054, "uuid": "3848ad0a-1ccf-4092-8a97-c8dca2940411", "comment": "Malware payload (SnakeKeylogger)", "value": "a81f4aa45f440bfb0f40c9add7f0acae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051054, "uuid": "f187658e-7919-45cc-9325-557e6d1a3fce", "comment": "Malware payload (SnakeKeylogger)", "value": "765363962cbf6b2b438caf02d916a567a600d3149b68621179af03c8312f296e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051054, "uuid": "4a493fe2-0324-40e4-b954-8b3cc68886bb", "comment": "Malware payload (SnakeKeylogger)", "value": "ea90e316a1ce994ed7a403577bc92d466956d142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051054, "uuid": "9b2c4f62-eec0-4ae2-b1c4-5f603021718a", "comment": "Malware payload (SnakeKeylogger)", "value": "60bf7e84fc093258e57c99712802f15fac2a276cc7d1105829726f2774f084d5c2f542271c5577e12ee6606119f4b835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051054, "uuid": "66a71cb7-a9f3-40d7-ba36-19dc66bd4a31", "value": "T164C4BF45AA19AB77F2AE0FB530035D04236CBC667670E22D6DC371D992BAF3047DA607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051054, "uuid": "306d5e6c-4501-4b57-bcf3-7abd64e9bf3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051054, "uuid": "fb69b1da-0caf-415c-9a6c-775659747d85", "value": "12288:C8jvv/4HVx577zvwfiXT+tZRBqJp1XFL7MIFzBcqy1+Pe/:lvYTNfw4cZRo75lXTyoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684051054, "uuid": "75016785-2e44-412b-8227-081b26784e95", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684051054, "uuid": "01a750db-62a0-409c-9551-8ef1bb24aeab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051054, "uuid": "e69db428-553b-42d9-853f-ba399b9916b7", "value": "PO 2290420230132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478cee47-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684067501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067501, "uuid": "8a1ead34-d3c1-4393-894e-002c24f90c03", "comment": "Malware payload (Mirai)", "value": "e573132bc79a7ac18cb815675b3084a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067501, "uuid": "2ca68f55-6204-4ccc-af01-d502d8442374", "comment": "Malware payload (Mirai)", "value": "76f5ae44476546bc78b114bbca2cf532ffb113de5f73f4655a6918c1069ae9a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067501, "uuid": "37a7c833-153a-44e5-8089-55e72759dab7", "comment": "Malware payload (Mirai)", "value": "4744682da1529a9f7fc158e52ad32ce6e6878b52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067501, "uuid": "4a8f102a-8f4d-49d8-b404-44d158ca4302", "comment": "Malware payload (Mirai)", "value": "4dc090f4d6f4cac76d375540f42de6857ff1e40c0144d1c8880e6186041b6dd0423c69078f11111bd5b1ea9368220457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067501, "uuid": "c51e2cfe-e462-4c7b-a58c-be447811c39d", "value": "T101130261A18D18ADCAB11B31E17FC1CFEE7838B85A9496E5A1C1553E63CF1D144F8363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067501, "uuid": "9be8a3c6-706e-44c7-961d-66f1543bbcf3", "value": "768:PECEWi5gNxWIfN0zhy2IqUpe6RGTP3eyM610XzDQqfi3Uc:MUxWu0Ny2t8eDT3Sj0aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067501, "uuid": "de4780e9-2ed4-49ac-86de-f58aab08c7b9", "value": 44756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067501, "uuid": "396fdc57-895c-4916-8602-09e5ce2a4678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067501, "uuid": "20435137-4046-4019-81a3-284bd23e8a9d", "value": "e573132bc79a7ac18cb815675b3084a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7385817-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103417, "uuid": "6107d6ed-5e16-45e5-8531-3246592a7430", "comment": "Malware payload", "value": "108754b2f6c6818dea2a974bb7113764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103417, "uuid": "b130652d-f600-4586-8d89-50dca9ccb7b9", "comment": "Malware payload", "value": "77bf27d9b1b9221e525a531a576dbaf0caf0080b6fe5ac34749438284528a23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103417, "uuid": "fc46ec06-a602-4745-b30d-029b831ae64e", "comment": "Malware payload", "value": "c266227e6b2a4f4c92eb6ff7eb1d9bb3af381129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103417, "uuid": "609fbf52-e4ae-42ea-b22c-b2288ddd972f", "comment": "Malware payload", "value": "71dfb8c8d274bbc8a44d628bc970da5d961b939e295a2abedf7d6381fc85420b13043c5f9633f23e26b9214a3d081de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103417, "uuid": "e93c7c81-7529-4b1f-96fe-f08854fb70ba", "value": "T1E253CEEA75E18E82C091197A7A82C79F3AD473218E61F04FF7B76B4E55AC0C0E85D0E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103417, "uuid": "4028136d-1747-469c-b6c3-1c4a0e6b8fbf", "value": "afb1ed92102b757e36567a4fe18527cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103417, "uuid": "41a73641-73a0-45df-8dca-7389274cccf2", "value": "1536:ktQmuU+QKUSmwrVs8BiNejStTa7kFqwdo55P9O:ktkc2s8BiNeWtTa7nwdo56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103417, "uuid": "92e53827-74f0-41da-9dcc-65a8db35fb2b", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103417, "uuid": "cdd7b117-addb-4c66-b2b9-4e1662c57920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103417, "uuid": "cb060c88-ec59-4152-9647-f7731b3958d3", "value": "SecuriteInfo.com.Backdoor.Win32.Agobot.17043.28163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f8d58a-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1684050829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050829, "uuid": "87f7d138-ea7c-4ead-a3a5-1d51af958a15", "comment": "Malware payload (QuasarRAT)", "value": "b5eb699845a8e943a788280ed8b27517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050829, "uuid": "f8143bcf-5cb2-47f5-b57d-3c32c0632eab", "comment": "Malware payload (QuasarRAT)", "value": "78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050829, "uuid": "f06314ec-6dbd-49fa-879e-ddd6ec9d235a", "comment": "Malware payload (QuasarRAT)", "value": "436e53d4a0bd510cfe242244a8d58855cb78ed18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050829, "uuid": "061124ee-d281-4cfb-883f-19f47a1fc253", "comment": "Malware payload (QuasarRAT)", "value": "b5be5cea14270737e96466c93ac35167b664eda119a2a1eb839a877bd8d75d79022fd8609e6e9f777801c6c2e3f04900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050829, "uuid": "c397e604-b729-40ab-8c5a-1e91a46d2677", "value": "T126163306B0D188F1E17129310AF25BB5623E7D6309F1D8A767EC0B5F8FB56426B22637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050829, "uuid": "079ee06b-e030-4043-a710-1e80f80f9d6f", "value": "ef95916dd097e49708f7a909e91f42c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050829, "uuid": "16fc167d-bb80-4cd7-a85e-7e3d94cb8a04", "value": "98304:420RJx1z4xKUHmqwwbjBJT5vLuAyuZf/Wq/7kcaT65Z:aRJxdEbjljuAyIfeqjkWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684050829, "uuid": "aedec186-6e47-44d0-a8fa-e51825195f2a", "value": 4391424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684050829, "uuid": "5f171f39-a2ae-4340-a2cf-84879f3cf06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050829, "uuid": "f9470dc1-112c-4686-a4bf-ab8f6865ad5b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7feb3e1-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684058268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058268, "uuid": "b1d8f740-1925-4080-9f4e-d30d6bff66cb", "comment": "Malware payload", "value": "9f339063dbe562051732472b0f73c12d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058268, "uuid": "287bea9c-d806-4543-bc20-465c7273a7f2", "comment": "Malware payload", "value": "7955c98c1bd693e24c92833f2186d58dd0c5fad231a8f27572bac5aeb2793674", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058268, "uuid": "f80490cd-e6d3-4585-8995-47d0b67e2c6e", "comment": "Malware payload", "value": "2ac2940992ad9cee88092e18566c82f6b6c114b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058268, "uuid": "304795d5-0e6d-489d-9664-aea5b51ac54c", "comment": "Malware payload", "value": "483d848c6c3287890e5ea0001bf4f4de89038089d0cd46b37cf1fa3319e4315228851102c602950e0d3500fc3c1f1567", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058268, "uuid": "87d275c4-874a-4ed6-b020-df48ed60f632", "value": "T122C58E5AA2EC40D4D5E9D079CD174B0BE7B2F851023583AF10A94B5ADFF72720E2E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058268, "uuid": "c622a414-75a0-4883-943a-039fb43fbe64", "value": "1dabae8d8b84667a71f99d771c05415c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058268, "uuid": "bec63347-85cb-4b50-bd8a-e7475f6c0cd0", "value": "49152:MC8ie3CGb7SCEns4SdqyTZ0Z3dMZG0+RQnwyiAKP1HrlF0OS20wlR+BkpT:e3+P2wyiAA0OSylRMkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058268, "uuid": "eb31e940-1e03-43dc-b547-a68533f373af", "value": 2733568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058268, "uuid": "f001690a-0e4a-49d5-ac60-72b7074e2159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058268, "uuid": "e0387216-39e0-4be6-8a68-0230ca464f00", "value": "7955c98c1bd693e24c92833f2186d58dd0c5fad231a8f27572bac5aeb2793674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1b5657-f1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1684023616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023616, "uuid": "6212276f-bf5a-45d1-bee2-5f7913d4af69", "comment": "Malware payload (Vidar)", "value": "a17af46e9c7bba005d9907ad2b722560", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023616, "uuid": "3812105b-201a-47dd-b505-de7366d4fa5c", "comment": "Malware payload (Vidar)", "value": "79b23b23f117799f716d74c2d4d59263926ef13cb47078a161fe88c9a3bc1cb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023616, "uuid": "7a883189-2b18-414e-a116-18ecde900bf5", "comment": "Malware payload (Vidar)", "value": "1e6aaf7adea2dd0c7e0b2bd962482b66452d664f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023616, "uuid": "869548c5-627b-4166-baae-54f57a27208a", "comment": "Malware payload (Vidar)", "value": "e62179f2ff75ccac09431a9bd5e8273fb0bd755db40f865da210746de395c27ad2f5ea2e2a677665150dfb08ddb93dda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023616, "uuid": "2ff4afa2-ecfb-458c-9dbc-cd9738e8389b", "value": "T19FE5124C1517B3DEDC60373B8A6AAF22D6F40C16A562446D3AE0BE77D6B2F82053D253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023616, "uuid": "2c3b679a-83e0-4215-b53b-adc711a1bed2", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023616, "uuid": "b19b5de8-77c3-4161-aaf7-516a4b45c712", "value": "49152:ZOPdv5nMrkSGYVgnUvGgDHrwf4DD01JBL1ENltnY/tjfyyV1nuTUXtMYqtWasy3:4Fv5npl4aQGwQ4MENk/JVbnu4XqYqtWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684023616, "uuid": "66c7ee03-aa48-4ceb-af93-1aefb48d834a", "value": 3132140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684023616, "uuid": "fb5389d0-7599-45fb-91eb-12f27ce82dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023616, "uuid": "70e46c9b-0a84-48c5-98f0-85f92b6ed91c", "value": "a17af46e9c7bba005d9907ad2b722560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38677eb7-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "6fff26bf-9fed-4f5d-b92a-eb652c7f3bd1", "comment": "Malware payload", "value": "b368b38fdc9574fb8f00da4239ff1b88", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "4aee01fa-b3ca-4980-b341-5ec56cbdfef1", "comment": "Malware payload", "value": "7d52e43adb16b26a0d4cd077d5f5934d430bfaa32d198154e0b5c514be16e238", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "894a6bff-2aa4-4949-a386-820582cb2c08", "comment": "Malware payload", "value": "9174cdea8e48d0e223dfc631587c956e24ce09ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089809, "uuid": "65f25e80-3502-4cf7-a81f-e5c3492b2819", "comment": "Malware payload", "value": "8c6c999c04ee531a1f9a6255e11b5ad571f1655962941751fbd544d9aa30c6b4a1dbec1540f4ec66ce04480a648bc6f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "48f00b42-4be1-4bcc-a09a-c6ce21b9a481", "value": "T196F2199BE81020F5DDE201F121957B42FBBA94344503AB5E8E44A7BB9C71DA3FA7C14E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "29010e98-e394-4770-94f5-e9d91ffc985f", "value": "7c2e0427dc9884c5748d925abcb8ce88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "500f332a-ee66-4833-8baf-2807cd8a1a11", "value": "384:imtBHURa5S+o+3hkzpoMe/GCDlO1FZsAwBZkh2QddSG15VjN/6Tu99:5B3kGd/NY1Xs9BZkhHzBR/6C99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089809, "uuid": "7f492c00-3c82-4358-90de-985f19e29a1a", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089809, "uuid": "029f8aaf-ba6b-45bf-b3c5-fb053ce9be9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089809, "uuid": "c357c2b1-f2c4-406e-9f33-a23fcc147115", "value": "Wisdom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436886c2-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089828, "uuid": "49dd04cc-9adc-44e1-80f6-253b617fefa5", "comment": "Malware payload", "value": "677b6481f8fe02de33603553b9ee1b2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089828, "uuid": "5166f742-4949-499f-b6a7-00c09240aa5a", "comment": "Malware payload", "value": "7daeead9495651433e9a5aa4c9fb74bdc741624c57898a0cda3c74447176955b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089828, "uuid": "54a8e0f8-263d-400c-89a3-4168e3c5d11c", "comment": "Malware payload", "value": "1d856b877ff18d5f2777a53421c1084c39dbfd6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089828, "uuid": "e404ca84-b39f-4e74-8771-a27f011de665", "comment": "Malware payload", "value": "5c950d8eb9d707af0cc5584feddb53df5936567d8ca308b87e14a98845bae26b097f2effc161002be228c9b1e6a7bc25", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089828, "uuid": "01cc594c-db5e-4625-ab2c-7f4ef14dcfde", "value": "T12404225083A528674B5B7F7BAB1820B1AEBA0EB4D3D4558FF4EB728471DFA4DE8D0110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089828, "uuid": "f8cdfa4c-2592-4319-8e42-3ba5726d78af", "value": "3072:IcRjXS0ZkD3FtfRRuTXj3fpby2JKfvf25w206IzIXyl56ExfomXDHiZBtm:vXtkD3FPwTzPpe2JKnf25w2CzIXyl568", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089828, "uuid": "106b9817-00a5-4811-ba02-9689fed3d271", "value": 173636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089828, "uuid": "826f1a2a-4c5c-4e95-8b26-31d8b6131ff9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089828, "uuid": "c49744a7-d1a2-49ff-ac73-44f6e044be74", "value": "Ynsbnz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f290b86-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089767, "uuid": "3e4e5fd9-415e-45c2-bbf6-351dd23eb8aa", "comment": "Malware payload", "value": "7e959b965c38ccf73416218e2272e098", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089767, "uuid": "475faa92-1b1e-4bc6-92bc-c155a573d06d", "comment": "Malware payload", "value": "7dd7670685a7856ea0675983e14e0e103cb8f189aa0e87dfd1ea984e11c9015f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089767, "uuid": "48afa806-ce69-4dd3-bc03-226401bbb226", "comment": "Malware payload", "value": "c6ca655662ba9be4f765c28db5d2e1b384260e58", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089767, "uuid": "5dc17c50-9599-4494-9fb5-91b4615002ff", "comment": "Malware payload", "value": "807eba5bfb936fc024726ce1584c938191eabda039547c060dc78b8aac4a2310b422a8ab6517f8fb3957e7a5fd8a1898", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089767, "uuid": "5fc9570a-785b-4825-8a53-c5c0601ce6e9", "value": "T10BE633F0724409D2DDE6A13E686E844B4576FC0623A4E98F43B5DA398F633265C7BF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089767, "uuid": "e8f5bf74-037b-4245-84aa-dd64c2293061", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089767, "uuid": "55ddef40-527f-4886-b8df-6b42fd4f2180", "value": "196608:/d/lOqPnih8FXj+hYeB0sKYu/PaQgKDnO8NpHzgsAGKaRZtG77CTRzbtqlKMYm0F:mqPnLFCjQpDOETgsv/GvkT6Ko0TEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089767, "uuid": "36a7ec2b-19ab-4ce4-b33b-0e4a1431372b", "value": 14582274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089767, "uuid": "38be74f5-33f7-4a4c-aa3b-c701a7cfed0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089767, "uuid": "6c1b1c02-41ce-4231-a857-27f281d005fa", "value": "VespyGrabber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43b004e-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684050906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050906, "uuid": "0ced740a-ec23-4558-8fff-101a90d8832b", "comment": "Malware payload", "value": "24b9ef9c1375b5d083bf28810ae4bee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050906, "uuid": "21c9412b-5d8c-411d-9025-a1616244570b", "comment": "Malware payload", "value": "7e18c5b0627fc49d38f4c1efd6e16fdde3d874284c7409265f3f88de8a08c25a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050906, "uuid": "37dc829e-0bb6-4048-a5fc-353dca7bfa25", "comment": "Malware payload", "value": "586ea9a83ce87d82c6fe3ffebaa7f0310c905fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050906, "uuid": "8a2ff274-2b7c-46e4-b27d-a46ef899c3f3", "comment": "Malware payload", "value": "131d326d09f47f9b9e903f06bc084c76af7f602285299dd3960291e8e83ad3aab631a349c3cedc0cbf084fb778aa8411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050906, "uuid": "6b1b0cc9-52d6-4692-8799-7bccb02a18c4", "value": "T155940222A6EC8433DCB9577058F602932B31FC909EF9C36B1B91A99E1C72690D875377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050906, "uuid": "b8bd2dd4-a58d-47bb-81df-2fe0faed9838", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050906, "uuid": "9e8494ef-90df-4baf-90c9-00270af9417c", "value": "6144:MhEN7+bp0yN90QEbsSX74roeRVxjAsAPUfc0NOB0ai8bKIE/03xzwOXmZwwe:MG7ny9057aoet0sA8fc0AB0atKIthfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684050906, "uuid": "807cc78d-bfe3-42a9-a4a8-76796cb43c40", "value": 436055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684050906, "uuid": "52790baf-b27e-48a2-9bf5-7911f36fdfec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050906, "uuid": "b81b892d-6aad-4aa0-82a5-82092dfb4232", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b11743-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684058269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058269, "uuid": "e0917edd-1f84-4ee3-bc9a-76c45e5adf3d", "comment": "Malware payload (Loki)", "value": "61a108015c7a46d11cf254de084e858f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058269, "uuid": "2b4f410d-7d95-4c8c-ae8c-337677d84cd7", "comment": "Malware payload (Loki)", "value": "7eeb4156442e8884037740372916553b81833cb3b066aaa39de13658b0c6b68a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058269, "uuid": "551b1131-d9ed-4174-8ede-b52d21af480b", "comment": "Malware payload (Loki)", "value": "61522db31154d747880018c81e268275af2ac290", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058269, "uuid": "654d902a-7dee-4bf0-b9bb-08520f00cf1f", "comment": "Malware payload (Loki)", "value": "e32d3a65c882bcb31d966db511526b2688cb0bd33ba01206bb6729af6d56dae23bf849f5f7add6915d641988c5ae8ae6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058269, "uuid": "20314c0e-e2b3-4942-99bc-9c9133a2f0a3", "value": "T190A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058269, "uuid": "d2f4972a-191c-49ce-8009-4900143659d4", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058269, "uuid": "43a480a1-ef1f-4ab2-b6e3-5e9d3b274e5e", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058269, "uuid": "27d40401-94e4-42d0-97c6-727b737c2c01", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058269, "uuid": "2932022f-df67-4373-97b2-54ff521f715a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058269, "uuid": "e35f80de-6158-4392-a0ad-b746c1f2f3af", "value": "7eeb4156442e8884037740372916553b81833cb3b066aaa39de13658b0c6b68a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253dbf20-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "7159d05b-d74a-4161-ad4f-511ba58a6613", "comment": "Malware payload", "value": "21eab81729333b160786a2de1b1e621d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "9f9c2da0-3573-4b90-b569-bc9bf0e65f18", "comment": "Malware payload", "value": "7f7692d93b4fc5f673d17ec6a603c222a5f7bdd08dac58b8804ec3393399a345", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "64dbdaaa-2aa6-4c4b-878d-edff6493ca31", "comment": "Malware payload", "value": "983942fb34c4bf8ac0bcd3bd69624e9a5eaf01b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "e6817d79-4182-42d6-b243-af1c0ec38b80", "comment": "Malware payload", "value": "d3b881f5d5b4523b8ea2fc1bc1fa1e272d8dac9a5a12e45ef96605bed3a8a1912fe2979bdfe21c19818af7ce97c260f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "55648096-2c55-4c64-ae20-6aa251a5ca8e", "value": "T11A545A0C6013B3AECC61773B8E3AAF11CAF45D659566816E39C0BE37E6B5F82053D642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "a9e1e89d-171a-417d-8d15-b65eceabc5ea", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "a95c03d7-e514-45d3-94c8-08dbb9b5d054", "value": "3072:PomnzVincQDKgc8APsc6dpp3LhYDwONaQxqQ+bu8UH33CmL8vXL2zdAQCI4hTwlX:PtZlz6dpdLXUJkQ8vXCZgbhT2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089348, "uuid": "7a85f7da-2146-4e28-b856-675db29d2f7e", "value": 299733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089348, "uuid": "374a99ca-dec3-4eb5-abc3-6d74fa069217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "4c4037f1-5126-4341-b339-52d9e00374ee", "value": "21eab81729333b160786a2de1b1e621d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2e0562-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089685, "uuid": "407f5503-aeb7-4d7e-9c58-124a6cd82bcc", "comment": "Malware payload", "value": "bb8cafdd13a9d6d162b9abcd6d89e56c", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089685, "uuid": "5f86e076-6aaf-464b-8138-49a32d6dd9c8", "comment": "Malware payload", "value": "8059600b1e542b12832d080cf0b4b0a73738369d1be981604471e67d1c78aaaa", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089685, "uuid": "70cc3d26-466d-496b-af02-6c4b09348f5d", "comment": "Malware payload", "value": "1510deeda60d7f90c773b0e2ccc926a456ee01bf", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089685, "uuid": "b74e130b-f901-4280-9088-f4e75a35f3c6", "comment": "Malware payload", "value": "939099e4effc266373c07bf7aa5a9120468a5e8e4fc8a9289d6c68023f611277b6ea1c18f48cf84bcdfd94e24cd0151e", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089685, "uuid": "4939dab7-cac3-4ae2-8d00-53b26577fcb5", "value": "T1929533D3D22EFCBFC69AF87247239441B4364170624DEAB91A11D06B1DE7F498E19F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089685, "uuid": "56a99d8b-1f04-43fa-a997-d57f50739bcd", "value": "49152:kIXTMacj+ZXxAXJSyxzCCChDqZT8oomjhzjA8HXGH:PPcj+ZXxALxvChDqFjhzM2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089685, "uuid": "b290abab-c9b5-4f00-9c68-8ac1bc881d99", "value": 1876262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089685, "uuid": "750773a7-69ed-4059-acb9-9aaf5221964c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089685, "uuid": "890956eb-5332-441e-96f2-be8bda110f58", "value": "SmsWorker.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601bee42-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032323, "uuid": "604ddf3b-5784-44df-90ab-8cfdbd74c808", "comment": "Malware payload (Mirai)", "value": "da92f6710490cc3ec4dbb563662eed4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032323, "uuid": "06cec1b4-50df-4b5e-9a8e-8d62bbd2f9e7", "comment": "Malware payload (Mirai)", "value": "8105409cf71f6ebe339fdd144bcdfc5d1db11016bbb1841b7a322118d92b36b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032323, "uuid": "d6d7791c-ce1a-4d36-9f33-4f2e3c383d9c", "comment": "Malware payload (Mirai)", "value": "81cf4b05d0f6d694194f6538733234588159a23f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032323, "uuid": "9d1a0110-4c4c-4d74-8ba6-621d1c153b3e", "comment": "Malware payload (Mirai)", "value": "e822e0123d2eabcdb20bfd2143f75da5b0537d26ae8786be62a340eb4adbbd0d028d93485aa6dc5d4c2a27f859389f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032323, "uuid": "1c5b5916-5b6c-4f3c-bb98-f427410dbed8", "value": "T169B2D0CD61943088CA8D7C7C278D4A665F6CA1D0BAEDDB16E350CD98B3BEA4B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032323, "uuid": "0113b2c9-6e44-44b1-a929-0c1a78593e29", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpsZqSWv5:4QlS07FUXqIYSXQKquUqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032323, "uuid": "952e1094-6ca5-4769-b605-1e7c1c468264", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032323, "uuid": "428022f5-24ae-4e77-ab5d-32bad20ac5ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032323, "uuid": "fb0ce743-9d4f-4bde-8103-ce1a0ea8ad0a", "value": "da92f6710490cc3ec4dbb563662eed4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1b8690-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103425, "uuid": "a76c15ef-ed82-4683-95ed-98d1261bb1d8", "comment": "Malware payload", "value": "07946e8914068af4092480d897c8a41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103425, "uuid": "075d31ee-4c1f-4573-803e-8f230196fb95", "comment": "Malware payload", "value": "81d36132fb520611600822d1b86fe842030f72e3a36675ccacb0e0ff143c5071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103425, "uuid": "e866fa2b-3965-4cc3-a8dd-bd209838556a", "comment": "Malware payload", "value": "ebf4f2f9a3cacc7fb611ad21f8e7d0a29725f3d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103425, "uuid": "f322ae5d-f154-41db-be8a-496ecbc509af", "comment": "Malware payload", "value": "a0011b844ef8dc36cc291d86f39d0b67b21321e5a08f09332d3470322a58065519d06dabcbb4c7d31d4156c47c16d2e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103425, "uuid": "4b58fc35-e2eb-4ea0-8ff0-e68f6646ecb2", "value": "T180D469D1E384D58DD51B02B7CC3AD9716417AEAA8974861E242E3D2B76F7383206BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103425, "uuid": "9ad7ec8c-5719-4fd0-b856-537097633425", "value": "d8a41e8c9a81d04ec24d53eeda94a55c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103425, "uuid": "bfbc51f2-7ac7-4c46-8377-e3faf28d8c52", "value": "6144:noyoMGGGGGGGGGGbGGGGGGGGGG6GG/DGXxeXJE85PmWyVcjUkdHbIIAgroMGGGGe:5KHjlFjKHjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103425, "uuid": "e534210a-9c58-47da-9a5c-fa5cf0184237", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103425, "uuid": "bb51c01d-36f6-4cb8-ba6b-497b01eb60e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103425, "uuid": "516feac9-ad9c-4e8f-bbaa-30d23a263bac", "value": "SecuriteInfo.com.Variant.Tedy.359684.30038.23384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c054d7-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089721, "uuid": "c817500d-31c5-4a31-8424-3f5392b174f7", "comment": "Malware payload", "value": "0b3e688992d8ff529387abcca7f31dc8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089721, "uuid": "0a3523ff-7a3d-4389-8c0e-c920e225d9a4", "comment": "Malware payload", "value": "828f196ae077731a1c9b635e19d653dc2f9a62432ca33feb695837989d079d7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089721, "uuid": "2d4742e0-5b52-4f0a-a3bd-c5d285c82204", "comment": "Malware payload", "value": "ac95628e2157b31c7560513a28c5df31cdb262ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089721, "uuid": "2c6e4c18-30a4-4ce7-8807-512de3fc2f58", "comment": "Malware payload", "value": "caaa5bd0af88450afbc7fb274a7d0d1a28e6a6f25f374641d0c55d881b11020e3df3e5ea09ad872ee55f9e1d06b6e555", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089721, "uuid": "861adb6e-22ee-42ea-8122-8ce5ef37dd89", "value": "T1DA9412BA93C29087C4C535F8360F1F4A5760FD47DE261B57614CA7BE6C2AB278AD0B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089721, "uuid": "8af1e4f9-7c82-4c7d-864f-5218a78a8437", "value": "c1b3e25907b370e02285383a3edbc75e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089721, "uuid": "a8d84f9e-4e63-4297-959c-4ba46bc6374d", "value": "12288:kDlSxfXu36j8K2Wv/OcmagFiKlPtVb+HyT36yk1aY:kDuPDRe7uyT36y4aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089721, "uuid": "4f8e5f41-5415-4720-b28b-985e97da54f1", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089721, "uuid": "3bbf7ad9-9bfc-4ee0-8d8d-c66e09b41989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089721, "uuid": "c852f7ed-da03-4b6f-962f-3593fef3fe36", "value": "TEMP.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ae2712-f272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684080787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080787, "uuid": "1c8c9641-b627-4909-8135-74cb0dbc926b", "comment": "Malware payload (Smoke Loader)", "value": "649b09f7e035a83252f29125004f2e5a", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080787, "uuid": "194f1fe6-6b8d-4f13-9668-d0555cac3335", "comment": "Malware payload (Smoke Loader)", "value": "82bd6cdc73d4224d3c9fdc69321929eb5dd3b1d98a3107253f12db0cfa838ebc", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080787, "uuid": "1948a6ec-cff4-4295-986f-86970ac5cc09", "comment": "Malware payload (Smoke Loader)", "value": "326a871b8497cc1907349f2bd5ee900a194e3301", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080787, "uuid": "e34cc3f1-a61e-4013-8fff-e6270d3d6ffc", "comment": "Malware payload (Smoke Loader)", "value": "1c01e30e9a3d1c2e58e6eb2e9eccd7d29ca943e78790f5bba7647ed274825a9aa65c90bce1dae8a7256ed5f76bf7f990", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080787, "uuid": "bfe52c4d-3319-4b2f-a5d9-2deb6e6fc87c", "value": "T12B547D0356E17C55E9274A73BE2EC6E836AEF1608F5967AB12289E2F09701F1C573313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080787, "uuid": "375952ca-d283-423d-b7d3-74cd215775d6", "value": "ee2cc8de8216a98a04e64dc8ea701849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080787, "uuid": "45b00e27-2537-4d64-990a-46d08f99f621", "value": "3072:vpXwnijs/LhQDXn4mvynd58U86EhG7BfVdORZ3hA4FhM5MvwKU6rr:FrjqLhQrn4mva3FaC4dv7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684080787, "uuid": "db219ed7-3697-432d-8678-56c0eb1ae241", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684080787, "uuid": "b22af83d-c786-462d-86ad-e749099c6ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080787, "uuid": "04bf4b15-6bd2-49ea-ae0e-0c8245197830", "value": "Ninja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9933acb5-f263-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684074510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074510, "uuid": "d07d4d09-c38d-4070-ac66-0627316cafef", "comment": "Malware payload (Mirai)", "value": "038701622ab1bfbbaf55f4f1d8d3eac8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074510, "uuid": "ede3ccc9-93cb-4090-bd12-663639abb715", "comment": "Malware payload (Mirai)", "value": "834fb040ede09d1cd7354ad0e923e4d5085d6f8d4383a5328e9c7604f24bae0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074510, "uuid": "1207944f-b2ae-45a6-a3e0-3f0f9dcb73ed", "comment": "Malware payload (Mirai)", "value": "ff8ff82483b508d37dc7b958b9e18b684ba33beb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074510, "uuid": "a852c98d-71f1-46f1-8da6-bc0a697f741e", "comment": "Malware payload (Mirai)", "value": "345f4ab2e6ab59f31fbf5fb8191d20592a0be8bd5cf724b4719d1368777a65455fe8946454da22fd4955f487ba07bb68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074510, "uuid": "26ef0a57-d32d-4c61-9a13-f89b31396b3d", "value": "T1B123026E151692B9CEDDC87F906C57B085730AA3B393CC09FAE2C517EF810B56AA3C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074510, "uuid": "d0f34967-e0e6-413b-bfcc-ccaaf5e9644b", "value": "768:JtHD5sM5xlS8QMB/AnAzGjyCkY148LND59ncvi1ffPfTzqAlA47MeSHJgGlzDpUC:JZDz5G8PB/AnAyR1zZD5/1/f3dlA4oeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684074510, "uuid": "9b6939d6-882b-4cb1-b7c6-26bcbdd6c312", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684074510, "uuid": "f6c1103e-636c-4b8c-9f78-06fb525504d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074510, "uuid": "fca3d5c3-e5ee-46ab-a725-18d6cca33482", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.UKX.17949.28583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760a7147-f25b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684071015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684071015, "uuid": "378da2bd-ca3c-44d0-85e6-1f8567a2b814", "comment": "Malware payload (Amadey)", "value": "41af923fe45565ab1e28361fd1fe2fb6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684071015, "uuid": "59f5d7ee-6fe0-4599-b254-6f2bc0304ec2", "comment": "Malware payload (Amadey)", "value": "84abbb285cd9094cd2efa6605e9bc19b4ba1e89ecac06e26bcc351e60de98a14", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684071015, "uuid": "0de49761-e447-4c6c-9ea3-f2b56038b1d7", "comment": "Malware payload (Amadey)", "value": "7903843767a3caf548d36c8fa889683ad4c4e558", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684071015, "uuid": "620a5c7e-1ea9-4242-be77-0745124873ab", "comment": "Malware payload (Amadey)", "value": "0645778eebe785fd25271fca7fbc2c2b466b137a4b07c9a06eca79d0ff7937a983d360afae9ee6189f6c97b691f52751", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684071015, "uuid": "1db33b52-3d05-443c-9f6e-91f9d4cbe42b", "value": "T14845231665D850B2D8B52B702CFA03930B7A7EE289F6875F96B5AC4D0DB32C4D271327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684071015, "uuid": "c2c101af-20df-4fc1-a332-453541dd6bc7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684071015, "uuid": "24f261fa-2c3e-44e9-aa2b-41fb775ea018", "value": "24576:XymnCednXRqqyqS10NgWkJHrDzJJFJrNQGSUK9+Q4MCKV86mC:iwC6XRqqyqSWNgXJvz7Aw/Ke6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684071015, "uuid": "7f796e6d-680d-4052-b106-e327ec22ffe9", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684071015, "uuid": "94f46db8-1ffe-45f2-a174-7515453a0a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684071015, "uuid": "f7b5d8eb-15ee-44da-a223-e1c8ee9e23f5", "value": "41af923fe45565ab1e28361fd1fe2fb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3627a718-f273-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684081216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081216, "uuid": "e1e5a8aa-81e1-4789-87b1-ba33a6ca988c", "comment": "Malware payload (Amadey)", "value": "5015ae73dc9c2993964f37db8999462c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081216, "uuid": "9e36f348-5b54-4a77-a6be-1a21877ad752", "comment": "Malware payload (Amadey)", "value": "855c176b04168fc55c650a1d5caf9feb9dd9cf65050cf993d03c0a1396a3c31d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081216, "uuid": "9afd6e36-0182-4501-9788-246fa85c9057", "comment": "Malware payload (Amadey)", "value": "1193e8d20a420f1053b6fb3444958450c4e166d2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081216, "uuid": "efc2a71e-b37b-4d60-b986-768e4c939fad", "comment": "Malware payload (Amadey)", "value": "908604704881df51897e0172f0c4259bf3e9a819ba1e527f758e0b2da6500704d725ed98083f1485fdcbd8fdf012441b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081216, "uuid": "8ff19a13-cb31-4fb2-ac45-be1b824c5227", "value": "T139452342E6F4A472CCBA2B3104FA15930F307ED29D74879B718A99AD5C37688B97131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081216, "uuid": "9350db68-84fb-4603-b89f-5af4b01b40db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081216, "uuid": "97852f9e-f154-47a3-8302-2295c5ebdb77", "value": "24576:7yX7br9jIwaqjhfRYhS2Bq/GAd3pOqSsHRBL9ZEYbL:uX79jZj6S2Y/h3hF5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684081216, "uuid": "db247aa3-c98b-403e-90fc-87ca83c11935", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684081216, "uuid": "86778365-07f5-4162-90a3-8844795a32f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081216, "uuid": "c0476d42-2dbd-4aa1-af93-6825048a7255", "value": "5015ae73dc9c2993964f37db8999462c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc56b05-f247-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684062381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062381, "uuid": "4e62174d-f91f-4e13-80ad-6cf36a9070d6", "comment": "Malware payload", "value": "d2e289a6ba11dc1f65101c8341508326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062381, "uuid": "cefc7783-0b67-45ab-86d1-a60f79f99422", "comment": "Malware payload", "value": "85a1e5d57b3ba79e0051a0cc4c53067621384fb369ff4f54ebe3ec551d4f6e8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062381, "uuid": "52505058-9470-4358-b447-b73b9b8b8c50", "comment": "Malware payload", "value": "765bd40bb47891235fc2da30a51900b4d5a00d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062381, "uuid": "4e5c7e07-20ea-432f-9fd8-0f7a7d21d491", "comment": "Malware payload", "value": "a77061705ebdeca071a8380c7b6022472056dd616fda80a8a19c4ceb90f41881c8ff4065bdc482a23eb3849551551a1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684062381, "uuid": "d66cee11-f531-4e68-ac20-51dd916ac62c", "value": "T10313F2871673E978CADA78FB8379040A8CD0FA0B53481B1F895F22A685E75287D74463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684062381, "uuid": "c4b089fa-f7ba-44b5-85b3-1713506a157a", "value": "768:C9Lq0ajG2b1JQqPjhuw4sI56wkHbFoEOooir1oklDnsv9sPg8oPZNfap:C9e072bTjbhuw495zkHpoEOs1zlDsFud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684062381, "uuid": "5f069178-9813-4580-9b35-991ab9710b7f", "value": 43840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684062381, "uuid": "a4590516-7ba3-4bf4-a533-e137365a514e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684062381, "uuid": "43a25395-2c44-4354-bba5-531cb7823424", "value": "gummy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c974b34c-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058270, "uuid": "0a624764-e729-462b-86f8-f1927003fce3", "comment": "Malware payload (Formbook)", "value": "5a3710936773f4b176993d639c4a0a37", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058270, "uuid": "90186377-989f-449a-8209-7020919177d1", "comment": "Malware payload (Formbook)", "value": "8602354725dfaadb02287a5913b03d7582e8e9faf3752a08128f701237ad3200", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058270, "uuid": "63f1db74-ac2a-4ce7-bd8f-b023f71f8841", "comment": "Malware payload (Formbook)", "value": "d1372aa1986dcd769c67c36c53b2d21c546ecf50", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058270, "uuid": "bf6da7e1-3efa-4375-ba57-4878520abb48", "comment": "Malware payload (Formbook)", "value": "a19f965e468af3302291a650d912c434618b97c3a254cd952e68989f9098d04c9bcf3de3ddce97b104472f782641268f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058270, "uuid": "4ad5b345-5668-45d6-81de-f538ae7a515d", "value": "T130D4BD823774B561F4AE32BD050A57CECB78B0462016F12B1B673A9052E37BF765F1A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058270, "uuid": "ba7d542d-758c-46c3-8f2f-daae803d9542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058270, "uuid": "260f253b-897a-417c-97aa-1fdae66c682d", "value": "12288:1moA5TvnTLF8x46Y2jV5B1fPluwoF7Gh8LgUy+09m9EmrPvD6eidPCTC:1moSTvnTLyMG5BJ9ubGhTUc7mrmNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058270, "uuid": "8d585eb5-025f-442e-aac2-72e438fe1714", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058270, "uuid": "bf02ce30-49d8-4230-922a-ca6b9dd11681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058270, "uuid": "2b472a6d-25cf-4dd4-8c6c-a0549687d429", "value": "8602354725dfaadb02287a5913b03d7582e8e9faf3752a08128f701237ad3200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e463c920-f26b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684078072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078072, "uuid": "4d3f2984-bba9-4694-9e43-361d4fd11b18", "comment": "Malware payload (RedLineStealer)", "value": "dfefc6dc4e6bb25d5de4a0166dfda1f7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078072, "uuid": "659a88a6-3bc0-4e83-b210-ff0d272e663a", "comment": "Malware payload (RedLineStealer)", "value": "8657f1f938eea7226bc776eca6cd4bc03d12fefd12a1883bffcff6e6cc219453", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078072, "uuid": "2b1ce419-4d39-42ab-b65b-e319342f655d", "comment": "Malware payload (RedLineStealer)", "value": "5bc5780f8aab62aaba1963b8691b1b2b87d9d44d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078072, "uuid": "8022f172-e7bb-4694-92a3-4ee4ad244779", "comment": "Malware payload (RedLineStealer)", "value": "c8c2285abef56323fc85e3361ec8c0ea80383686c2bd493fa43314c952b3a5ca75455c14fd3641ebd2a4b4df317aee5c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078072, "uuid": "2fe05180-2461-4600-9c36-c0b858d87302", "value": "T145452343A6E84026D4F21B354DF302972B39FCD1A9A983AA27D9249D1C736D4E53237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078072, "uuid": "50d4c388-2d06-4dcc-988a-e5cd29f4a40f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078072, "uuid": "242367ab-f18b-403a-b64a-85754cff1340", "value": "24576:KyzKYNe3s2jS0RVWnhE2eHMDJNwdaWOjyYj7JIAMsYf:Rz90ckSVhE2eHaNtJeK7+ANY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684078072, "uuid": "b290f3e3-6379-4dad-b079-f8e08b8f82b9", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684078072, "uuid": "629b0635-dfe8-4ff2-ae49-dfe752089de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078072, "uuid": "632524e2-6833-4159-aa98-5933ee9afaa1", "value": "8657f1f938eea7226bc776eca6cd4bc03d12fefd12a1883bffcff6e6cc219453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1c63a7-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058271, "uuid": "09e9ee24-9b28-4ee2-a20e-e2bca77e0f0c", "comment": "Malware payload (AgentTesla)", "value": "a27033a4d5e25bf5a4844f18d8d1bd38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058271, "uuid": "e3d37ee6-945d-4268-9178-081c5fe6955d", "comment": "Malware payload (AgentTesla)", "value": "86d4a06ce584c3d67c982690c85a60d789d48293ef122c81c7ea4e19ab7c912d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058271, "uuid": "76260c8e-93a7-40f8-a482-00fcc3f14b5d", "comment": "Malware payload (AgentTesla)", "value": "62eea27661ed94a48b8142fe87d049b03b9f1295", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058271, "uuid": "a0020c65-687e-4230-84e0-1a06ebe1dfd6", "comment": "Malware payload (AgentTesla)", "value": "c7353c084b0e2fe0cef745b891e418b2cfa781d93e6869a73933476d40b58d1abd33be8333c4a7c93f91f9b9e0333d06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058271, "uuid": "ad01d9e3-edaf-41fe-8fbc-bd58315bc71b", "value": "T10005383C19BD263BC1B9D7A6CFE4C467B114A8AF3121ED65A8D747A60346E1235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058271, "uuid": "b7dc5764-0b16-4202-9624-f585a9855944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058271, "uuid": "96b4b2ba-2745-47a7-9690-47edc8b33710", "value": "12288:LZ/9WflU/9DWlN/OyRj+uIeAeDNnqWWaF7luSDCA11WHNdLk2W3:tylURUNmy9LDplqA7luhEw7gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058271, "uuid": "9724e8ed-5cd2-4829-9ed8-d89894e79a26", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058271, "uuid": "ea978289-64a4-4d53-b742-f359b200f589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058271, "uuid": "68f5d0f4-b6a3-4053-b873-51e339092250", "value": "86d4a06ce584c3d67c982690c85a60d789d48293ef122c81c7ea4e19ab7c912d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6cff44-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684051052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051052, "uuid": "7cf86497-49fd-4a3a-b3db-eb8cc4eb0c8f", "comment": "Malware payload (SnakeKeylogger)", "value": "fd67230071bb2c1c1526139ccfc27ef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051052, "uuid": "7a41aec7-112d-4a8b-a7ef-474d5c55ed03", "comment": "Malware payload (SnakeKeylogger)", "value": "8760dd4d037c34998c16fea312946f0d6d05c2d3b25c1acd6dec12d00e376acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051052, "uuid": "064b3cbb-df95-4b9a-b979-a1650f12a23f", "comment": "Malware payload (SnakeKeylogger)", "value": "b26a0e633f976da66affb35ad59e9c5730e1987b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051052, "uuid": "8e8509e6-a88f-498f-967c-d92f3f5f2266", "comment": "Malware payload (SnakeKeylogger)", "value": "96d37e4339783ca4dbae8d32ffca8ea3610266bc4630835196b2c4aa9b3dcbb4d98f854762a3efb5ef1f5a973d045468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051052, "uuid": "f02b3ebc-e5f6-420a-9b9d-06a22d7949d7", "value": "T10ED49D44AA16A677E1AE3FF520425904132C6C667260E12D6DF335D992B6F33CFCA60F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051052, "uuid": "b39436db-fc22-4d8e-88ce-1bccd82c18fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051052, "uuid": "8071da2e-044d-469a-8a09-5319ef87fba4", "value": "12288:smjvv1Gm9nDGtz9dnlwlzozmc2rBsPsArsdJ:xvn2z9dapozmJNz4QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684051052, "uuid": "782306bf-3d82-4484-ba54-c3b719cde953", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684051052, "uuid": "671b5046-eb00-4884-a828-0c22d2013c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051052, "uuid": "cf14acf8-3ca9-45a0-8df7-e6edf4090dbf", "value": "PO RBPEN2305-001.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3da16f5-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089184, "uuid": "730ade77-e0ae-4558-8a35-2c9309b00d62", "comment": "Malware payload", "value": "69a0684a269350b33d7501a5641d5416", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089184, "uuid": "98eac413-4ad3-4fdb-8c26-ef5288ae0882", "comment": "Malware payload", "value": "890ff32b78429f6fde4c95834973a1437940ac1d9c452c90de4d37d7282b5a17", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089184, "uuid": "82fabdef-dba4-4fa1-bf3b-657026ba6eb1", "comment": "Malware payload", "value": "012bac6c1b85f4b17bf16ec30afa769c0a7d3889", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089184, "uuid": "df6b7924-fa5d-4c63-92a2-90ca64644605", "comment": "Malware payload", "value": "d346d06a24642cd0942041d3fe162e01a4187456cf5e68763d5cc021855eae19de244974b74ed25cd2b7a8b086cd3f35", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089184, "uuid": "5256231f-ab02-4c69-b107-08aa7f792511", "value": "T101A4084AF6B550E0E0B7C134C5A3623AF971785A473497CB4794DA5E1F22BE0AE3EB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089184, "uuid": "eb5ec729-b8ec-4bd6-b2be-703c1cc51f31", "value": "c8c95a9c030cb1f0460c35cb1d796146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089184, "uuid": "9cb66d61-3752-45d6-853b-0b05997dcf17", "value": "6144:xb/cy3gO1VQKVvsTa6Rh5fn/wAT61LVAC6W4DTmgnOY:v3gO1ZV+hRgF/4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089184, "uuid": "c6ad439a-1685-4b79-9e0e-a0eda7f4b778", "value": 471120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089184, "uuid": "8e18494b-1a6e-48bd-95bc-f5ae63962a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089184, "uuid": "30153ad4-e8e0-4ecd-9741-e96a8eec7d75", "value": "Copy190153.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d05269-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089587, "uuid": "2bfacd4c-9e87-4ffc-8c5a-891b6cdf15d2", "comment": "Malware payload", "value": "6ff05c2da10ac28e7f7f0e8150ef0e27", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089587, "uuid": "df7892f5-dbdb-4dac-bb00-97d39ecc1aa8", "comment": "Malware payload", "value": "8963d85645646e0f4a0a3e6518cd136b78f0795499ae98c04546be7a6ecb259c", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089587, "uuid": "14c4040f-9b70-455f-8fe1-3fc761198a8a", "comment": "Malware payload", "value": "b4adfc5843258a88127a8f932525c9e5b1547c10", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089587, "uuid": "99846050-a3af-4dea-83fd-07b8cdacbe29", "comment": "Malware payload", "value": "92bd0772068191ec361e2023469c5266158ec681e6207d431989d1617e8bc6fef77b7162119c961aa4f7f7d8cbbd00df", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089587, "uuid": "79b88c19-faee-4d2a-b333-8eb35d259abc", "value": "T1ED2423172BF4B9D7D4BE657A0D9161B0B1FF0C92E566466D17C2190E082FC8643A3EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089587, "uuid": "4be59c1b-c6b2-42d4-95b0-f6ccf9ac05f2", "value": "3072:6FiJH7AsACOtGWDBABaqbvtnbWNayMyaCoaBSCRFaH3QF10/NHO9BkErjSfeCcgd:uIbSjuBjvta1mgn0dMrjZ09wjqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089587, "uuid": "db7cd91a-7132-4e95-95db-d6eb3f4f46de", "value": 217591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089587, "uuid": "a666d825-34d3-43e4-ab36-5d6c3a892722", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089587, "uuid": "b061bae9-2f13-4cc5-bca4-031d3204c920", "value": "FakeCMCC.A.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63089047-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089022, "uuid": "a0a3b901-3289-48fd-bd3f-bb958aeff55d", "comment": "Malware payload", "value": "0bbff943175749fab383b7d448c776af", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089022, "uuid": "c6db974f-5238-48f6-acd8-c6f30537f612", "comment": "Malware payload", "value": "897ed62100039dfacac32b756bd7e0fbdb101cd5147843dc1cdc0aea23225834", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089022, "uuid": "e718a8be-0505-4d4b-acd7-a745bec5f3cb", "comment": "Malware payload", "value": "9084e8728b3f7c3608ca4aee6a8d0275244b5252", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089022, "uuid": "283d586e-f428-4a07-bc45-5f630687f97e", "comment": "Malware payload", "value": "77a8c6854ce2c6b2a1f38492795d5f08ada1b64592ea752c6868b983c96a9a0cb180889f6266d2ed0f1417bc55128ad0", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089022, "uuid": "8ef805f5-9f74-4f84-ac95-7b474e0c1fee", "value": "T13D049D13F2664309D1F6D77489F30291A171BE70AB21C60B2E5B7FAD56773B09A183CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089022, "uuid": "904f6aed-26e9-4e51-a841-ee3b0e571d03", "value": "3072:pwvRaI2xpj78vRaI2xpj79vRaI2xpj7ivRaI2xpj7DvRaI2xpj7kHlu1562DK+Uu:pwvR9+BYvR9+BpvR9+B+vR9+BHvR9+BN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089022, "uuid": "0838beb8-8725-4033-bbdc-7672a37045c9", "value": 183460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089022, "uuid": "800040d6-dc7b-453c-860b-7a1b02cd062c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089022, "uuid": "bf62ad62-3918-4c6a-b168-60fb21dad430", "value": "BackstabHDSonyEricssonXperiaPlay115Crackedtag3r.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65052eb1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089025, "uuid": "0efa0bc2-e3c2-4e9f-aefd-4eb4dac599d8", "comment": "Malware payload", "value": "98cfa989d78eb85b86c497ae5ce8ca19", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089025, "uuid": "c0a85da3-cf73-4ab4-b854-44ad0e7500d8", "comment": "Malware payload", "value": "89a8c758f45d86bf0aee1496fd48036fad55805927327d89af6ec1d7337a3938", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089025, "uuid": "7a057589-4690-40e0-b73c-abad2f1e0423", "comment": "Malware payload", "value": "8d0cc1dab447130ab99528be89681f2f35d0294e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089025, "uuid": "da14fe8c-5b9b-4a55-97e3-5be8cb6dddcc", "comment": "Malware payload", "value": "5d96c99ea85449b1088cb481a254d50dec93896739893bc5edc927e61df4221c13e4580cbe3396cec3c4934fba53dd7c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089025, "uuid": "773c200f-e344-4804-a169-25736337795a", "value": "T15BF533A9E0E7C2B4DD53E6686E267C0DAEC8B1FA507153F60549D83D423CBD56A03F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089025, "uuid": "4c66d891-e3fb-4ba9-9eb7-4a1beab37c51", "value": "98304:PEg+qFeur0Pa6MO77fMmEOUQWa5Nw3+br:sg+qYuIeUfSanus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089025, "uuid": "6475995f-c1b5-4817-a3f6-72914a7e4264", "value": 3354613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089025, "uuid": "4777399a-2a79-43e3-9ddd-564753ea0f00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089025, "uuid": "e1ffb845-f4a0-41e5-b028-f679b56e1870", "value": "BadNews.A.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad3a830-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058272, "uuid": "7db200a8-1bb7-479f-abc4-ecfa847832cb", "comment": "Malware payload (Formbook)", "value": "030cb5edfbd4624b6af28df66a6bc68b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058272, "uuid": "603b4d89-d518-428f-9dd8-ac78fa9021a1", "comment": "Malware payload (Formbook)", "value": "8a14ae6c1c7af7a36cd83c1dfb1953ee2a3178cf8ed4fe452cad593e0aad71cd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058272, "uuid": "7d36cd7c-cc01-4840-ac22-b7572b9cfa5e", "comment": "Malware payload (Formbook)", "value": "bec0f14fe8b99b6494f197a47e4fadecdc1e5458", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058272, "uuid": "c1f6f04f-5ef3-4fdf-baf9-7800655785e6", "comment": "Malware payload (Formbook)", "value": "19c6bb94bbc3262b45aa5fe042669165766a0ea5295e276d2b8f2aafd4224347ae7e6cd8d6b384b6abee780f4991e844", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058272, "uuid": "5f3e63b6-5fa4-4e27-9bc1-c7e2015eb707", "value": "T190D412167F592768C57D07F3D823150583B1996AB0E2F3DA6DC028FA8E73BA44961CE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058272, "uuid": "768f0142-1bf9-4d14-8bc0-fcf84e7df211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058272, "uuid": "c7562247-d041-43b3-923b-85c4b92b9a92", "value": "12288:ZpwjgDeHh/RNQT11mU5PbVd3zvI/bC4MqTbwfgXICxG:z/qxRKR1d5PbV5jmJMqwfgXIkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058272, "uuid": "49e3e616-d8c6-4d25-95e9-67da95ccc176", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058272, "uuid": "024344ef-49e2-44cc-b1eb-6a16a9fd1272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058272, "uuid": "adf44398-56ed-4679-b021-d3f91a18dbd0", "value": "8a14ae6c1c7af7a36cd83c1dfb1953ee2a3178cf8ed4fe452cad593e0aad71cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2ad1c7-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032691, "uuid": "843d0af1-45a1-4550-83ab-5d6d93bb3f26", "comment": "Malware payload (Mirai)", "value": "286ce4a81cbe02bb93d9d8e86d322849", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032691, "uuid": "d053649c-40ac-487a-a91e-490daa9dfab2", "comment": "Malware payload (Mirai)", "value": "8a527e6863ed70effec6ca2305370e89a4c459b4149a331ea726539641772154", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032691, "uuid": "830f0698-fb0a-4d4f-b3c0-b56a3695969e", "comment": "Malware payload (Mirai)", "value": "21789d49b655155d6e017c2c241f2dff4e8552c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032691, "uuid": "d590157b-2a75-417c-b30e-a4b94235b856", "comment": "Malware payload (Mirai)", "value": "45f5aef93901c8583072195f21e488d57b3d3540d0c8c178550b29b1c130abbb64d17aaa7875eaa329bd96bfed0885e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032691, "uuid": "e2478423-2abc-4aaa-84a6-933616b149f0", "value": "T1CF33F7C5F58B86F2C5174830509BF93FCA32CAB911B0D6AEEF999E31DE37642510264E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032691, "uuid": "d60792d4-b95d-4c13-8679-819153259fda", "value": "1536:/1IK9j5QxnT9YRdI5XL+j+9gQGtsaROkU:/6KV+xnT9YQijXQGeaRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032691, "uuid": "4d13d424-20da-4174-970f-21a6ae50044c", "value": 54672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032691, "uuid": "9feb51f7-2bb0-4942-af66-8fb7e38811bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032691, "uuid": "b833f20a-032e-4248-8de7-254bd5a15d82", "value": "286ce4a81cbe02bb93d9d8e86d322849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36a8269-f26f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684079681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079681, "uuid": "ce84438e-0dfc-4a4e-b232-6b54b5770fe4", "comment": "Malware payload (RedLineStealer)", "value": "b73337250d66ecf2716397d710b7cf15", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079681, "uuid": "b665647c-604c-4ac7-90cb-b3d8849ba789", "comment": "Malware payload (RedLineStealer)", "value": "8aa4d84060ac7df3c31fa5b11aeefe18c1abc3b2996818f8d03f4e7bbb326892", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079681, "uuid": "f9efa17c-e4c7-4ca9-a0c0-c6817c87375b", "comment": "Malware payload (RedLineStealer)", "value": "e63afec6d139c3514c27e435d4875f104776139f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684079681, "uuid": "2ccb70f2-2da1-4af7-aedc-7773e78f81d1", "comment": "Malware payload (RedLineStealer)", "value": "affc5cad6754a2f8d94486bd617a4e24f413e2c0387e82e584aa1028ee5c3b1ea58b46106654f0ab27b0c6031a8c7093", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079681, "uuid": "3b6ad27b-36c6-4392-a439-eae9860b50ca", "value": "T14E45236A7AE090B3D8BC57B09DBB13D30D383EA55DA8835E5759584A1C736C8AC3073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079681, "uuid": "86586054-da8a-4e2b-9f81-55910ea8bab2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079681, "uuid": "c1af1541-b82f-4a87-987e-d33d229c887e", "value": "24576:7yQUamAVE+7IPMjYd3/XJ5a3FZAkfr4QzE+SRZIMU/NC4jjo23A:uHQE+7WMjYdP7a1ZAkfr4QzEjRyMoNxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684079681, "uuid": "7793d1fe-c3d9-4612-b82e-396531924746", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684079681, "uuid": "aad0467a-4621-4e54-aefe-9d961ec2bb77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684079681, "uuid": "ef4988c2-696a-42aa-9fbf-541b732dc6dd", "value": "SongDancing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e994a890-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103421, "uuid": "714d67ae-d27e-40bf-992f-819567822985", "comment": "Malware payload", "value": "f2a764d5c425b0d60e13a72bcf13b88b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103421, "uuid": "c15c2d76-578c-4ee2-9aaa-fed1f86f2886", "comment": "Malware payload", "value": "8b917f6cf824a0620cc9a8633e0c3c27c988b822081f89b799f1c2c9777b829d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103421, "uuid": "4830e2eb-4686-47c1-8eef-2bcd1358e4bb", "comment": "Malware payload", "value": "412173f2abb60eb2dc02cf3c68707476090c761f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103421, "uuid": "a0b1603b-7af5-476f-9cc4-ff9339729611", "comment": "Malware payload", "value": "2cc87cb2880aac49e44dfdb3ee32b77304375f67ded158073541944d002ea542185448d2de4dc486c510c644f32a1bfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103421, "uuid": "74ee49e1-c02d-44c3-b64c-7896ee6611e4", "value": "T135A36C02E59244B9C0248DFC4C0BD56DE82ABA663FF928D377AD4B0D8A7934B4D145FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103421, "uuid": "c27dcd48-f7d0-4ca2-868b-56586ca93e04", "value": "1536:EGqAzsw9EpZmKbqPkXfX0CKT5QFDzNlUax7:Rz39EawLC5QF/N6ax7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103421, "uuid": "1b74f0d4-2801-403d-94f1-66998f4d6d38", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103421, "uuid": "a239e154-7d9c-4bee-af97-3a2ddc6172a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103421, "uuid": "a88301d5-9114-4163-a8bb-62c2e61b3719", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.22356.3554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64607ce1-f230-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052517, "uuid": "a70302fe-3ede-4ebd-b973-eb35d7bcb736", "comment": "Malware payload (Mirai)", "value": "3a8c5d0fc0e1cf686c2313dd700af9c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052517, "uuid": "41bef5c8-e146-4135-8a31-a53b4d130f8e", "comment": "Malware payload (Mirai)", "value": "8bd5462306c1897218132dc562295e4cad933a9d3629a599bdc3701a1940bb1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052517, "uuid": "1d15728d-b358-49e1-bd87-809a7232128f", "comment": "Malware payload (Mirai)", "value": "aad93cdf277c1359d1646c1220cd04bcf4d8f4b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052517, "uuid": "ad62f1e3-8c7f-4f79-a580-fe69b1f0c4eb", "comment": "Malware payload (Mirai)", "value": "5a607f8c396c51e399862107bb89821b9953c09eab625827679212d21f7a6aca86e74cc414d23e61d38bb716614e529b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052517, "uuid": "12f530a1-1b40-4089-b0c2-5f7352ccb1db", "value": "T1C33302A22B6E29D151B09777FC33AC1596AC17F9986730D63CF4691977C18024EF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052517, "uuid": "2e59f316-3d4b-4129-ae98-c7d7bd6fe358", "value": "1536:j9O/ZMAXIxNUk05LcPqF1aBexo4opKZba:j9O/ZNKyVLGqFUFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052517, "uuid": "410a8634-4dc8-4c84-8311-1a54fdccabf9", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052517, "uuid": "96de27a2-1294-46b2-8443-69925102afc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052517, "uuid": "a8eb12e1-6881-4add-b105-d912ea8a4e13", "value": "3a8c5d0fc0e1cf686c2313dd700af9c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8bb073-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058274, "uuid": "4fcde2b1-8627-4406-ac88-b20c9d912d4b", "comment": "Malware payload (Formbook)", "value": "7df31d97b98a8830fddfc9f2930683ea", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058274, "uuid": "d5529ee1-8c0e-4215-9cdd-3401b20d2b19", "comment": "Malware payload (Formbook)", "value": "8c0918e6c03961d7f82b1ac9466df259b6a1574803efdc94370f728a707af234", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058274, "uuid": "851901d6-f1b1-48e1-a835-1272490f8f2d", "comment": "Malware payload (Formbook)", "value": "c3cf705ccad435f61723c1cb71cdcea808d9409b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058274, "uuid": "9112dc8b-a474-4ee4-9d53-543747a5c7b0", "comment": "Malware payload (Formbook)", "value": "9143fc8f7ef39db98fba09f9033e35242eb7afd704ac165fa13e54d0bfbb9c0c5f312244011b06c3c5c051a1b1b9b89e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058274, "uuid": "bf4bfd60-3923-4539-b8ae-53b880696ed6", "value": "T1D8D4F12AC136ADF3E6CD0536000439E9DB70A2E3B8B6C53C0BA67596DB9F7156D980C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058274, "uuid": "8e3d4f30-59e0-4101-9349-bb250d1f5bdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058274, "uuid": "02136ee5-a235-4d72-a4b3-c59cb20f7ea9", "value": "12288:KanE+NTq4Q5+7s5GenL7gnwmJ2YYBa/4cyrxK7LIEmphPJ:ptORfDc6w/4cAxAhmpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058274, "uuid": "1158f539-e2b2-41de-bd93-bf2d3c4e6c6b", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058274, "uuid": "4d3067bb-0856-4261-ac63-09dee46e9611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058274, "uuid": "6d3c8d7c-40f4-4442-a005-153c923c373a", "value": "8c0918e6c03961d7f82b1ac9466df259b6a1574803efdc94370f728a707af234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a85ec2d-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089813, "uuid": "333c594b-39e2-438d-a02e-d45992b7f1ff", "comment": "Malware payload", "value": "608fb76ccddbfaa8de0491f48ca11e01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089813, "uuid": "ad84f15f-9236-4944-b6d3-bf1463244f99", "comment": "Malware payload", "value": "8cb2dd7d9a734abb366f1cd1a03a7ddb0496ba3a745379e22ff2fc851e6398d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089813, "uuid": "d067568a-1c91-4fdd-ab33-987330382e00", "comment": "Malware payload", "value": "0c3c4312355e5c8693a501fa0ac48a3250f773cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089813, "uuid": "bd608d93-76f8-4b1d-b778-b7bd4185f542", "comment": "Malware payload", "value": "507e2fb3dd89467853732710db68140aced27ed3c2130543afe7ecf59bf6757f991162ba086285ffa3bf1d12888dff0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089813, "uuid": "a7c48832-7bbc-4610-a570-7d4cbec07bd5", "value": "T1DFB3124C456CF9ECCF36C178E7669DCC827CEFA1B756908862E1525EA4051CF8C88DE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089813, "uuid": "82436a5c-561b-4526-839c-a831caf63da8", "value": "b21b12781028ae95cdf457ce465bdf18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089813, "uuid": "e58a5659-05c7-467c-8d81-a265592dd03f", "value": "3072:KnpQa+bbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7M7jboib24HjqH:LrwvP6bQ7yMP+DE827Q3+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089813, "uuid": "430e7c61-c05e-4c48-a93c-6d38069e82bd", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089813, "uuid": "390e64b9-79d5-4ffe-926a-41306d4ff542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089813, "uuid": "c966c6b2-178b-46ef-aefd-ef0d22b05166", "value": "x0rp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c57666-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089805, "uuid": "ac3189e2-f6ad-42a3-b8c5-ec3e1b1d69c4", "comment": "Malware payload", "value": "951a685480e98067ca4e5875c6fd263d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089805, "uuid": "a08bafe8-e972-4430-9dbe-855ccef570c8", "comment": "Malware payload", "value": "8cd8b9fef438930331289c06aebc0f2f1f07ff803c6d3e9dab86cafc7a08430b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089805, "uuid": "dce54d41-1a72-47cf-8a76-54080ffea6bd", "comment": "Malware payload", "value": "01f0be0e61bdfcc4dc57efd6422a1c35840d8f20", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089805, "uuid": "d6e2659b-014e-4044-98ef-cdbdba53bd26", "comment": "Malware payload", "value": "8faf89ac3cf2a69fb7f359980f49af3268b71a17269fd7b0a382abb8e275ae2f94a35bc7192c636e6dacf4d2af39fbb1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089805, "uuid": "e94e9b06-b826-411a-9571-1232d1c33835", "value": "T1A604CCC00EA594718796ADA27A70D5A0D73D0A6047CCAE8BF96D32B1F68D6CCD9DC730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089805, "uuid": "6feb6774-1ea9-4a07-81c4-53bc47fd7d45", "value": "3072:523JZMBoRCwHRDH/8wEJiSAI8CNk6IwStL:523+D9wCN9te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089805, "uuid": "cd870644-3cd6-48e0-b3a6-691880e917d6", "value": 176072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089805, "uuid": "26355206-2c3f-43f9-a431-4cdcad264747", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089805, "uuid": "e8ff4411-29a3-4df9-ac0e-52c7fd4bd9f0", "value": "werjlkj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b83f8d-f247-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684062314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062314, "uuid": "78a618c9-d308-4b0f-9459-7b66e0eac1e1", "comment": "Malware payload (RedLineStealer)", "value": "dd77d8b213323cf86a625a4c2adc1fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062314, "uuid": "d5422178-9efe-4bf0-a820-79f03f4c8d89", "comment": "Malware payload (RedLineStealer)", "value": "8d515247ddc2760147cac5be18d5ebfcf5bd1c7e9d2071762737e644cc458459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062314, "uuid": "1c868e01-b1fe-4ea1-ae47-2170e5c389ce", "comment": "Malware payload (RedLineStealer)", "value": "565e74257f6ef601e159b2793a8b5e08dad1ed80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684062314, "uuid": "5e4b3509-3645-4037-b2b2-5ddad5f3310c", "comment": "Malware payload (RedLineStealer)", "value": "29951c00375f1e0b694b02f62b28ce69534459db7a4a92a22e7b6c9cb268fe24977130580377d048ea326c7470ad5f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684062314, "uuid": "5906253a-3c48-4d1a-a27f-70bbe7f2a06f", "value": "T1A5452305ABD454B6E4B82B70C8FA078B0C37FC108D6ADB5B3B55349618B278665363BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684062314, "uuid": "53c6c4b2-a5e9-4e6e-9bcc-e2d5a0bc1676", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684062314, "uuid": "0d4c8142-e54e-49df-908d-28c8eb10f8a4", "value": "24576:synv8s2BHVxxEyA3PqP2aiJ/ITUVNBEnKMAkaYlMaYoMkCKaWEYpZ//j:bUNFA3PquacMUYKDkaeMpOtEYpZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684062314, "uuid": "b8d408f2-3e79-4b89-a697-f40e2e63ebea", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684062314, "uuid": "c2d0b9d0-a676-49bb-a3f0-d5395f1c0e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684062314, "uuid": "048d18cd-f342-42ff-880c-96c2f6c6322e", "value": "dd77d8b213323cf86a625a4c2adc1fd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f933bf84-f24f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684066081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066081, "uuid": "48581d9c-49f7-49c8-bb43-1df05117ad7c", "comment": "Malware payload (RedLineStealer)", "value": "65994a6e62724ce7882fa170f059c62e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066081, "uuid": "6a9be5df-5eca-4e48-b338-563343fba1a0", "comment": "Malware payload (RedLineStealer)", "value": "8df2f0bc580feb63725831d724dab0e3b0e5bb55e301c8d2da4761f7b6c43f2e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066081, "uuid": "8401324e-2154-42e5-8aca-c7b54d26c3f1", "comment": "Malware payload (RedLineStealer)", "value": "ad74694f3e553f6600bc298c54e3ba31110ccc31", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066081, "uuid": "3c0c1512-63bb-482d-85d8-19fa25e23e1c", "comment": "Malware payload (RedLineStealer)", "value": "eeb3978abb8d079db3660c3dd795a9321f9b3b1fbe43c0c43001329117a94b543742a72a918f7b5a0b23b50f44ad06c5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066081, "uuid": "86a76152-dac3-4e5c-afa9-02ab50effa6f", "value": "T11345234BA7F80123D8F623B094F622E30635BC965939C79F6F89AC4E1863594D836376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066081, "uuid": "9f8a6a55-cd62-44a3-8aab-8f7102111dd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066081, "uuid": "68189282-359d-40be-8de2-2de47d4d86dd", "value": "24576:+y4163i7hBPeJqheeV5OTprjgkYsW8c7rEvDGnPYSbG4WFsC3Qdb:N41d7L2JqheebO90EarEvandKJFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066081, "uuid": "bde38069-6320-4721-a4de-d5e489a00fba", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066081, "uuid": "e4b2b56c-11fa-4e3c-ad9f-caaccb679a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066081, "uuid": "5db5c765-9db1-4753-811d-1a7d518d361a", "value": "8df2f0bc580feb63725831d724dab0e3b0e5bb55e301c8d2da4761f7b6c43f2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3623e78-f29a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684098176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684098176, "uuid": "d9462433-3a71-44ef-9938-c1534928c2ab", "comment": "Malware payload (Mirai)", "value": "4726305e1186c7325e3322033e2128ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684098176, "uuid": "84c0cb04-9022-4268-a06e-6ea32cb8dda6", "comment": "Malware payload (Mirai)", "value": "91dfefbf5c439ba9a68ae4d7393515190d56c9d0ad318e086718769f690fbe93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684098176, "uuid": "934af5a0-c824-471d-84ed-4eb20a9ee0d9", "comment": "Malware payload (Mirai)", "value": "8d955d0a4653204d795f105b579f059f630246bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684098176, "uuid": "ec4c5b9b-1fa1-4043-99d6-54d00e8d8283", "comment": "Malware payload (Mirai)", "value": "ca09b482cf10e0301477783ca278d244348122b4e6f0841241afd698e57311bb7be4cd055e905d68c5ac49da7fb2f6f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684098176, "uuid": "419331a5-f35b-4cc5-882c-7f3bb4b558ae", "value": "T174334AC5D997DDF8E8201A793077AF3296B7E13E2128EDC3D3999937A942A03D10724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684098176, "uuid": "0aa1f335-2bca-4ecc-88cc-31de6c86124b", "value": "1536:PS+dEczOjRC6qf1dhWphmEBB19/MEgnNxg+kC:bOjRC6qf1dhWphmEBB1FMEGN+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684098176, "uuid": "d8750197-f96c-4514-8761-487dd4046010", "value": 53852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684098176, "uuid": "f3117b6e-a101-4cf0-8cb5-6e51a914b7a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684098176, "uuid": "3e620ee0-e801-4d5e-9b43-0a9283515bc7", "value": "4726305e1186c7325e3322033e2128ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c7d6d4-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684103042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103042, "uuid": "de05fabd-71b8-407f-bd0c-a6f1510192f4", "comment": "Malware payload (AgentTesla)", "value": "bb3850c496dc9a43fcbcd6d1bc970639", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103042, "uuid": "53c1bad5-010b-4ccf-8b1b-bb09274965c1", "comment": "Malware payload (AgentTesla)", "value": "923ae0c266afdbbb76dfca5df18e4aa33f8a41c705711ec9d1d1ce0bf276e40b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103042, "uuid": "8b72420e-c47d-406a-a7a4-ad0dd389e279", "comment": "Malware payload (AgentTesla)", "value": "230a099400b3ac02ab580f3f4689c49922058898", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103042, "uuid": "02905c2b-9dc2-48e7-8487-bfa1b5e361fe", "comment": "Malware payload (AgentTesla)", "value": "43fa3a61c7a5864157df457405e3ea7f4e2736a59de09fb933bc3947b058c8f3df2e7007cbddf00bba0634e6704473c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103042, "uuid": "419f8d95-b5ca-4aed-bbed-3b507ec71584", "value": "T19DE4DF4592B98F11CA7547FD0EA3C2850BF59D782C35D6340EC364CA9AB2F2B1984B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103042, "uuid": "87e93065-74dd-4311-aba3-1b232cb22706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103042, "uuid": "04a9226d-d3ce-488d-8a5c-095837344732", "value": "12288:Wxwhh2Y4Y9LBYnw6AS5XUhtjBGsWRFUX0KFYqIkWT:ewhh2Cd6r5gj4svX0KFYqZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103042, "uuid": "ba459b4e-cc15-425c-bab0-75627510b699", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103042, "uuid": "fa17d1da-c556-472b-abae-651fba57fede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103042, "uuid": "e3f73e4c-dd44-4688-b8c0-e2dc8d05a3a4", "value": "cBdIEJdDAjSzx7P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cce3315-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684067510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067510, "uuid": "08dc1664-5a84-45c3-99ff-bf9a5d33383e", "comment": "Malware payload (Mirai)", "value": "dd73a360b94177d16ddc863ed89a4fc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067510, "uuid": "3e3ccd21-9eb4-48bf-a41d-42f976718f86", "comment": "Malware payload (Mirai)", "value": "9383595c1bc470644b8f01d23433ad348950fec0b2286b81856a67db1c9b9909", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067510, "uuid": "cc54c4b6-c08e-4ec7-827a-1d745d0e9cdc", "comment": "Malware payload (Mirai)", "value": "cc4c7ce73a60b31f9672d91b199203bf9d8be2b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067510, "uuid": "c8a6e7d6-c070-4a86-a1be-24b704922896", "comment": "Malware payload (Mirai)", "value": "8c97b5e4a6ce12839faa6a38406823a63140f2b7d347417873504780e5ed225e0a917e10e49e6f5214458826cc8798f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067510, "uuid": "4500803f-16bf-46cc-8916-911ea5836e98", "value": "T12CE2E0B3421076B2CC7135F3E2A9D58D22311A3A75A9747A9B6C19398EC9013A7EEC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067510, "uuid": "e7d93a6a-7698-4969-b42b-f7442bb3aa52", "value": "768:0cI5YaKOvyxSF4Qle4UoxWjZD7+iYGX8Pb3URM:04avvuSle4UoxWjRPX8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067510, "uuid": "dd3893b8-33ba-4559-bdc7-001d2b9d04e1", "value": 32936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067510, "uuid": "84ded313-227a-4565-bef2-f78481894fae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067510, "uuid": "965329e4-448a-4201-902c-6330266fc799", "value": "dd73a360b94177d16ddc863ed89a4fc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c21fe4-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (FormBook)", "timestamp": 1684057349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057349, "uuid": "485e4696-e28f-43bb-b3d2-ab9cf78680b7", "comment": "Malware payload (FormBook)", "value": "056c8e14391eace2a7bbce0e4fbf7fd3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057349, "uuid": "ed252512-d31a-4376-8a7f-f1b06c68e5d5", "comment": "Malware payload (FormBook)", "value": "93b465d7ee036386b53254f8ba73fa8ec121b5182cc3dccc6a42426f69130be3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057349, "uuid": "d3a2f788-26de-4cbe-8b2b-b4024bb60486", "comment": "Malware payload (FormBook)", "value": "8a821a498353d62a8a2f82f7dd4cb71a75469a5e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057349, "uuid": "20d1b932-2389-482a-b01c-549370369c43", "comment": "Malware payload (FormBook)", "value": "7b06090ac18b244874aae73a20f6256e7291be05f66b2a80eaca6c9c00598568982bf2ced2baf6b826c6c5c0f910a063", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057349, "uuid": "51f19bcc-b7f4-4951-b59e-0f461a56e495", "value": "T1BCF49E12A2B0C977D00B1A788C1BDB6C48D5BE207935AC4FBBD47D4CCFB66417A1A693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057349, "uuid": "3e1f7289-ccc4-4944-a4db-384e1613f5e0", "value": "3315fbaa0073c4f3592d7e54ba056c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057349, "uuid": "07bc23f6-f0fa-4055-8638-750a62e418b1", "value": "12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNshnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeWizhxN2rn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057349, "uuid": "d01d885a-2710-435c-9fdf-b62e0736275f", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057349, "uuid": "6f05f267-a4cd-447b-a38e-bc01e3f3c314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057349, "uuid": "7812d86d-5189-4d8b-a7ed-d57f9b763111", "value": "93b465d7ee036386b53254f8ba73fa8ec121b5182cc3dccc6a42426f69130be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb0ce6f-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089177, "uuid": "ff7b5ab8-23c6-43c0-994e-47fb36c3d3dd", "comment": "Malware payload", "value": "48f8bb0621448bcc1bb7f784f19066d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089177, "uuid": "36d52139-8993-4874-bcf3-1ffae3373e05", "comment": "Malware payload", "value": "950df083a18934ea810425bbc4ae875c298f6fb610a433da8b5bb68e937e5aa5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089177, "uuid": "af6fd4d5-f7d1-4030-9913-705926a378f1", "comment": "Malware payload", "value": "d09c89d0e1da815fb2c01190fc98db98f3831d6f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089177, "uuid": "664bb60a-829c-42f0-8a34-4594a27b368d", "comment": "Malware payload", "value": "663321234c42b1285116db33268f1381c591c203d20b4875166e1cef404a88c8075231d727ea6ecc512cceff7c6261a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089177, "uuid": "93a3b185-49c6-4476-b109-4bffaadc03b7", "value": "T1C2A633453132D0F2C3F5543148A246F4E3B2FC971722466F5A353FA69F93783AE6AA21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089177, "uuid": "8b81cacc-9217-4709-836c-74c097731562", "value": "bb2292057634957dfa559b6eef7b52d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089177, "uuid": "c743ba92-d941-4a46-880b-3214d3884bb3", "value": "196608:4+PDonsp7CSM9onJ5hrZEKte9tGPqKKiTb+dFQ8dTZd4dc27ty:jonsp7o9c5hlEKdPNKi3+dFQ8dTTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089177, "uuid": "84606f56-40f9-4e99-b564-ec665a43a40f", "value": 9586072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089177, "uuid": "d974510d-a385-4c3e-9602-b27b4a9e4ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089177, "uuid": "7b33b246-56ee-4aa1-9348-267c4e63de0d", "value": "ChanChanProxy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39febb1-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "e374c568-fffd-43d9-bf4d-2f179dd2ade0", "comment": "Malware payload", "value": "6f895f89e7d068822ab596e46d0a4c90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "e6a62f98-a2d1-49f0-8ec1-8489b7c19925", "comment": "Malware payload", "value": "95bc40fb1956b0c98080dfc8792f3c0300546021066fc1826c089b5e3fdd6dc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "58662cb6-767f-4c6a-a874-0a6be1629f63", "comment": "Malware payload", "value": "aedbe37fcf0ce06da60979e2315a7138892509a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089640, "uuid": "9a047dd9-5863-4a86-977e-aef9b9ecb225", "comment": "Malware payload", "value": "b82861697942808b83ad967ce2b76f9cd244214036fd07fbeea35b6f6c52bcf553650872c2200ee3b465f7dbb7d37e2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089640, "uuid": "dbe4f24d-6083-4dff-83c6-b8c475e15f32", "value": "T119C2E82C37B68232D2EE067E4662EA5143F5D04BF223FB0F4CD954E94B5B3860A41EE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089640, "uuid": "ebd6a58f-b5c1-4401-8687-9f1625d7da83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089640, "uuid": "bc9ea94f-a25c-4ebf-992a-7279ef574cd9", "value": "384:DLBFYTmgEJbzgr2KGbPxZh7M9AQk93vmhm7UMKmIEecKdbXTzm9bVhcaUo6or6eR:H/dfEj9A/vMHTi9bDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089640, "uuid": "bdd505a0-bdc8-4123-a03d-3bb9dad731b5", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089640, "uuid": "7231bb5b-9e9a-4d89-91af-0e2aad7f4e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089640, "uuid": "2bdb49dc-0dc1-4ef2-af14-a74b9af12081", "value": "school..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a24297-f223-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684046968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046968, "uuid": "809562c7-a73a-4ffc-b8c8-2a15c7dea31d", "comment": "Malware payload (Mirai)", "value": "5bf5b868b9a1d953babb1e5b72556ff9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046968, "uuid": "f3bb2284-0004-460d-a548-012bba975f01", "comment": "Malware payload (Mirai)", "value": "960ed21efd5e2c78f0151d2296ed36d112528a99b59f1557ef3465d7f86b8249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046968, "uuid": "199677d8-e8c8-408d-a70e-bcc333dcc116", "comment": "Malware payload (Mirai)", "value": "c7796146b0a88a6f7b5dff3ababd93d0297c3084", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046968, "uuid": "dccc51b3-be96-4fc9-9b11-8cb36776b3ca", "comment": "Malware payload (Mirai)", "value": "ad77b8bf12f2698f5100a634b25fdc20555aaee012f7e749aa3a8a50e43620f6bc5db8a011288ba021c74b566fc11253", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046968, "uuid": "1390f0e1-6b9d-41a8-9615-441e4612a35d", "value": "T12CA2E11472A32D56F3DC1C3DC96A931BBD671BFC80F6327A79456620C94920A3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046968, "uuid": "111ec59c-efc4-4a13-af38-b9047b799f7d", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjGDhymdGUop5hP:vvQn4j+ZO5fKAlxaDs3Uozd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684046968, "uuid": "a9b8e120-a692-4ad8-8675-98a4aa7253f5", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684046968, "uuid": "9947641e-6cca-411e-8d42-d1eef0d8cf06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046968, "uuid": "cc5a127c-873e-4d4d-9c00-17899a6b0586", "value": "5bf5b868b9a1d953babb1e5b72556ff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a2b244-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057351, "uuid": "ffb0026e-1c95-4a4e-bc51-8b3d13b36188", "comment": "Malware payload (AgentTesla)", "value": "4f9a3a57cbdd2754e0111a5c57bde9fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057351, "uuid": "c1234e38-9ee8-4707-b1e8-cfc46f370ef5", "comment": "Malware payload (AgentTesla)", "value": "9652929fc702b8e9aa0d69b6902bb69b845d3445b174d2b1ec25923de63cad76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057351, "uuid": "10ce528b-f472-42e2-bd70-1c5d41ea09d8", "comment": "Malware payload (AgentTesla)", "value": "8ec27d1ac1d444ed46a9e79a7c01194596e02f41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057351, "uuid": "26e64b64-366f-47e2-9801-077234814f17", "comment": "Malware payload (AgentTesla)", "value": "1b45705f63d7509ffcb8302e8c50e73502f2ffdffd3aab1723d867898fe238fde0f053dabb99e813dbd587a462c177fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057351, "uuid": "375acc2c-d622-4624-beae-d3e48a8d855d", "value": "T14EE4E11123B9F7A1ECE583F8720CE401AFA56C50E3BAE6E44DCBF0D89158B15F6546A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057351, "uuid": "3d70973f-494b-45e5-9bc3-0b1664f57d33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057351, "uuid": "54ea2766-8c1f-4b53-ab8e-62338231429b", "value": "12288:HK9++JXILIS4KHGWgOSoRiQDYA8j8AUdz:q9HqIpHWPToQ+md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057351, "uuid": "40ccd04f-56ec-4bcd-b91c-81ffd439c66b", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057351, "uuid": "2b7eea9b-9ee5-4d5f-9cfc-93f92feba589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057351, "uuid": "8de267bf-468c-4ea5-9a47-57ccb630bf45", "value": "9652929fc702b8e9aa0d69b6902bb69b845d3445b174d2b1ec25923de63cad76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a1df9b-f23a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684056978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056978, "uuid": "e6276c6b-38db-47e6-9178-6d4a970e2f32", "comment": "Malware payload", "value": "33ee0bb76f93a82bbab5fd4b2a903291", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056978, "uuid": "86645848-50bf-4e27-8a87-4d1c97c4ba66", "comment": "Malware payload", "value": "9666bcc542cbc13280681782c1e7971429564c138f9f4fd5d3dbd187104c9e85", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056978, "uuid": "b284bb9f-40fd-455b-8b82-adb6ca9c806b", "comment": "Malware payload", "value": "a31a0f9bea721f98665a0f55987f77c0ef2f2b10", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056978, "uuid": "c557fe17-37a7-4c74-8efc-8ca4d25e50e9", "comment": "Malware payload", "value": "27c898a57fbcc58b1df7eb1061f802079172d9fcb5781f856e424fee5453940127f658f21bbc8e2c36c9c92b462f39f6", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056978, "uuid": "5b9e4b31-3cab-43d1-9db2-523c811bfc46", "value": "T11CB48CCDB6905E40E7782E31C497072813B2AE5F61BFF74AA94432B16CB2EF04D566C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056978, "uuid": "18e0b511-9cf6-4a2e-b1e4-748998994b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056978, "uuid": "9dff2925-2540-464b-b70e-f9ba592ede3e", "value": "12288:Vh/mWk/ViDzpt1r8iOhVju0xw9awVdopE:X/mLitrKaf9awbopE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056978, "uuid": "d7438e84-9eb9-4041-9a4d-39d99953a910", "value": 517552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056978, "uuid": "c56c9dcc-87e4-4791-a0ed-ebf4f8e8f04c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056978, "uuid": "ee054270-ccb4-4eaf-bee2-a88ad3a9affa", "value": "9666bcc542cbc13280681782c1e7971429564c138f9f4fd5d3dbd187104c9e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce748b9-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058276, "uuid": "48fa820d-5018-4b13-acdb-016802f2116b", "comment": "Malware payload (AgentTesla)", "value": "6d232ced9542d40c282a4b5f068354dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058276, "uuid": "414b0f31-4344-488c-aaf6-0c60af18ebdf", "comment": "Malware payload (AgentTesla)", "value": "96c283a9edad7bf16f772d34c7b137d5403be1dbc96589f7d57d71a0fd89c02f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058276, "uuid": "9f50a434-3fc4-451a-a0b1-268ced1aac96", "comment": "Malware payload (AgentTesla)", "value": "26bd195bd2a9284660dbd77d698a9834492b7b01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058276, "uuid": "4b7ab338-ec5c-422b-b894-ccd3921ec658", "comment": "Malware payload (AgentTesla)", "value": "bfc84428d5b6fbc88f3e615c9b911916df2834936153f128ddaea9044ff7feda0ee7d3cfda6b7e571ea0d2b8a9dd560d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058276, "uuid": "db9838ca-becf-4323-aaee-1232ea6b5958", "value": "T1D5E48C62F075CADFDE713BA5C159E3916E72D412E061F1A07E4D20C8DBA67E10E8837A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058276, "uuid": "5c84aa0a-4435-47fe-9f56-09124895b262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058276, "uuid": "d9365116-4a5f-419f-8994-f021871cb8bf", "value": "12288:6dFmTcMN5ibdArg67c+CIceHD8BKuifk7jWcLc:6dF3YIi0nkuiQKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058276, "uuid": "dc51ae92-e163-42f3-8cdf-4cb95afad5f0", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058276, "uuid": "a192d323-c184-475a-bdce-37fcdeb15fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058276, "uuid": "8e9e5d34-5d9e-4673-8745-3066d7a2c7c1", "value": "96c283a9edad7bf16f772d34c7b137d5403be1dbc96589f7d57d71a0fd89c02f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9008bd-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058277, "uuid": "e4522f7f-ffdb-4b13-8ac2-dd6f2507752a", "comment": "Malware payload (AgentTesla)", "value": "47124de273a6bfb0574836a275dd6e04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058277, "uuid": "d4cb2ea9-324f-4481-a7dd-61cb9747cc27", "comment": "Malware payload (AgentTesla)", "value": "98d735989cc1423bdd21526c42deaa86db9982f5c7e6c09d37adb881afa9c8f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058277, "uuid": "3908d673-5730-42f6-976c-18bdd58d4592", "comment": "Malware payload (AgentTesla)", "value": "07a8628347833460021284496db8da9a02962bf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058277, "uuid": "8788ab24-b26b-4d5c-a1a9-0d23b880cb59", "comment": "Malware payload (AgentTesla)", "value": "d1b376232d2117b3f0a472e6a1660e51ae40f9a927bcb4c415265e3889c7e55c49da8d15af209b3488464fda28a0b80d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058277, "uuid": "ccd3af1a-35c6-49f1-9e06-ae9d86342a52", "value": "T1B805D0AC3295B5CEC417CD3A8998DCB0EB20ACA79717C21391C72E9BB74D5878F141E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058277, "uuid": "6efe7f5c-042f-41e8-a08e-3f3d226b0efb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058277, "uuid": "8d618961-5298-455a-82e8-429b866e826e", "value": "12288:ZDFy6bYCPrCOrMLw62eoskp/UiFewt8GqxbjI/Bg1qco5kuimOMt+1wpbh8xDTtO:C6bYzwz5DUyntPC9wrnimXOJnSH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058277, "uuid": "66cc222b-e4f2-4710-a62d-c5c0cdd63048", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058277, "uuid": "b56790fe-0428-467e-8ddc-00821efc79ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058277, "uuid": "29b055ba-ed36-45fd-a48b-0340ea18aead", "value": "98d735989cc1423bdd21526c42deaa86db9982f5c7e6c09d37adb881afa9c8f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce46d279-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058278, "uuid": "edb556ec-5fb7-4854-917b-596af2dd103f", "comment": "Malware payload (AgentTesla)", "value": "c6838d8539e2acf97d8e9d17fad6303c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058278, "uuid": "69fc4e88-cf3b-4467-a271-f2fd9e07123a", "comment": "Malware payload (AgentTesla)", "value": "9904461ce9858afaba40159f95c46b0a081e9fbb66b302a53852c12d0a7823b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058278, "uuid": "d866f96e-1647-4bd1-a4d1-fb1ce2b45c49", "comment": "Malware payload (AgentTesla)", "value": "c43b56b29b264ca5adaba0a6ca62fb9781ab0b04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058278, "uuid": "4bfce647-c1a2-463a-8fd0-4fc240a16135", "comment": "Malware payload (AgentTesla)", "value": "fde90b78f1874dc11bc66fe22aa1cd6b7f899abf39ba42dda4600352b31b1c796587abd8a3883e0fb4d1d547f55c3504", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058278, "uuid": "36eba267-0347-4653-adad-27ecbd581b4e", "value": "T1F4D4D074509A8B51E02EDBF12478F872077138F3AAE9C5380FE655C4CA6BF545D88E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058278, "uuid": "8c8e8b81-18b4-421d-a058-726a65211139", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058278, "uuid": "47903fed-3428-4f53-8d2a-02e2831985d5", "value": "12288:oBPfyWqhSDuw/HCRL2MbzcfD0R+WX2+luuoncJN:oBPDqhoKLDkfwR+K2+lKkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058278, "uuid": "c4a89fa3-657a-4677-82a7-bd85284c8297", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058278, "uuid": "481e047f-488f-4247-8851-aa9e3890e8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058278, "uuid": "edaa292d-a11a-48a7-bfae-a8556c63470f", "value": "9904461ce9858afaba40159f95c46b0a081e9fbb66b302a53852c12d0a7823b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65e6189-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057352, "uuid": "191c7feb-f455-4009-9b6a-cf75bcf9c019", "comment": "Malware payload (AgentTesla)", "value": "9c422c8e92ef0a830f21053321603ab2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057352, "uuid": "f187f0b0-2fdf-43d5-9191-4ef26cfcefbb", "comment": "Malware payload (AgentTesla)", "value": "9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057352, "uuid": "19a2968c-dcb0-440c-ae18-f02b9c616665", "comment": "Malware payload (AgentTesla)", "value": "4b539cc4111e86063e668f0f5ac178f1aa83830a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057352, "uuid": "242c14b3-1cfe-4b61-a829-095676c2062f", "comment": "Malware payload (AgentTesla)", "value": "c10b5d2843a3bf320ac5301c387da56e12cd7255715e0915d9c8f8df043277ea28c2f98405ff1e116213054a7c60215c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057352, "uuid": "239328fe-ff34-45e7-a601-08fd23c138c4", "value": "T19DE4D0132069CD8AFD2EC735D464FBF421B5BCB3D8D59523277A3C89F9BAB01190825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057352, "uuid": "95950276-101f-4b88-8b6d-607a61992d49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057352, "uuid": "da0d540b-dd62-4346-84bd-afa2c46c35f6", "value": "12288:Rtdqmj8aaJCGcGvN+VLEeYgNSzGEZ0v7pUfKMkGZSkW/HeKZc8:NZj8lCPGvNCAebNbp2SrZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057352, "uuid": "867bee3c-3d51-493c-9461-1a8c2d7bb397", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057352, "uuid": "f1b4c726-8795-4627-9cbf-894d427a2988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057352, "uuid": "dff6df51-0ea5-4aa6-a60c-681bdd9f3bdb", "value": "9ad8a600ef80dda6989189726d0bcf0ec22618d71e5111736f1a1befaf2d6ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3230b7-f22f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684052129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052129, "uuid": "ef982536-418a-4f76-9b15-666aa06bed09", "comment": "Malware payload", "value": "0d30e791353ea530eb82442500770c14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052129, "uuid": "1b19e00a-887e-4f42-b56b-1ac248770972", "comment": "Malware payload", "value": "9bc133ac78ecf7c38cffe72eebc69546a0bfd4c306837eb49834eca9881c9e0c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052129, "uuid": "0e1a9151-c76a-4d71-a417-a0c6bedab2df", "comment": "Malware payload", "value": "59ae3cfd251b6f5e39de62faa5b8247bb31221eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052129, "uuid": "381ea61a-d89e-47b5-9c4f-b6e87318047f", "comment": "Malware payload", "value": "83deef63258f7bb44d79ba0fa49d85434e72a3e66b8a002ce6d41f0a1eb3d531592b342519d638875acd4e99adef22c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052129, "uuid": "8bbf6a24-f6b0-4526-909d-c72ac721c4dd", "value": "T19A422B43FB560CEFE1258237C1335929E4B2B63007E1C79F57B8A6690E626CA7C26589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052129, "uuid": "127194d0-8c1b-4e29-9a8e-2564138baa97", "value": "6781fdb39de7b4765f1079cf4296444c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052129, "uuid": "4faa4417-37b1-4190-aaaa-65fb488ed5b1", "value": "192:KB2eqnQNKcvd0XUF0mVmO0jqDasQ5tfFDjPy:lQNKcvumVLKqDasUPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052129, "uuid": "eb1c72f2-969d-4367-90c7-85341861ca64", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052129, "uuid": "5ab1ea62-3962-4064-bdf5-8069cf6f17a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052129, "uuid": "612fa208-3813-4861-abf9-2dfe60a767b1", "value": "9bc133ac78ecf7c38cffe72eebc69546a0bfd4c306837eb49834eca9881c9e0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f9b9c3-f274-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684081694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081694, "uuid": "560ebf73-6113-4941-b5eb-fd8669490773", "comment": "Malware payload", "value": "d5be46a61de0ffa39464114f5c6afc65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081694, "uuid": "3f1da791-a930-44b8-b498-331d39699f65", "comment": "Malware payload", "value": "9bde8cfc487ae8371a9a5f17d39b1037caa064f4d913caea74fefd772feb05e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081694, "uuid": "93bb6816-e8ca-42a7-b35d-ca26f1bde510", "comment": "Malware payload", "value": "e373e8da0a5aefac9211d5dfb33e0178c6ac295b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684081694, "uuid": "7cb77299-3294-451e-a188-9c9774e69239", "comment": "Malware payload", "value": "e76ad51522131eb2fbcbef6aa330d612b5f66a22d27788abee821222be366bba11e8e4042d1f78e35f6f639137794aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081694, "uuid": "8817966e-ef82-4c61-9b62-b8e5a40e8594", "value": "T18DD629A533B420C7FAB5F1B48E16DB31EEE1B56A2B196A970490C7C43F85DD22BED044", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081694, "uuid": "1183f6b8-86e0-4d67-9d0b-9dd9363d31ba", "value": "2e584bc98bbe879142c0875103761f71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081694, "uuid": "f5e85c19-fba2-45e4-90f4-d57a4dad6e5a", "value": "98304:gS67jWkWWS9UXQieVVa3CiFNjNcjxpjfq3CRKkxADXTeqgIAa5K8snmi3:Fk3qUhcjn33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684081694, "uuid": "b8222849-889d-4cd8-bd47-17ca5aa7209e", "value": 13053952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684081694, "uuid": "f0397380-2084-42bb-a335-bec40b7abd11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684081694, "uuid": "f06a6896-0abb-45da-88b9-1176d6a334d4", "value": "SecuriteInfo.com.Win64.MalwareX-gen.7533.20558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b8d323-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089624, "uuid": "8538fc8c-51f4-497e-8325-13b882998577", "comment": "Malware payload", "value": "8492b293cf62a0b06f6555f7d7ae5886", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089624, "uuid": "f16f4498-e3b3-4ba9-a0f9-86b4d7fcfe0e", "comment": "Malware payload", "value": "9c26d095e7887176e865d01175377a27e5213e28b46c1dce307a19d0be59395b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089624, "uuid": "2a758461-86be-41ca-a935-9484c86b8315", "comment": "Malware payload", "value": "05c1d76ac15d2b475718297696b4523fbb55b936", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089624, "uuid": "eeb7ba2e-0bde-4342-bfce-ee01675e4c3e", "comment": "Malware payload", "value": "743b706ea2634457c0e9aab4cccb13664a6e2bc78629dbfad805e98b81921ac6faa1cdf5ee10c4bf89d78cc4721db533", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089624, "uuid": "9e5bf38f-b381-4dfb-9ce0-1dbe6afa38c4", "value": "T163E5D06B350AED90C32A8632C8EE50444365FE5B7F03E20E358D379A36757D6FC8A946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089624, "uuid": "691a9003-36d3-44cf-82b0-3b1ea10e25af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089624, "uuid": "ddc3c6ad-36e0-4997-a799-1dd8c6a835c8", "value": "49152:UiRenwA4tqKzCE9HnwA4tqSOWPEzmpwMX5T/oWcNyq2cSt7JAvEsS0:UiRenMtdznVnMtfXzTpT/oWcN1St7eMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089624, "uuid": "7a3156cf-d062-47ed-b6df-d2c9a8f9cc10", "value": 3072000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089624, "uuid": "d3e1183e-54e5-4a79-bf56-f4fcea65dc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089624, "uuid": "80fbf5d5-b6dd-4210-b5ce-0f92ee1d157f", "value": "LadonGUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31db1d77-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684067465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067465, "uuid": "c5f6f818-f591-476f-8147-7d3a150c648d", "comment": "Malware payload (Mirai)", "value": "be82bda77494a32b0e349cbe1a3cf04d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067465, "uuid": "49a49339-3779-4668-83eb-c69185db22bc", "comment": "Malware payload (Mirai)", "value": "9c87909c6afaf34ee8e15e1644634ebf80fa9127163291f139310e10e9a9d959", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067465, "uuid": "5495444d-e858-4fe4-b518-4adf1acacec2", "comment": "Malware payload (Mirai)", "value": "606f128685b1a9d6c2f6be9bd146600fc8156bc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067465, "uuid": "ce148921-eb36-4ca6-8828-789f4d82d957", "comment": "Malware payload (Mirai)", "value": "3c86ee17307a29e48a224534ff7fd6efe216c6394e4c6c3b132d04eecad856d87522c8e8496829540ff47f53aa639b1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067465, "uuid": "feb7b857-6d74-492e-b7ba-b1dd79752b10", "value": "T1A5432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067465, "uuid": "3fbab2f8-3817-4eb9-a45b-00a8905951e7", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwD:RqtmZPuutfbltZFBSJsBcfDSTFI+BED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067465, "uuid": "81b474ac-72e1-40b0-94a0-edc6f4a69974", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067465, "uuid": "ea895a9f-43b7-4356-ae89-c91fc4e0b340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067465, "uuid": "97e11024-9836-4e8b-bd65-424998059da5", "value": "be82bda77494a32b0e349cbe1a3cf04d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e697fd70-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103416, "uuid": "c4c0cd6a-483d-427b-b9ad-cd9dccab7103", "comment": "Malware payload", "value": "cb1363d5c8f1baa50fb07eeccdfab24d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103416, "uuid": "2596d782-51ff-4c17-a303-fb7435a6ebc1", "comment": "Malware payload", "value": "9cb09038755d952bc278f2694f721bec1f50b0bc70e3930ee586dd8c177608de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103416, "uuid": "f32c9940-d06c-4ad0-a471-4d7e432ed004", "comment": "Malware payload", "value": "b0fdd250f8fc6d46b2dc35ada3710236e9871ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103416, "uuid": "40bea8d4-64f2-4bd4-85d4-5299a31af2b0", "comment": "Malware payload", "value": "4a7469a0c9aa9e5ac68a3b9bd3f02701b60c909d3408d32934f2c614feca74bdc6b0a03de15e47cd651529ba3642e2f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103416, "uuid": "79cc60d4-86fc-4e34-98f3-dafee6b843c7", "value": "T11E553331F066195DF3A482B540F2A65E5B92F71138BE5DE803F6EA2719ACB3078F421D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103416, "uuid": "441b1bfb-4506-4377-b20d-79a7aef05988", "value": "8e733b52dd698785e78592de149b5f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103416, "uuid": "907b93d4-50df-4666-9335-aa6d75bd6bfb", "value": "24576:MAWiz1VMX3nXrRrpRi+mHpTlqVoKvwkjzsf8p84dQmXx3emm:MAWrR9WHpTliFj4W8nmdemm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103416, "uuid": "b9ae3f70-292c-49f7-822b-5fd0e49e1437", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103416, "uuid": "ab266872-a91a-4b0f-aded-2fce2b5400d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103416, "uuid": "792f72b9-de2e-42ef-81df-fd393f1e4aec", "value": "SecuriteInfo.com.W32.Malware_fam.NB.31761.22699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6219ed-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089732, "uuid": "f1f0e24f-9fd2-42f7-99bc-2c5db325d1b8", "comment": "Malware payload", "value": "6ab9414667d7a71a99bff98c9b687086", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089732, "uuid": "07467512-5576-4e15-9bab-01486cb049bc", "comment": "Malware payload", "value": "9ce19d46fcda2aa429c6ae18cbe00e6ae8b7c6a2188ee6bb9a7de81089382a84", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089732, "uuid": "1081e9c2-c68a-43a4-9f48-3564cdb2f10a", "comment": "Malware payload", "value": "7c479a6a97d0ce6bdc067dd6ed59eafb6ee53a8a", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089732, "uuid": "b4e437f6-4ca8-4d6d-ba98-cfca613a6a9e", "comment": "Malware payload", "value": "15d04e378bd3122318ec9fa1cd023451e8ebdea95ec7386918a5b877da2f7966f6b706371cf53ef37269a00165481a45", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089732, "uuid": "4ef1499e-bd75-4915-9c5f-c204622af2f3", "value": "T19B652249BBC84911E9FF6771B9B693C4A92E3D214466E00F8051B04C68F2FD097B1FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089732, "uuid": "fc705733-724b-4728-b978-74403d89229d", "value": "24576:NvtALjQdqfsrAjP5oI0ZE1rJDJ0rViP9iG36HSYh6S9u6XyRHDOQpfWWLe7jgbjz:NvtGYqkUjP5V0W1rJDJEicG3fM9u6UDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089732, "uuid": "641c818d-4b27-42ee-93b2-965e3f9a3af3", "value": 1443649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089732, "uuid": "7547b40e-765a-4d6e-b7fb-4e3a4d7ffb7c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089732, "uuid": "c8d0a1bc-2ae1-4ca8-843f-a7b602c1ec0f", "value": "tigersnesmarketv244.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf01462d-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058279, "uuid": "6055b386-1872-4dd8-8229-8e0d630ba763", "comment": "Malware payload (Formbook)", "value": "3200807afd13b29dbed7a6ef977a76df", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058279, "uuid": "c707a5c0-e740-498c-beb4-bf7ea27045dc", "comment": "Malware payload (Formbook)", "value": "9d31bb5aa1c796ad53caab202d5fe30d09157bf81ed3cc93ea1225e78aff0624", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058279, "uuid": "cc97fb53-034d-4f89-a3bf-2c28ca156b5a", "comment": "Malware payload (Formbook)", "value": "945d50efadbd1c5063159743495b1ba09fae15da", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058279, "uuid": "a48b6bf0-4a6b-453c-9c10-58bac6df23b2", "comment": "Malware payload (Formbook)", "value": "48dc3ca113b6ac3973224808fa440b405d774f4eaec9491b52f0ee2aae53889773b38face07dff6b8fbdcb51b2383724", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058279, "uuid": "22898862-11c9-4258-b4d9-e3625aae5c62", "value": "T1B645482439FA502AB173EFA98BE475EADA6FB7733B07646D1090038A4723941DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058279, "uuid": "260b1898-14c4-48bc-bfc5-b091f575cbb5", "value": "12288:O+xSyUNe90wlgEKqB0zUK6fZHJTGXXM8qCCyBdbkLff8oFF9vXai4M71FIShh2EA:dpPwjGrQxZEOnvzcEUqvid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058279, "uuid": "cdf6d30d-a781-487a-818c-b18a108c705c", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058279, "uuid": "1c237dcc-5d1c-40ac-9d09-c8f9a0189933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058279, "uuid": "d5dfb277-7f2f-4620-b81c-ead09000076c", "value": "9d31bb5aa1c796ad53caab202d5fe30d09157bf81ed3cc93ea1225e78aff0624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aca067e-f23a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1684056850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056850, "uuid": "e7072c1c-3f7a-4b23-bb16-41518b286744", "comment": "Malware payload (ModiLoader)", "value": "e6a2905d20a301ef5d644d1972b3395f", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056850, "uuid": "5a6389dc-935b-43be-9048-5bfd0f1dc75b", "comment": "Malware payload (ModiLoader)", "value": "9e07cf78963257e6dfbec89916c91aa264325bb5d1fe117879f7abcb7b08c77d", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056850, "uuid": "3f1a022f-7554-489e-8bef-f18dfb404aec", "comment": "Malware payload (ModiLoader)", "value": "0d012c5baa6cbbad5214acbe13a6c856c9600447", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056850, "uuid": "f96bf4f7-6aef-438e-a090-ed1f095dff2e", "comment": "Malware payload (ModiLoader)", "value": "580cd3f036e36b8d90941403a952f7f2a4d898dff6db80a27b3c6580428277027aae589a1d5072eb6aae174c9275a141", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056850, "uuid": "42d1ae99-f196-4034-a233-4bf43215854c", "value": "T1B605BF31A6E25037D5762938AD2B4765E8297EE01D19375EFEE97D0C2F3D2A1342E203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056850, "uuid": "3a7b1fd6-5ccc-4bb9-bbb3-75ef57a52f42", "value": "2eb49758b652eedff910503837727781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056850, "uuid": "e82ce135-cfd9-4196-a219-51e497317ca5", "value": "12288:TNLhcjoS4FC7ITh3IBPmOt50Pbkttml53kbXJ2zlLj0:T9hcsFCMTaFCKIsbZ2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056850, "uuid": "0bc066c0-dacc-49e5-b2f9-522e3251946e", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056850, "uuid": "adc074e9-040d-4312-af02-fb17ebecd838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056850, "uuid": "dcfbb3f5-4236-4c51-81b1-f50faf2257e3", "value": "9e07cf78963257e6dfbec89916c91aa264325bb5d1fe117879f7abcb7b08c77d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8cf6bc-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089712, "uuid": "64f4acc9-c990-410b-802c-97cee02f7b5f", "comment": "Malware payload", "value": "7d0bdf54bf2a7f3e810d4953c3503daa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089712, "uuid": "1586037e-bd0f-4fed-a8cc-160f24ff2d64", "comment": "Malware payload", "value": "9e5a1c480cfeb5383187c95e1c998ba263a88fa7d1206cce0ed6ba7a2b8fff6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089712, "uuid": "44d17d2d-7064-4c2a-bd6a-a9b3baec3ef9", "comment": "Malware payload", "value": "2064ca8286d1028093196406665b83efdcf910f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089712, "uuid": "24b4d8a2-4230-461e-b404-00d946299263", "comment": "Malware payload", "value": "2e74c6efbb328a5c0e2e4495c9b43abe73fee9e4d8c0f7a9a7f1d6e75e4affe92f59eb16d4288b253e82465b8c998b4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089712, "uuid": "4513d6c5-d293-498a-889f-78eecfed5429", "value": "T15BF3BACC4B2129664B2F6D72B724A4BDE7640EA4C2D4869FF46B71A1F6CFE8CD8D0411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089712, "uuid": "bdae9d17-0564-4653-80af-138e50a2f5ab", "value": "3072:j42JS6kTRCFxneh2tg1kY7ynUU7IFsIwyt7:E2ITR6deh2tb5nasIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089712, "uuid": "74aed1f4-f55d-4887-812e-66f9ba921a3c", "value": 159907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089712, "uuid": "9652f2db-f46c-4e3b-9ead-6a7e8ab686c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089712, "uuid": "d8af8371-7009-4252-a165-3059a8c9cb66", "value": "Szfluuob.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3897f0e3-f28e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684092816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684092816, "uuid": "717d052e-0928-444c-8853-f0a6e3798a49", "comment": "Malware payload", "value": "50704081c707604cdde6eb10430da3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684092816, "uuid": "16f34de4-b7cb-4c1a-bccb-6f25fb2723e2", "comment": "Malware payload", "value": "9f52ed6cc6d1d39ab8a706fa959d59b8c11ae3804e1d87504fb6348eb77f69fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684092816, "uuid": "0890b6b9-d340-474d-9ae7-6ed2063806f4", "comment": "Malware payload", "value": "9d6c5980d639d1927d96dd921d1d3d9956a16224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684092816, "uuid": "56a809d4-a2fd-44a6-831e-5cdc0cb05f35", "comment": "Malware payload", "value": "5355de9eea2c9efb3d3ac1aa540062627ad71eeb7eed89e96b1393b7610b92c3671c4228479706da2ef18665305c1f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684092816, "uuid": "224c5b41-62b3-489e-b3de-6a5c0da72421", "value": "T18DB60A0390DB8432CE19CCFEAAA6D7665B5F34B02E4D92D953C4A25D07D5ED0B0BA237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684092816, "uuid": "a90e6676-ed01-431c-ab06-9a860b7438aa", "value": "3fbe537ffebff18f8391e84d462e9e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684092816, "uuid": "5065414d-d15f-463e-8a97-b95a46e32909", "value": "6144:c0SYdNQejzASPXrk+TLv9GxrqK01t3TPk:cjYoeZPXNG5qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684092816, "uuid": "67d39bed-67f4-4bc3-a839-e6c6f065e8c5", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684092816, "uuid": "f0211209-0d08-4a6b-be6b-e9a345ce77b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684092816, "uuid": "bdc94aa4-6709-4b4e-ba9d-8d8dedbb2d9b", "value": "SecuriteInfo.com.Win32.CrypterX-gen.689.31370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2deec5b0-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684055862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055862, "uuid": "cae5ed03-3864-45e6-8832-5bc21f9288d2", "comment": "Malware payload", "value": "29abb62862473848d91a1ffaf44c66d7", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055862, "uuid": "a301884e-06f5-41a0-b43e-afa916a14a3e", "comment": "Malware payload", "value": "9fa1c516adf6686905e99e6179aa58d889bce5b6e3ab75a279f0987a624b58f5", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055862, "uuid": "171d132f-7a18-473f-a464-b9eafe5aaf85", "comment": "Malware payload", "value": "fbd5060c1824c6eb85ae40effd5b8387dd2618e6", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055862, "uuid": "98a9ece7-5ff1-4192-adb9-78abbf842553", "comment": "Malware payload", "value": "1968d8fd052e122ffb4439cc4dce826d6850d3527a478c0d8d43b1d66daaf034bd0fd56ec10d4c12c7e1b86a1bbd6513", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055862, "uuid": "57d953a0-7f27-4a40-8a8d-911b77519201", "value": "T1F4D45A46A6FD06F8E0B7D23C86875806E676BC1603719AEF03A046771F676E18F79720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055862, "uuid": "c91b63df-dcc0-4235-9310-77edd1fe3468", "value": "6d28b6cd3c6f8bd5f4c3bfad3bdceb38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055862, "uuid": "e61b62fc-3bd3-489b-bd73-336d9839e147", "value": "12288:zU0wh8g3nKlFzfFeOVYP3c6g6gj7Pqo86uuK++r:z0h8g3nKlFzdl6gZHqd/++r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055862, "uuid": "359e344c-5600-47d2-85d3-ab5bdfb6a714", "value": 599312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055862, "uuid": "01bdd80f-d273-4f20-ab42-cd75f5fe40ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055862, "uuid": "c2e9c64b-4ed2-485d-9727-441995d60548", "value": "9fa1c516adf6686905e99e6179aa58d889bce5b6e3ab75a279f0987a624b58f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eaec54-f259-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684070159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070159, "uuid": "6246d84c-18f6-43dc-9f91-455fa896c1bb", "comment": "Malware payload (AgentTesla)", "value": "02e5a3fa1254414f93c8173a6fbf54fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070159, "uuid": "0fa83205-e45d-499d-9c03-1741ee6a9a3f", "comment": "Malware payload (AgentTesla)", "value": "a1080dabf296d3fad0718120c07bae5b175e166b791e701f4ca86b10f53678e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070159, "uuid": "66f31154-6136-4aa1-b639-1d862c361c6d", "comment": "Malware payload (AgentTesla)", "value": "8792a2297a6d9430f31a0938f0646a9db3c9a950", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070159, "uuid": "c7887ffa-b5e9-428a-9c24-3d4021fbbd3c", "comment": "Malware payload (AgentTesla)", "value": "baa829c4f772bacaa4a664a906d7f4d27735cb362662f9805fd786bb65886cdde13d0d61acf992b78386cf7f86c13fbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684070159, "uuid": "c71d246e-bd36-4499-ba1e-ab9678970e27", "value": "T1B9E4236CD024149AD7B76E17BDCA4BF6CB88A62392B5F848DC775EB126C3006BF53124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684070159, "uuid": "e765d78c-10d5-495b-89ae-7f76a0730839", "value": "12288:RhKLgt76axUCxtc2iq4hhp+BV6IE2/myE5LLGZSJB9mJyNg1UypqfG6FgyFhSCw:Rhz6a7fc15b8VYe1cB9mijeC1F/zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684070159, "uuid": "3a674d54-1f48-409f-9828-d7a156d39fc3", "value": 671089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684070159, "uuid": "f31a165f-11a2-4953-a702-7ca712d5838f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684070159, "uuid": "d679b8e9-5613-48c0-a43b-24c3cc38f24f", "value": "Product Samples Xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d196fe6f-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066874, "uuid": "6d240d6a-fa19-433e-b6a7-554d5208e3a1", "comment": "Malware payload (Mirai)", "value": "453f71b4cc6eaf8f154427f423926120", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066874, "uuid": "3001ca23-d2d6-4cf2-a343-36b143d0bbf5", "comment": "Malware payload (Mirai)", "value": "a3691a650760bf46e84b485e18ad450e9f028aefb3bbcf8c853082f49bb44b3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066874, "uuid": "59139dc5-8682-4b6c-aff1-08ea0ce53bd1", "comment": "Malware payload (Mirai)", "value": "815fde7ed14b439baa8f8d57dc1064cd8ecb838b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066874, "uuid": "9148dac5-1190-4a91-a278-a8250ac78792", "comment": "Malware payload (Mirai)", "value": "b9aa813fc9eb63d042279b742c4cad126be41ac12f3da6abe1926371242b92e8abe7f60447583a666a4f03cb5bf17a4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066874, "uuid": "a22c5066-e60c-4231-880d-d9aa1484bd6c", "value": "T12FB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066874, "uuid": "32905601-4169-4985-9c04-d61cc3533c37", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1K/LWy:c9sSyzz36YaWWgg1Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066874, "uuid": "84d02848-2fa3-4a47-9d29-d7881fc05149", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066874, "uuid": "6daf4e0e-58a2-40a6-a2bc-e10ff05613e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066874, "uuid": "a900826e-9b2c-4e41-a2e6-94030bfeda32", "value": "453f71b4cc6eaf8f154427f423926120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb694f4-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058281, "uuid": "8598c234-2812-424f-84d0-148eca64fde7", "comment": "Malware payload (Formbook)", "value": "5a4091786137bd9601dac27588821df5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058281, "uuid": "459b9a6f-e09e-4259-886d-13538250145e", "comment": "Malware payload (Formbook)", "value": "a4515730dc2be572ac039d78bfc3c3e2e1bfa4a737e67f0a709b29d94c737ca6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058281, "uuid": "e7d00915-a06f-4d8d-9bb8-6d0c355e8f1e", "comment": "Malware payload (Formbook)", "value": "f9e6a6f2424c5eb03f0d8d57407cc728064533b5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058281, "uuid": "8602bf3f-61ef-4064-b8df-54db531263fa", "comment": "Malware payload (Formbook)", "value": "7fbe5c10ee56969d5fa6c563087e32dcebc8253c4da34945677c6c125b135d5cefa8a135c2697dffb5ec560001131d7d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058281, "uuid": "8bd3f0b3-932c-4df9-a7e8-dfcb7aa30e9e", "value": "T184F4053C297D1727C57AD7A58FD08427B664986B7121EE68ACD393E60306F1229C363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058281, "uuid": "cdf250b9-eb37-4478-b70a-62d4b2ea3801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058281, "uuid": "a486a956-7c51-4a50-a147-6d984d58821b", "value": "6144:0sVpZCRorNdzgvxzUToxD01kJf/RzBHz19aTLyZpxTrrGKyiHP+uWtsWUt8BwD8J:M6Tww1kJfpz9jaT0frPyiv+ui28WD82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058281, "uuid": "a1c0cede-5b38-4361-8e8d-f5b80f6e766e", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058281, "uuid": "18170cd4-29db-456d-9a54-528dc6836926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058281, "uuid": "bccf6490-a05d-4ffd-af20-407dd14b9076", "value": "a4515730dc2be572ac039d78bfc3c3e2e1bfa4a737e67f0a709b29d94c737ca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c412e32e-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066851, "uuid": "aa2d51f7-85a6-42c3-9c7b-18dd49f82221", "comment": "Malware payload (Mirai)", "value": "31f0d71fe8f179270607d77682964465", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066851, "uuid": "e52a2ccd-44e0-4eaf-bcbf-12362686d1d5", "comment": "Malware payload (Mirai)", "value": "a498439e74ef17ebd14b0074de7b51b64e58f7a4fe7b5e94480e53761ff1f844", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066851, "uuid": "76b7a742-a09c-4e2d-a4d3-dba46b7f9053", "comment": "Malware payload (Mirai)", "value": "0f4b830837cbdd33a6a8a90bf5213bae6bffd720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066851, "uuid": "9e6f36c2-9aa5-40c0-b268-500b9f301abd", "comment": "Malware payload (Mirai)", "value": "72d992f67260dbf2bee9523254bd2bc11d9c658d927cf2da7c0427b117345ab603628e1ad73c25d1b419766bf221b68b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066851, "uuid": "5b78ac18-6232-40bf-a265-452779af72b4", "value": "T128A2D11472932DA6F3ED1C3DC9AA8357F9670BFC90F5327669416620C94924B3E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066851, "uuid": "bfd96d91-af66-4894-b00a-ae08f65eae99", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjhhymdGUop5hR:vvQn4j+ZO5fKAlx1s3UozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066851, "uuid": "8872e185-911b-401e-b6c9-f7f983c95110", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066851, "uuid": "3eecf659-abef-46ab-9cf0-274afc2530e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066851, "uuid": "8536b254-455f-4b12-8f70-2852ff5f57dd", "value": "31f0d71fe8f179270607d77682964465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52dacb6-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103414, "uuid": "77c43a91-31e5-4e93-9e8c-f6338a37209e", "comment": "Malware payload", "value": "465f3cfd7218145737b922a421188d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103414, "uuid": "c7ac33ff-6e28-41f4-8cd1-338562a8dd4c", "comment": "Malware payload", "value": "a4e36c8a2e9485feb8d58c4085981e614b7d4b6974d1fa026a8097ccc9b8e27e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103414, "uuid": "73b33936-df51-483e-87aa-d7c87a3ecccd", "comment": "Malware payload", "value": "cc7097bf8d5d64bee55720802ce2f310615b27ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103414, "uuid": "d49dd32a-6ed5-49e2-9472-14f450111b13", "comment": "Malware payload", "value": "d1648c8091e2083152928684b35c09a56571ac5e36984c626d839f1d3c9fddce34dffd0a1bf28eecbbf14a2d9fd578ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103414, "uuid": "ed6e03a8-538c-4ab9-9669-deb521de07b7", "value": "T17A52AF6A1BEF5954F4EB0A73933606012C95FF38089793FA4AC672794D36143DF82C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103414, "uuid": "4a4e3f68-3f65-4abb-a304-095742dfb1d0", "value": "6dce49c3d25455b8d4e9d7887aa74d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103414, "uuid": "84942838-17fb-43cc-8c4d-ce1c3d7e88db", "value": "192:ygBkUejFlhDV1EAXv86KrQg6qBinIdMoHleHysQ7LKgKUOXXR91PM/b:yeeFlhDVVX06iBrdfl6sLiUOXX/1PKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103414, "uuid": "24cbdc81-824a-488d-be4d-9907ef51ebe1", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103414, "uuid": "c69a11c7-beb9-464f-88de-dc4ad9ccfa11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103414, "uuid": "297f44d6-cdb0-4a67-9bf6-b5b0ac0d7354", "value": "SecuriteInfo.com.Trojan.MulDrop6.10030.31849.13443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67638a27-f230-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052522, "uuid": "182057c2-985a-45f4-83f2-00caab54b4a9", "comment": "Malware payload (Mirai)", "value": "da12f223486c1ca45642383fa6bef891", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052522, "uuid": "5cd3677d-6077-4f02-a6f7-a84e76adf477", "comment": "Malware payload (Mirai)", "value": "a4ebf5e0d4197ba91cd391ab73829786d4f9aecfeee24531d7249f4b7b6c72c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052522, "uuid": "748e2a32-5a2a-4840-a3c2-ed6c90bf4923", "comment": "Malware payload (Mirai)", "value": "1fc5f0ec87f2ae016fb12129a62adcbc4122dcf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052522, "uuid": "7460874c-c67c-471d-b1bf-b43882a6980c", "comment": "Malware payload (Mirai)", "value": "1951a2f05187910362e04947b980e63bc245b152edd02b6bb03c9aaf228ccfd8d4e4eee1cdd8bdafdb9ecfce141b58f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052522, "uuid": "cae31c35-de91-4542-978a-49cd4035d1a1", "value": "T187E2F1A3D372A092CE782AB1F96DC68A6ABD4B6CD53A70931501522C2D9A0435B3C8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052522, "uuid": "c708a76b-30f8-49e2-9ff6-86296f789168", "value": "768:uoiWiO031vpAPbrVWZK3XVGxm9Xf9q3UEL5IR:uorm1vpALgUJOL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052522, "uuid": "013bd588-eb02-4545-bfd4-44a33c23ea32", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052522, "uuid": "d684479f-631c-4e26-bda6-70feffaf182d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052522, "uuid": "7719004a-77eb-435d-a10c-785b611caf0d", "value": "da12f223486c1ca45642383fa6bef891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482d73eb-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089836, "uuid": "14ee714f-5927-439b-9c92-f85bfb9efbd2", "comment": "Malware payload", "value": "22d6d0b5440b9f57505b247df551ebd6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089836, "uuid": "a7fcd76d-2ce0-49d2-ab5e-31e2b0acb5e9", "comment": "Malware payload", "value": "a5a02b9c6204747b5f9ce08be7274b3f7aa3d9eb1b13221145c7bce79bbc1eb8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089836, "uuid": "2a39cbda-cf72-43a3-9996-0181cc2130ee", "comment": "Malware payload", "value": "669da8dd0518561c6f41c69d55418ceebd7b08dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089836, "uuid": "2b68ac56-b70b-4ac8-b54d-d3006134cc7a", "comment": "Malware payload", "value": "71d4445521b66bed44b375dbb501e6ce34be202e73f26add080af7eed4e101c7e131922bac40c23930a3f297034f90df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089836, "uuid": "e2ed3cd9-91e1-4004-9d18-82f6a946263a", "value": "T1B3B402F89C3CB33BCE583B737DD110664D0BDE60563B409CA0E4B86CA1F6967666B096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089836, "uuid": "d85ec319-08a9-4c8b-af69-9ab61a4f09ca", "value": "f7bd9bd421c857ecb36df18fed6997b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089836, "uuid": "9fa42fb6-e408-44c1-8c44-f1d33ed80fff", "value": "12288:tw1vnw9i7ukEcYBCe2MHCK3RHNsTdVFbArG:tevWbrCaCeZMFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089836, "uuid": "700edee9-821b-4391-b7ce-ae227bf03672", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089836, "uuid": "479e85eb-f3eb-4118-8ea3-e4cbc0aa66f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089836, "uuid": "3ba64ebb-c114-4ed1-9d00-2fd3dda58ecd", "value": "zsbBuilder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0580662-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058282, "uuid": "9af17117-8eb6-4117-9f5d-0f3717989b84", "comment": "Malware payload (Formbook)", "value": "eb2b322f8bb4827c2d4649dd81ad7fb2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058282, "uuid": "b31a6b32-393d-4c5d-bb80-d8cff51face4", "comment": "Malware payload (Formbook)", "value": "a5de092cf0470e6194275e392a955b89bc00535d9180996da2a55b82f8215121", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058282, "uuid": "aa01bcfd-4d02-4614-a2bd-bbe087f390e0", "comment": "Malware payload (Formbook)", "value": "d0a30fccff23810120ea5cae33f7bd8f37b6cc7c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058282, "uuid": "cd62b778-200d-4ea0-9d2d-a5610b5a5b64", "comment": "Malware payload (Formbook)", "value": "d6e05e3ec4858db4577d0f91ff22fbc1f5a9b298b5345e7f1b2f94d060eeb02af170c57e3f1cd4fa962d023db2a2ffc9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058282, "uuid": "c8c9fa02-1f77-403f-a055-6352f6b043a5", "value": "T1534412083F21D6A3EDA647B2DF3E026F7FE4780108681B4B5750670CBB66A92E70D795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058282, "uuid": "22f88f13-b17d-4071-9073-d5fbb379e47c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058282, "uuid": "e3a3e020-4a27-4b74-947c-7334669cc749", "value": "6144:/Ya6+qgoXPxYgRcb5+gDZ8TE/8c5uOSw+kerkl:/YIr2J96x51SbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058282, "uuid": "3b938573-b302-4f7e-9bf3-7446f621aa23", "value": 273726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058282, "uuid": "3b78744c-a623-45a5-9128-dde12c47296d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058282, "uuid": "92ac8625-632b-4261-ab3c-8cf5e620d1e4", "value": "a5de092cf0470e6194275e392a955b89bc00535d9180996da2a55b82f8215121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13e8836-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Kutaki)", "timestamp": 1684058283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058283, "uuid": "1c09c43c-fda9-4922-b5b7-e33b763e9067", "comment": "Malware payload (Kutaki)", "value": "fe87505c13a6a986885193cb177d4607", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058283, "uuid": "b8edb07c-1566-4872-a4e9-7eb5df465a14", "comment": "Malware payload (Kutaki)", "value": "a7f37926eb21924303d17007e8dd4d87c0bb428d1663a86d24d1ca38442ef845", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058283, "uuid": "07b8d98c-52b0-4d51-83b6-4834d31dd1a4", "comment": "Malware payload (Kutaki)", "value": "8d11c69147d8fce75c714d0f7de6a26415facda0", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058283, "uuid": "5f603c91-1220-4d84-8126-171307674195", "comment": "Malware payload (Kutaki)", "value": "154b988780c03dec6e663f41c8f723bb775c8760b4bba1f9df37807a64e33c2c320922e023090617555fe16570729640", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058283, "uuid": "d967dedd-abcb-4dac-9a54-372b2a6639a6", "value": "T1FCC5D0039C5D4A83D42897F4BE034EAC2B163F0DB98236EB55226EDBBD317215C9D52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058283, "uuid": "3e7daa79-f68e-45e1-93c3-b00099db6b94", "value": "d24edab77279df23707d626d3ad31888", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058283, "uuid": "35feaec5-778b-4972-a3cc-ae64d7bf68a6", "value": "49152:hlkWk5cS7a+9XYaQHZehc4mTYJ78V9gyBn4cbfmP/SA8N:3ajJ4Z942KQV9hp4UfmP/SA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058283, "uuid": "c468a81e-5613-4aac-9266-07b571da5e5b", "value": 2539520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058283, "uuid": "f2450692-d00b-4cc7-9187-99008122eda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058283, "uuid": "08fc5243-97be-4f92-af68-4c600dc741bb", "value": "a7f37926eb21924303d17007e8dd4d87c0bb428d1663a86d24d1ca38442ef845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459eef4e-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032709, "uuid": "5e28ca15-c806-487d-a755-326ae72bbc78", "comment": "Malware payload (Mirai)", "value": "e7ec9369a6de1c6e5a7d5d0e1b840192", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032709, "uuid": "16caeee1-03ca-42d9-8c4f-5a44c8e0fa9b", "comment": "Malware payload (Mirai)", "value": "a91d574144ef6e4b5019bbd77c26c9f0a84747c89c18af77d05de8f166cfa9df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032709, "uuid": "fdca5f15-cc8b-4ea2-9acf-5c270df7860b", "comment": "Malware payload (Mirai)", "value": "3717691006201c4fa784f2a95ef4ccc583347920", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032709, "uuid": "c67dee1a-5b6e-4fb4-8ba9-96879db6c750", "comment": "Malware payload (Mirai)", "value": "33e96ab1c7e039add24e654183bbcd97794058e9b73128fe2d355c534171e4bd899197fdab3d6e7fee57f54eebfd493f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032709, "uuid": "afd62ee0-2c37-4141-ad2a-647564262e4c", "value": "T16B233AC4E443DEF9DC561531207BFF329EF2E5FE2254E983D3A86532BD52602A406A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032709, "uuid": "1642fe1c-0742-4b32-abe1-8a9b16df3ca0", "value": "768:8SJQ+oRDNiYEIMN6uu5mfw19dP0naAxl93Eqgm5YGuI8uapopSDD:8SJQ+oR0YEIMymmd6v+CbuI8xpopSDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032709, "uuid": "454bad8d-e623-4709-8f06-b744eb9f48a1", "value": 49968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032709, "uuid": "bdc7519c-d43c-4b36-b751-18911b4e84f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032709, "uuid": "3950d756-9295-4e9a-9ba4-6bae70047720", "value": "e7ec9369a6de1c6e5a7d5d0e1b840192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec4f4c9-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684056480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056480, "uuid": "b2efc4bb-7d81-4cf0-ba85-47ecacbbb6c2", "comment": "Malware payload", "value": "977c9a890f0ab2864aa363a7d1455d83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056480, "uuid": "bac6dd96-f754-474a-a9b5-ffc7b3ea5930", "comment": "Malware payload", "value": "aa2fa1000f9fea03339edf67295dd043806294ec1644e38b7dd08e7d670d5423", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056480, "uuid": "1af3e684-d1da-470c-8be0-f6937768573b", "comment": "Malware payload", "value": "6513907adc294f6a32e43245b0e37f6622e24fbd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056480, "uuid": "0242c453-1384-4705-b9c7-38f9fbceb43b", "comment": "Malware payload", "value": "e378b2d81b3372b2140ee026aebdf3d51a7034a120456f6529524b7de78baadb4e5bff6b2846b204b9737daadeda750e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056480, "uuid": "094d1d23-a637-4475-b7ab-7fb067b0d9fe", "value": "T147A3181D63E830E5E476913989664209C3B2B835132267FF26D0C5BE5F37AD8AD39F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056480, "uuid": "d6b12039-0126-488a-8ad1-76ce869b28da", "value": "f222a63f4b272ad341460e317faa357c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056480, "uuid": "d16ea8e1-08d2-4878-8ba2-edc7dfb4c11c", "value": "3072:UjneREvAttH3OvEErCa0VUTx4r9SSZ6n:UjgEvAttH3OvEErCa5SZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056480, "uuid": "257c5251-25ef-45c7-8f63-542655396688", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056480, "uuid": "cd459499-7673-4146-8691-caebfbaf53ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056480, "uuid": "13664b2d-6cf4-41aa-bec0-456650e5031b", "value": "aa2fa1000f9fea03339edf67295dd043806294ec1644e38b7dd08e7d670d5423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e31e4f-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103415, "uuid": "b15717be-e3aa-486d-aa9c-a4569b9e686e", "comment": "Malware payload", "value": "e553854518e65ad2c00fcc7d936529e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103415, "uuid": "51db983e-737f-4dba-bbdc-2bb2b9a60ca4", "comment": "Malware payload", "value": "aac31540e04134a0b7959fc33aeb903a8c8850eb30b4823f9e3da0df17687e39", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103415, "uuid": "ee3022cc-7a03-4548-b7f0-4a2850a3bec4", "comment": "Malware payload", "value": "f114702d268b1e8d9be198e655d6ea43dee432f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103415, "uuid": "345a7fa0-15d4-4e26-80bd-8b6da95a18ad", "comment": "Malware payload", "value": "cca7c78b71669f5adc94203c8d4b1ca0f3f1f14c2a7b639b7f4560e5beae7a7f61561a8174efc4c3e15c810592685ec4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103415, "uuid": "ef96b64f-de67-41ab-8d40-ba9c21195df5", "value": "T16B752311F5D35B77E2A9013210C28B1E43B59D207B67A851436B7B352EF9AB862B33DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103415, "uuid": "7ea5029b-c42d-43a9-a92a-a0c010182cee", "value": "41d6111748b360082d3a2d64ed8833d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103415, "uuid": "36ed6f7d-4ca6-4954-b757-dfc983b58469", "value": "24576:clnh2Zo3Wi71knXPXDpRO+dHpJQqKoKv+EjJpyvp8OmeyiR9Ynx01H8HBmMiRR:coo3WXXF5HpJQ9Fjfu8NeyqQyapiRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103415, "uuid": "00017645-4ae3-43a8-b5f4-d48667d6152a", "value": 1612288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103415, "uuid": "be9cc7ce-487e-40af-9c90-222831acf47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103415, "uuid": "e55d11cd-2a58-40cd-a5e9-83d2ce5e58fd", "value": "SecuriteInfo.com.W32.Malware_fam.NB.13346.11011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b1704b-f25b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684070872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070872, "uuid": "c0aa5481-8ff2-4b68-8d67-58a839171b74", "comment": "Malware payload (AgentTesla)", "value": "020f986ac3ab78eaaf96c5c3cd1ffe9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "cab;", "colour": "#F26AA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070872, "uuid": "c894a7ca-61c8-48ec-a200-f672ed365d6d", "comment": "Malware payload (AgentTesla)", "value": "ab3a14156bf77a335fa00fddeeb80393948d4ddf79c3b69567cedb1446d2d47b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "cab;", "colour": "#F26AA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070872, "uuid": "4d3bf34f-f440-4597-8d65-b158f27146cd", "comment": "Malware payload (AgentTesla)", "value": "e6868b55afbc3279ae4cd81ae9a9528ac2063b99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "cab;", "colour": "#F26AA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684070872, "uuid": "73b6f4da-3f0f-428b-8417-98f87fdd36d7", "comment": "Malware payload (AgentTesla)", "value": "8c97508b4c0d9cd0c85f76848df4d6f57b45edcea778bf5205dd960ea44cb66727b451b0167edf991f064973bda30b6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "cab;", "colour": "#F26AA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684070872, "uuid": "6636b45d-1cb2-47ff-9ce1-0d5fde39cf4b", "value": "T1B9C42379EAA9C925D0BC76480B540D70C8D430B44FCBCDA25AF3CA2EE1758519B9B3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684070872, "uuid": "1fcd63b4-9488-47be-9550-253222463b5b", "value": "12288:w2UNUXykWdQhHaO9U/5xq0OtpCnXu5AIHh1ffZbvIldVSzjWXWbB:w2UKXykWdQhj9UBH+5IldVUjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684070872, "uuid": "bb9bda27-4388-46cf-9539-dd39161a220d", "value": 556291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684070872, "uuid": "c9d0a9c4-4250-4e56-b838-50916f58fafa", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684070872, "uuid": "a1239afa-0f50-42bc-b0cc-ea45b32e3c73", "value": "202312056738819991.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ff9c8f-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058284, "uuid": "e45282be-2bf8-4849-acd3-cb32cc400c7b", "comment": "Malware payload (AgentTesla)", "value": "e140897b1fd8b93170e97d47b75722ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058284, "uuid": "e35711d5-a0f3-42c3-a5ee-1c119018c593", "comment": "Malware payload (AgentTesla)", "value": "ac79243f3e4c0ed820af9da511c8736fa82b71522ef90e0dd6baab1810160c1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058284, "uuid": "3e9303ef-7484-4122-a43d-bd86be9af3db", "comment": "Malware payload (AgentTesla)", "value": "19c0a1eddff555fa85589ec555389428fa117e53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058284, "uuid": "af8cc8b8-6108-4075-bad4-10455d66e0da", "comment": "Malware payload (AgentTesla)", "value": "6e990e72c331009392650d7fc753185f42108b7d19a6d0017663beca94091829b31a3bc9f76cf588990768c78389c61f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058284, "uuid": "100e2664-3435-49ba-b611-7c5e85ce7d44", "value": "T115E4263D19BE222BC079D7B58FE4C52BF01499AF3121AD75A8D787664306E6235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058284, "uuid": "c344ab41-77ec-4720-ac93-6a7326b61c4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058284, "uuid": "134a677a-9062-48fd-97de-cdd5ffdc9f15", "value": "6144:u1m2lUb5fplLaAK3RiQl28Ovtjh4pv1GcP19Ixz/ifSWW3z8/2BVMVPjeBzkQp/5:uAxlLTORfOlt8vsV/Ms3IebM5WkQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058284, "uuid": "7ce404af-ee42-49dc-8bea-8e3f236ef191", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058284, "uuid": "9c1d1d98-c1d5-435d-a4dd-b839673eb096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058284, "uuid": "f5a8efd5-3ce9-491f-977e-2c4edc198010", "value": "ac79243f3e4c0ed820af9da511c8736fa82b71522ef90e0dd6baab1810160c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9dcfbf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089632, "uuid": "3115df98-78b3-4593-b902-69de88724df0", "comment": "Malware payload", "value": "4c8c98396afb9305534a58b6e801306e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089632, "uuid": "750e2892-759d-482b-a9bd-f0c58ad92e7d", "comment": "Malware payload", "value": "ad3aea2a10807977da5c1f0530769f0c6904e39b33c0c3a4a6a33f7b4dd7f212", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089632, "uuid": "5955c958-f311-4b27-9561-61fb48d92906", "comment": "Malware payload", "value": "e8d0e9dc1d12b73dd613f3d2e1f2161fe7fde9cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089632, "uuid": "ea4d7423-b1f7-4765-8b25-0db584feb188", "comment": "Malware payload", "value": "9c0385cd90a35f38cc89ae9320a7d82e89ad874bbc94d6fd243433f78963805cdc13e49f4c8e4f97189dff611ec80ee8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089632, "uuid": "4dc73a40-889d-4323-a37c-4d456e1ba353", "value": "T1F6E52284B4EC7623E9591830462F9AF725F2FDB61948881B9AC728DF427DF7530312A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089632, "uuid": "a697ed42-872c-42a6-8397-d8e5bab3ad62", "value": "4ecfbe6e42943fae92c4582752c63b2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089632, "uuid": "c934aa63-61c5-4eef-a4c9-0fafb5ba2309", "value": "49152:DlMWposLIqBsOUS8bmacCrkAOmN+S+RqrseNM4Yj+6LfwJKsufaxN4u:DlRF+O38b8CVOmN5S4YeJtufaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089632, "uuid": "fc98cf72-790a-455d-8976-a8aae518473b", "value": 3310592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089632, "uuid": "a628ffdf-7fc9-4fef-b6a0-55caefab11aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089632, "uuid": "a953b878-4965-40d6-b9ca-5e012712f672", "value": "Qp02IFPW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e881e5f-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684055863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055863, "uuid": "96a223b9-7129-4a3c-b534-1b67e1edf02c", "comment": "Malware payload (Mirai)", "value": "b2f350a4fce3ea46e7b849bba0c0557f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055863, "uuid": "632f64fd-9f47-4461-a532-47c80743ed5c", "comment": "Malware payload (Mirai)", "value": "adaf2344e288af931dfd6d400ac3568876e275e77c47b02e04c29d265d9c6ff7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055863, "uuid": "1ca6ee7e-7f58-4983-85f6-17445cc495a0", "comment": "Malware payload (Mirai)", "value": "2b7d3974f7bcef1a277d14f0ff6cc2ba80fb0210", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055863, "uuid": "ea7350a8-ac07-4ef5-9c01-6f59ff61739f", "comment": "Malware payload (Mirai)", "value": "abaec596dfa323bb542361a04561b5ae833fecd60505d136814457d9e848c857148e7de3665e6498860330cf2a1a612f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055863, "uuid": "77e12f9d-f9e3-48da-8860-4160b5ba28a6", "value": "T10DB2E03C1B111F98DA1EC0BE83AC0B113CB81B2591429D4A6217FDC79F978B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055863, "uuid": "3792ec91-380d-4e74-862f-715c128dd7bd", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuidmdtJgGlzDpH7uNj1JA4a:YeD8ZSWvZHZbs1row697qohQvg9ditJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055863, "uuid": "4289ba9e-f111-4191-9051-5dc26c8d4c39", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055863, "uuid": "0735e6dc-99c8-4c22-bef8-e9525f3dcf5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055863, "uuid": "1ec090c3-f5fe-44a2-8013-581f4f6eab39", "value": "adaf2344e288af931dfd6d400ac3568876e275e77c47b02e04c29d265d9c6ff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb33c07-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684055865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055865, "uuid": "255625cb-1af7-4e61-88aa-7bab787706d7", "comment": "Malware payload", "value": "11d433204dd28ee2d275411b70b0c746", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055865, "uuid": "8b5d7673-02aa-48a9-bf68-bd455cd9dfff", "comment": "Malware payload", "value": "af49eebde405cbfeb5003747f48622d2c1292a3eba28b52eaba68532a63d1e02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055865, "uuid": "90f197b0-757a-46df-a4a7-85674a2852ee", "comment": "Malware payload", "value": "fe12fdc873979ec050eb8c2d1e697e2f78dcd17f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055865, "uuid": "85e8b049-284a-4f31-ae99-1e13f18af207", "comment": "Malware payload", "value": "e8cdc6e0f94ebb4f0b50e0c55ec1c693dd8fee08f83b9ebc7a32baa8e45939d485c9f16d44c802ed2327c0437d40dc75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055865, "uuid": "2d56ccdb-b410-4ee2-9da5-d93af368f200", "value": "T130470A27F2908F35C0EE573F819F86409372545A0BA3A7C702D8A679FE8E2E10D7575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055865, "uuid": "53c70df6-2266-4cc7-9362-abfaa9056977", "value": "fdce173ae7d96c9a7c9c46455070f0b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055865, "uuid": "1bd459e9-1caa-4099-a1ef-13eb6e4fc04f", "value": "786432:cxuvcKZwiBF2CBwtj9ttcjzx8xN1RQE5LD4Gp5iTz2oC4inkGt7ZJevVOYPSp8pu:cxuvcKZwiBF2CBwtj9ttcjzx8xN1RQEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055865, "uuid": "b36e25cd-0808-4362-89cc-e7aa620ba1db", "value": 25242121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055865, "uuid": "f157d115-a430-40c3-9c2d-72f049c03644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055865, "uuid": "119e8d08-6689-4a09-b3c7-0bc330818357", "value": "af49eebde405cbfeb5003747f48622d2c1292a3eba28b52eaba68532a63d1e02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d60af88-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684056424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056424, "uuid": "4e7690c0-8449-441c-bced-b2e8896d3ce2", "comment": "Malware payload", "value": "0cd3b5acfab2d6081a2cb48c4c711fd3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056424, "uuid": "73f36e56-930f-497e-8998-217734d19944", "comment": "Malware payload", "value": "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056424, "uuid": "32a57479-1952-4d56-9601-7089ec02bb27", "comment": "Malware payload", "value": "d102a399824aecc96596f8ab584264ba675aed92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056424, "uuid": "e4b38703-9f89-4e51-9ff8-3c6e2966d29f", "comment": "Malware payload", "value": "a30877a2b4be26362517cdfe7e643a06ad8b3dc417da4557dd43d4ea33c5c28f63083a643f80c708193214112dd32a85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056424, "uuid": "2ab5af7d-d3fb-4eeb-bd28-9e190d1004a0", "value": "T16D544B4AB6AA18FDC997C8304A2761766DB074A962127D3F3486EE306D16F301F5DF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056424, "uuid": "98dc4646-13bc-427f-a56d-751475ae268b", "value": "6144:D5yJ6+erYM5N1J7d9v4QAzascPKTS50xr/9dfArs1u5:9qFa31J7dh4QAzatPsS5MrTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056424, "uuid": "8f04c63f-c0ed-4606-985f-ab355e63c0a6", "value": 302576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056424, "uuid": "43b78a36-583f-4720-aa81-c02b9dafdf89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056424, "uuid": "dc1f5a21-9590-41e1-9cdf-2b9946449d82", "value": "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46c4ecf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089588, "uuid": "ef0e5ebf-cf71-4db7-aa6c-8ba6e620a704", "comment": "Malware payload", "value": "c16b7422ef5fdf06cea68f0d7d5e471d", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089588, "uuid": "24e36026-eed0-4815-869c-003820455803", "comment": "Malware payload", "value": "afc460d9d889935946c4a70be3130cbe0f5b4eafc248e3c69811e292ecc5e4f5", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089588, "uuid": "e3ad08e2-4280-41c8-b8d0-36e9501eec09", "comment": "Malware payload", "value": "a41614314fadc2c61f7f3bde68f70235985859c3", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089588, "uuid": "a26de963-0564-431c-ba29-49c1ac315457", "comment": "Malware payload", "value": "ab8b8eefe1f8db0acd4883a98de0e26b3f71d8181030fce05e7f751c1366408aca286dd8cfab3e7f828a87f0f9f52310", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089588, "uuid": "2761c295-7dcb-4e68-bc8d-3aa478dd4fa1", "value": "T132F4125193DA9930F7F36F32AAB610981D273CC02801C5FD2615B64E4D77F448BA9FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089588, "uuid": "c34bb971-11a0-4b7d-9d33-6a5667104bed", "value": "12288:GZR7516QpiCWVltszEQ6YbupiuloIkOKLtU+vDFyXa0z3StjxYnM+DWRlr+:IZ50QpiCqid6YbeBlfdAUcVtj45iRlr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089588, "uuid": "00eaba38-d4c2-4a51-b6c2-106396f48a98", "value": 741792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089588, "uuid": "0d180cf0-f995-4234-b1a1-df95ba58ea7e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089588, "uuid": "b6783333-1af2-4df7-a07a-a1a54dc2b27a", "value": "FakeDoc.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f004844-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684050844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050844, "uuid": "23865251-5b93-429f-8215-bcfa9e91cf07", "comment": "Malware payload", "value": "e525dd6dae654c5f1a4e8d41a88362b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050844, "uuid": "1e47dcd5-05f0-4067-bb37-e6cadca5bd33", "comment": "Malware payload", "value": "b038635a69e3540e00473d5d1987cbdd7448d06ffcdd595c0218b76ae61e536f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050844, "uuid": "b58b51d5-99c3-497e-ae60-db4a95d69a82", "comment": "Malware payload", "value": "df3505ca873513c2f57e4b89bc90d5d8c1ffc3b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050844, "uuid": "b082e2e0-4412-4f6e-be95-c713f8840579", "comment": "Malware payload", "value": "92a9d9ea442a677c8a14660c8348f29aaf76793557d19f43bab7ff2ae78e4209caac0fcb6e5ae5eec9147e6432fb395e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050844, "uuid": "330ce67b-57a4-4ca7-aa8a-1d2f2a661845", "value": "T1C126335037646C3AC2B4E9F035EB2C16B368FAD5C789AE5F2EA0DD0ACF15C17A819C54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050844, "uuid": "ca5269ef-81dc-415c-a1a8-7941a7207b83", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050844, "uuid": "47cdcfa9-7476-44eb-85c7-ae98343720eb", "value": "98304:tiXg33XEAdoWMQH8T1ereaymQ00anBzgd1PVUV/DBv/TmerBTqcHVg49Ic:tyg3EAdogreaymQ0NBzE1eQeFh1g4Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684050844, "uuid": "dc4be08e-4ec4-4beb-9d9e-48926b6e5808", "value": 4507648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684050844, "uuid": "b36fbed9-7a0f-4279-b7f3-76bc81bda58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050844, "uuid": "b1c5be85-f9da-4d99-a4bd-33a1b2cd0bfe", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649bd679-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032331, "uuid": "cd41f0a6-18c7-4c64-824a-4ce73a3c5c83", "comment": "Malware payload (Mirai)", "value": "c6ca07a951ecfc870b92c466c86431b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032331, "uuid": "cdd29fd3-2e89-4377-898f-8a96e23f0e4a", "comment": "Malware payload (Mirai)", "value": "b03e4b5fc01f39df8694d21b3df5a5cb8f4ab80190d3575d0739f5c4cce098b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032331, "uuid": "f53be7fd-e856-4da8-81ac-c7711ed607e4", "comment": "Malware payload (Mirai)", "value": "b8d8201e5a1934cee0daea7de8c067e4a67c7c32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032331, "uuid": "19985bc1-3f9f-4ae2-826c-387e7940402a", "comment": "Malware payload (Mirai)", "value": "640aeb9db5e6ea6410d22816a067e217dc7a282d65101dffc04199d60fa9d8c1636e3dabf010a27999c8d513ba9c1852", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032331, "uuid": "eb2042cd-02cd-4788-b8c5-9f655f80cbca", "value": "T157A2D0257F1DE98FCD37B23886E5E9C693D07D20D2ECC9866741C11FABA36846834E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032331, "uuid": "573258a4-2737-43c5-8d66-d15ed9bb7646", "value": "384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtnISyW:T98o08kxofBE+ZkXaT47C2EpitkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032331, "uuid": "31ebf8ca-abcb-4832-86d7-e0570e2553d9", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032331, "uuid": "77e6b848-ae2e-4884-b110-9acc7c952aa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032331, "uuid": "956ae68d-2373-47e3-82b2-51cdf6c868fa", "value": "c6ca07a951ecfc870b92c466c86431b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b4682f-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058286, "uuid": "b2625d78-52cd-42f0-99a1-5286d2461027", "comment": "Malware payload (Formbook)", "value": "479fcbdb199bec23e2462252380c85da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058286, "uuid": "c10bc98e-c9d9-4eac-995a-75f9c08ea1f5", "comment": "Malware payload (Formbook)", "value": "b075b40cecd6da99c0d8793f49b4f672abbf0e688a818f94e746170ef5fb6a89", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058286, "uuid": "31fc8fc8-5158-4338-a67a-4bc7cd4b1523", "comment": "Malware payload (Formbook)", "value": "d0dd005e10b94e9d3bcceec3976b322e8f455596", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058286, "uuid": "6be63b61-9e9f-44f7-8bbb-6e3a99c0bdbb", "comment": "Malware payload (Formbook)", "value": "9d92e9e2bd58e881116f1a7c4f43b059785fab4e853af040465009ced70a116d8037a39bc53c7ad0efa5092e57306969", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058286, "uuid": "e688e80e-0081-4ea9-92c3-161f5be092d8", "value": "T1FD45383439FA501AB173EFAA8BE479EADA6FB7733B06645D109003464723A81DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058286, "uuid": "a227e9d7-1be0-422e-8dcb-59e52c556dda", "value": "12288:QCqubqXf1KJdcTPIxCjwp4PTHQqExjqiHyZzJUizCbgAKSWJHcq8ZG3ZU8eiyr0t:Q0xp4rf1GoslFHcAXROsbf8yN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058286, "uuid": "b596da29-9691-4989-ab84-1a7dffe5e296", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058286, "uuid": "93f110cc-7827-40f1-90fa-81fbde72fac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058286, "uuid": "82af7259-cab8-40fb-bbcc-194cdc76ec29", "value": "b075b40cecd6da99c0d8793f49b4f672abbf0e688a818f94e746170ef5fb6a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87916def-f22f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052147, "uuid": "5624f7c0-886f-4172-8fd2-a6134cc00dda", "comment": "Malware payload (Mirai)", "value": "bc68ddba392d2c08b0930a93a818b2a4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052147, "uuid": "aed7789e-f0bd-4daf-af79-801b5cf69dd6", "comment": "Malware payload (Mirai)", "value": "b092fa82c44bd26747cd0a238bd1d81029855dc6b039e1ec9e9c9fbe9dac597d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052147, "uuid": "22e71b55-a7f7-4e28-8922-482d6f02b18a", "comment": "Malware payload (Mirai)", "value": "a3a7497db4ed8863e7a16cb16c147d55c40ee4a1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052147, "uuid": "e6fa36fe-bae1-4d12-b77e-75e0c57def70", "comment": "Malware payload (Mirai)", "value": "959c3f02063888edd7ae9d8bfaf1d05d8e15fbd5d19b7f5652417ae8f618791a45da2175fabf4d4e3a23bc83ed81d32a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052147, "uuid": "3730f871-4db3-4ded-9532-27f5a8f00d8c", "value": "T114631817F94281BDC09AC1740B6FBA3E993274EE0239F2B677D0EA273C56E610E19D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052147, "uuid": "de0293a6-f276-44fb-ba17-388e7b2b668f", "value": "1536:13lyQuesvLStsi789nXRhPtx1RtL1CXr/0L99rWZVbqeNNMN:Xytes+Sw+nBZX1Rp1Cb/63WZUeNN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052147, "uuid": "489a8bef-cdce-416b-942f-f549e41af18a", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052147, "uuid": "fa58b47f-4579-4d38-b3e2-5a82707c083c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052147, "uuid": "6d910607-6961-4b70-8751-40ca524585f6", "value": "b092fa82c44bd26747cd0a238bd1d81029855dc6b039e1ec9e9c9fbe9dac597d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1918e3-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056426, "uuid": "3f82e510-830d-49bf-9642-b6164c52ea1b", "comment": "Malware payload (KmsdBot)", "value": "9e6e3e8e9b8d52ee15a27ca522a2dbee", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056426, "uuid": "0031a54c-b0c6-47f7-9f38-9875bbeb783a", "comment": "Malware payload (KmsdBot)", "value": "b09a3c2922ac519e76718c56763e39aece82c18556039be8547b166479f35555", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056426, "uuid": "a0cc9a74-311f-4e8a-a9e9-7ac19515b681", "comment": "Malware payload (KmsdBot)", "value": "3c7727934630b53de579f70efa1ab40399be57dd", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056426, "uuid": "65c6520f-33df-40a3-8467-87ae007db114", "comment": "Malware payload (KmsdBot)", "value": "b2b791d147592be79e486f31850e0eee8065bf2a381370c3306021f65dcad32c7b326f73fed9029355965feb89706c4b", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056426, "uuid": "ab8c47a3-a98f-4ba3-8b8b-989748274ad3", "value": "T1A6365C01ADC26B76C2DC07B085FE539963603E4856D1172353E8EAA83E7B73DAF564C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056426, "uuid": "f14ee0f9-2b29-435b-b60e-48c300c4c598", "value": "49152:7zMyd5Cn/1EXZgAqBe7+UM2bf7F1Ne/wrn4QA4oBGANlUxZs0:7gSUnR/gnMG8qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056426, "uuid": "b6d3999b-f3d8-4d33-8db5-dcf178a44194", "value": 5206890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056426, "uuid": "4b4eb056-8b00-4923-a72f-a2f87daf41e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056426, "uuid": "28e8eea7-825c-4f1e-9414-2c0debaa9dce", "value": "b09a3c2922ac519e76718c56763e39aece82c18556039be8547b166479f35555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a14cf1-f28b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684091741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684091741, "uuid": "f5d60bc0-4ef1-4839-9874-1fb030377301", "comment": "Malware payload (Loki)", "value": "c21f8d352d2afd341355721a5f12f288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684091741, "uuid": "fe630d2e-99d8-41a5-b609-20164a1ed26d", "comment": "Malware payload (Loki)", "value": "b0e9ab8722211e906494335f94c75e0b7ab1bbd53b2b036e0b316daa11c0e7fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684091741, "uuid": "dfb519c6-f778-4d2e-aaab-14bb00941f9d", "comment": "Malware payload (Loki)", "value": "39bcc6535cb57b87f1a6074408b1823b8cb5e698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684091741, "uuid": "0ae5bbc3-6cc3-4e24-82a0-3eea8a38209f", "comment": "Malware payload (Loki)", "value": "adf844a00ffed9cbebae224f45dff6ece22d4c5344a06ffda3805d7ea2de1b4a9a207f8857c3cf0004e842d518d366b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684091741, "uuid": "6072d55b-3297-4439-b717-1ffb706b16c8", "value": "T1C455D0B26E8AFDE7ABEC2D54D8B2256C0C403E779358D0F4FC885A8E19A4614DC59CF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684091741, "uuid": "29a3e31f-f9cd-4cfe-8b06-d5f1486e3fc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684091741, "uuid": "b870c74e-1d4d-4c39-aeff-c07db796385c", "value": "24576:eCtDtoThLb5+pUBYf1hHsg20qKTCDiFg9JlN6UICNpJ+4zcCDdqkTzhjuBz2Wc:B8jqQKTCuilYEzcCDdqkTzhjuBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684091741, "uuid": "2834b1df-5ff2-4b08-8991-ba03d9f41e43", "value": 1311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684091741, "uuid": "1b9992ca-04d9-4526-ac9f-af7758e0570c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684091741, "uuid": "85a1d855-79f3-474d-b03b-6815768a580e", "value": "c21f8d352d2afd341355721a5f12f288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef24092a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "54b5c3a1-504c-4911-9fe1-015307d07f05", "comment": "Malware payload", "value": "aeccba3e22db4978ae4e754ce940568c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "02f08aa4-bfdd-44f9-b5a0-fc2834d6a5ac", "comment": "Malware payload", "value": "b133fccfd54e62681e3549c6947ca1521417745cc7f376c362ba118bcc0de39b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "5329f6cf-8160-4e11-aa00-1386bbab4aaa", "comment": "Malware payload", "value": "33ad5318f81e93a19a88c24696cb0cb898cc8f55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089687, "uuid": "f4b7ceb4-a6fc-47fc-9484-dd68d28aa59b", "comment": "Malware payload", "value": "06ecc2309876bc29ca07cd14a3d453ae8ce4871bc50f8814293a7fe8af77a208fa957d12d83f1664240efc09d7406683", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "15cc86e7-55cd-4152-b614-74fd762d0bf0", "value": "T10C94820C3A66CDF0FF7E15FDA8614B404B3AB9139608561A1FED84D90BC768E8F454EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "4b8536e9-f8ac-441e-9cc3-481947cc5c1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "445c997b-89ef-4bc6-bbd6-b5ab7bca58ff", "value": "6144:hmT6yZ/I+86h8sm3bXAPEkkF1eAsg9bUzQ+0gmJ5bHc:hm9k6h8gPEkK1eAsbzQ1gmJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089687, "uuid": "75f4090d-f893-4be0-ba29-0c034ecca5df", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089687, "uuid": "de7eb853-438d-48fd-8bd4-bafde3cec2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089687, "uuid": "3faf03af-2c18-4c37-973d-a5c7c9f3a5fa", "value": "socialscrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd46f38-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032721, "uuid": "10a20d1d-4092-4fdd-8121-7451a6ad5c83", "comment": "Malware payload (Mirai)", "value": "712ec0c43e82cf0849801202c3ac173c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032721, "uuid": "198237ec-1499-4ceb-a422-f09d20e8204c", "comment": "Malware payload (Mirai)", "value": "b1385dcb5d270ed0d9e652f232529acf50b512bc5228985c2c92acc82c3014ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032721, "uuid": "42e4dd9a-6d07-4444-9afd-791c844b8fba", "comment": "Malware payload (Mirai)", "value": "1e1e8658b8e1502417d10eec56c1ed5b0ff24471", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032721, "uuid": "68c20b8f-2a93-4cb6-96aa-4ddeb8851752", "comment": "Malware payload (Mirai)", "value": "ce97c42d624783979b3acb6cdd5018c8cf3a6ebbeea7f18e119ce45a7311a5cab623dc4fb8ed4d0d6af2b0ff7bf8bf0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032721, "uuid": "c9a93507-6daf-4a97-a04d-d45c1365be68", "value": "T1DC63E756F8828F11C8C5127AF92D158D371317ECE3DEB2229E106B6477CA92B0E7BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032721, "uuid": "1421ab06-50e5-4889-8af2-509ef9495e3d", "value": "1536:uJn+5+CQa8NM0c9AJMUx7bTVZUQOskjzAIXi4cHykyOA:pYCH8NG9NEtuBpOykyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032721, "uuid": "3f218dcb-7778-41f5-83dc-7c16271141d0", "value": 66868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032721, "uuid": "8cc627d4-7fe0-402b-9a72-4e3d022a4217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032721, "uuid": "12c33b1a-02ab-4665-a15a-81d40a8cefb4", "value": "712ec0c43e82cf0849801202c3ac173c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c878a33d-f262-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1684074160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074160, "uuid": "dd159626-c6ec-4d47-ab37-00eeb8f7b529", "comment": "Malware payload (NetSupport)", "value": "bcbecbffd44fe370c09c287c4e5bf468", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074160, "uuid": "6a06e1d4-486b-42e7-986f-6395d194f06b", "comment": "Malware payload (NetSupport)", "value": "b1e216ae1f56cc54120fa85b9ddbcf263b20bd113f8a3c3950ba7e8ffa7dbd6e", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074160, "uuid": "909297b7-1f03-49d7-8d49-aca5a6804b31", "comment": "Malware payload (NetSupport)", "value": "cc2293c8a147b27cd16eb01a35367cf5390c2292", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684074160, "uuid": "36a745d5-43b2-4a6f-89a8-2b90f42f197c", "comment": "Malware payload (NetSupport)", "value": "8dd7f49d51ce53b1a7b3d6abfa7cfffaffeb7a68c717d538684c8965987a54d886161143c3160925cc32ca384294f4af", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074160, "uuid": "6e7ecb55-abdd-4eac-9022-90aad02e741c", "value": "T15ED2EEC826E3A012972BF17E766F9CC0E16548575BC4690BB90C7254FF99C3CCAF0A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074160, "uuid": "f29e6d25-f09e-4259-9a1a-f66cd9c94045", "value": "384:9/qm/IlGvFj+Rqa/tHF3kAfve90G32nG0qvqfZF9Y0mSydnj2Uf:YzCY1Hd5+9f3mOvu3YHKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684074160, "uuid": "59d8452f-a64d-4b4b-8636-e34b93c95678", "value": 29104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684074160, "uuid": "70cc6e3c-757f-43a4-9e23-62329ced0a30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684074160, "uuid": "925caf42-1a94-4ba8-ba9f-cdcf0fa4b0ea", "value": "3199683_4229061_rechnung.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350d53f8-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032681, "uuid": "530e1522-cef4-419e-9c1a-d8484534015b", "comment": "Malware payload (Mirai)", "value": "3f51c9b3e87f40c877d5d1a7f9210794", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032681, "uuid": "074cd0ab-54ce-4ac4-a0cb-c456702af518", "comment": "Malware payload (Mirai)", "value": "b2ae8b40c001ab5f50d0d589fc5fde70705bc09d3e7601046383a2f15aa80348", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032681, "uuid": "c465f07b-a8a1-463f-a664-939a6f63f067", "comment": "Malware payload (Mirai)", "value": "173dda94b7fa4ef0953f7028c0e419c075eadb77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032681, "uuid": "2c18788a-6e7b-4c12-854c-d141f2f52e2c", "comment": "Malware payload (Mirai)", "value": "3d867d042e10841b0e1a78a7b89c12984d8fc88cd35f8b7fcf2b95245bd2ee3ef17023210798cd668e22923dec626d25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032681, "uuid": "d760bcfa-5215-4dc3-8bc3-dc69cb201e20", "value": "T1FF4329EAB001AE2CFC5BAA7E54060E0DF92173A112935B27A3B7FD936C332645D17E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032681, "uuid": "0d23c5eb-76e5-447f-bb49-853f4f8045e3", "value": "1536:8FdY5gVNkLzWMbdqNvfrn2swaVKF3299Lr2d8y2:8FdY5gVNkLzt0C38KF32Lr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032681, "uuid": "6dde05f6-75e7-46ea-b7d9-9035fd3c6390", "value": 55328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032681, "uuid": "9e0cc2ab-a7dd-40f0-baf6-8f5ec23e8060", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032681, "uuid": "d2dbcf49-682b-4362-820b-bcd237fddf63", "value": "3f51c9b3e87f40c877d5d1a7f9210794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcdf0b2-f222-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684046550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046550, "uuid": "ebec2a05-c4c7-47d2-8802-4093f0e2b260", "comment": "Malware payload (Mirai)", "value": "b8d6da8b90ceddd68711bd48291882ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046550, "uuid": "450e1172-db2a-47e0-8fdc-5457cd1e1690", "comment": "Malware payload (Mirai)", "value": "b35bd0bbddf49aa3d5155508ab1ea8c9144902b7b45ba449d0969ba488ed7c9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046550, "uuid": "b80bd8a5-9f4d-44e6-bb4c-971ab73882a0", "comment": "Malware payload (Mirai)", "value": "baf85e14935f0db5a76357be724c366b89dcd8c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046550, "uuid": "c22ce96b-52b4-4738-8c54-87479f41a09e", "comment": "Malware payload (Mirai)", "value": "fb039e480a6cea829f7036afaad0fbec5acd33f57d57457970ffc3a24d7160cc056992c4cf1426bda33d2285268f5428", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046550, "uuid": "a55f650a-8096-4ff9-9f88-7ad19bde045c", "value": "T19EA2D025D305AEF4DFEF9D9452C2C2C276E542C6238AC8F240FEAF012916046FB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046550, "uuid": "39e53e7f-b9f0-4261-bfce-464508de414b", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5LM4uVcqgw05VxJ/:mRxsSVsMD6xiJJE5zRWNi4uVcqgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684046550, "uuid": "7d685f02-bd89-4784-a449-852162fbfca9", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684046550, "uuid": "660003a7-a189-450e-a25d-da9917b0a6ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046550, "uuid": "aa547274-39f7-4a8d-ba11-51b6a15f8c3c", "value": "b8d6da8b90ceddd68711bd48291882ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8580ee0-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066858, "uuid": "bcee3b8d-dcf0-4839-8cdb-0e4eb3c5c89f", "comment": "Malware payload (Mirai)", "value": "709688d14dc5e37f59b77357e6cbb3e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066858, "uuid": "828499f1-2dc4-4d46-aec6-1519bde08958", "comment": "Malware payload (Mirai)", "value": "b534654252304b2779b2fe5b87559bc1fd05c8d9646a280b1890a957d8aba464", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066858, "uuid": "0d6e06b3-24c1-434c-9986-8c4ecb30febe", "comment": "Malware payload (Mirai)", "value": "6b564861a54870ed8a08e52d30591a4698266d3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066858, "uuid": "6f0ccc5a-ea1e-461b-b35a-681adea57c40", "comment": "Malware payload (Mirai)", "value": "b909dce80af0b0e94288e3f3118d7d1d054de1107bc1284e3a5a9a22045b5d7d381ed5d830d27c53b2a97abb9d3a4241", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066858, "uuid": "bd2e1649-ae14-4fa2-9358-e0bf1a9bf0c4", "value": "T158B2C0CC61543084C68D7C7C578D4A665F6CA1D0BAEDDF16E350CD98B3B9A8B3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066858, "uuid": "4e22f7d9-dd39-44e0-a62e-d39e023e5dea", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpdZqSWvO:4QlS07FUXqIYSXQKqujqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066858, "uuid": "63d363e3-ecd1-4396-a726-a23b67494e90", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066858, "uuid": "265c9cb3-8e28-4a60-9d73-957f0dc0448e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066858, "uuid": "bbe090d6-e03e-4210-aea7-002d339c09ef", "value": "709688d14dc5e37f59b77357e6cbb3e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edd5527-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056427, "uuid": "be018f9d-c4e3-4d18-92d0-469424665a1f", "comment": "Malware payload (KmsdBot)", "value": "376c47cf659f00694b91ce544f643520", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056427, "uuid": "1b668f53-b870-47dc-b007-11eb5c293c31", "comment": "Malware payload (KmsdBot)", "value": "b5eba1e7403e64559cfd40d56163ac31f3100d5e6e46be8fbb190cb82905528b", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056427, "uuid": "bbabe0b6-e133-45ea-96e6-53024ef945ab", "comment": "Malware payload (KmsdBot)", "value": "37d1e6c22b479c63936c4acb43f3a1c0bb326973", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056427, "uuid": "8f956cd3-8ad1-4540-819b-56e1b16c2bdd", "comment": "Malware payload (KmsdBot)", "value": "867b9ea7d5b31e4ce245fde9db6721745cbd16134a0e5ccf54e0c4b0305564250af9bd1e6d21a69d370105d2ca565c4e", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056427, "uuid": "0cd41eeb-582e-4124-bc23-5ac5be766ebe", "value": "T15C367DC1A710906FDA4B177244B38BD0BB116E42C7E49A5F370A276F06F36E79D0AE94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056427, "uuid": "90a07365-c95e-4c79-b8f6-479f3155f085", "value": "98304:uBUzZfDcgP18168LSlXjpWxkSlSGqeExsl9SK3iXk:uBqdAgP1rpp6kS9uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056427, "uuid": "ebfdf819-e9f7-4171-80fb-1ddb2b0407e6", "value": 4901230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056427, "uuid": "fa923168-2dda-420b-9089-530f67436d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056427, "uuid": "3c21d509-046c-4282-a93c-819062df57bd", "value": "b5eba1e7403e64559cfd40d56163ac31f3100d5e6e46be8fbb190cb82905528b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35f7e8f-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058287, "uuid": "e0c1895b-527b-48d8-a504-de5fe4206ea1", "comment": "Malware payload (IcedID)", "value": "14ff82941d613d69a93e758b3293a18a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058287, "uuid": "7577fe06-7342-4462-9896-150eddb439b4", "comment": "Malware payload (IcedID)", "value": "b665306250d7f6ba89596bd331003b8e5d7a4d4c52d4bd55343b975808a6a00d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058287, "uuid": "206b96fd-b0ca-4792-8a0e-ca25d9c8d714", "comment": "Malware payload (IcedID)", "value": "190f9e42992277149b8ed15ebc939ae804d14688", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058287, "uuid": "963bad65-737e-40a1-b5c4-83d102f07d80", "comment": "Malware payload (IcedID)", "value": "58d5431c277df772b66993d668f1713f5dcb25840b913b73e479e24a94613d259c8b19c7a3f454fecb4d9e2c51d45cab", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058287, "uuid": "fde2b30a-aeca-435d-900a-f467d51cfc2d", "value": "T190D4AF06F3327C96E54BD73785E45CA64F7EBD2D2725C74C0A4183323A4A2E89C613AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058287, "uuid": "f6852a6b-ca51-487a-a54a-78a15883f194", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058287, "uuid": "5cdd8115-2911-4e79-9dee-db2790f7b249", "value": "12288:wH8lHtg1MJu879Yj3wraaW43fofL0OtBgUoHTuZgy7Z:wH8lHtg1Qu87aClgJ+HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058287, "uuid": "55a66133-aa14-4eb7-964b-612ac5ab2875", "value": 620640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058287, "uuid": "3a7155d2-c27b-4f20-b7f3-0c271d7e08a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058287, "uuid": "13138c46-ff3d-44a4-b86b-8b4ab7bfebb7", "value": "b665306250d7f6ba89596bd331003b8e5d7a4d4c52d4bd55343b975808a6a00d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40a427e-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058288, "uuid": "89134bb2-6fb2-443e-a6f6-199ec51f7449", "comment": "Malware payload (Formbook)", "value": "863b6d5c2e0e9faab0726e88694bae05", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058288, "uuid": "2e0de594-9dd7-40ab-b219-3168b2298a97", "comment": "Malware payload (Formbook)", "value": "b6beeb071936a3309a382471d88fc0247eccb93f1889b897eff0901019902cc5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058288, "uuid": "10ed0777-e593-4273-8c9c-6a0fba7deeec", "comment": "Malware payload (Formbook)", "value": "1adce6611fe8ee5fbc0071c2d8a310a401b47c3e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058288, "uuid": "4348536a-7a8f-4606-a3b5-0e370a05ca35", "comment": "Malware payload (Formbook)", "value": "30200d1a3f449bc73ba2daea81d6ff274268186e3c796ca1f3eb8c552d07c5c85aec85f792bc67cc8112e40408a0b138", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058288, "uuid": "25828fdb-66a5-4072-8ceb-1c01b291f6a4", "value": "T1E8F422243A54E73BC63F4FF3156B56260372A99A6893E37C49DA65EE1833F08C441B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058288, "uuid": "5d0d4783-da58-4bf2-bc6e-764001487c1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058288, "uuid": "4bc7c7dd-55a7-4454-916d-28d9e0110d6e", "value": "12288:Q5CBWKdq1FbwwJLwrnSSKZ464xycj15yWkzBMWZuHsyitvhE+w7Q5A3q7+uxl7s/:zfrpzx964Ew15+EsychEL02C4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058288, "uuid": "aad6c1a2-cadd-49d5-9ca7-e6ce7708b661", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058288, "uuid": "1beda1c9-e5cd-45a6-88c5-267ac2d58067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058288, "uuid": "5d8fe30f-d8b6-4b0f-947d-006619273044", "value": "b6beeb071936a3309a382471d88fc0247eccb93f1889b897eff0901019902cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028bdda1-f1f9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vjw0rm)", "timestamp": 1684028731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684028731, "uuid": "1c707d3a-663c-40af-8024-158ec44ad5b0", "comment": "Malware payload (Vjw0rm)", "value": "c159fc653a86ef3eab80e5d06b9cfa2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684028731, "uuid": "00e50ff9-72ed-48a2-b114-0f251757fe4f", "comment": "Malware payload (Vjw0rm)", "value": "b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684028731, "uuid": "0974db7e-17b3-4868-aea8-ee14d0b7fa19", "comment": "Malware payload (Vjw0rm)", "value": "f95b35bcd8528dafda2b8fd53bed2bab150676e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684028731, "uuid": "3174c770-0029-44f7-a721-edab6b0af6a8", "comment": "Malware payload (Vjw0rm)", "value": "0c718dd7f8c41027a9ee469bab9095686d6f9de3eaccde4fcc5dbe644073e8617c0259a2e90e6f61ed78df4a463471aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684028731, "uuid": "36498046-2ce7-4e66-bdf9-3dae5c8221ff", "value": "T1BBC4772828AF516DA177FFA13EDC7DEADDDEB6632509641B1042030B4A16F81EF4293D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684028731, "uuid": "f85d77cf-dcdf-4e97-89ba-4ebcb4e18051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684028731, "uuid": "58244edb-bf89-4aa5-80c9-952d0f4a3d7f", "value": "12288:lBXSh9d55EWf6bkHXgtQZDsfDfWXWBt9ExkUp8ZbcoahOOufKlgc+ABeaESJAzEM:7QZQz8Du4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684028731, "uuid": "17caeab8-126e-411d-a502-d3f4d4d0d8db", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684028731, "uuid": "da48f67f-0f3d-46c0-b096-d49957997265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684028731, "uuid": "e1a269d6-26b5-4c54-a14b-758ba4c289b7", "value": "c159fc653a86ef3eab80e5d06b9cfa2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d895d36-f203-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684033259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033259, "uuid": "05f0db28-22c9-49db-91fb-61559e7da8da", "comment": "Malware payload (Mirai)", "value": "2f62ba3068f05f9615780d49918b1cf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033259, "uuid": "bfa0ce70-d8b7-4068-a956-65bdf7f08d06", "comment": "Malware payload (Mirai)", "value": "b735b4f5b00d950c5ebba4d86bc6d0ad3c4119f0de611e6902d41926f67dcfb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033259, "uuid": "23db8657-9b70-40db-a2da-0386ae3e47a5", "comment": "Malware payload (Mirai)", "value": "a2ba5e110991c8d380e7da0e0312202a140141ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684033259, "uuid": "c380bce2-a2c5-418f-a0f9-9b6a4fd49bcb", "comment": "Malware payload (Mirai)", "value": "63f0990897da0c7c010cf2672b66b1b277967a0c53999adf464d345479dc4a1f0538259ff8338738f46222739044ed59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033259, "uuid": "93ece4ce-646f-4af9-a7e4-8fd81634bbc4", "value": "T1C32308C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033259, "uuid": "0a16b828-e388-422b-8bf3-071971c14d14", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AG+1pa/4Qw7bn2ige:Gv4QPfZfW5XTOeoEzG0AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684033259, "uuid": "b73bd2e1-c344-4756-8fde-4a63b0d08253", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684033259, "uuid": "b7a102d0-6304-4e66-aef9-293eb028f095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684033259, "uuid": "e79ed69d-f224-4ff3-b4c2-80a988fe370e", "value": "2f62ba3068f05f9615780d49918b1cf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8017389a-f1fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684030230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684030230, "uuid": "f0cadd8b-d8b6-4d63-849d-2d2e295ba166", "comment": "Malware payload (RedLineStealer)", "value": "4fda10dd689cf07faf7ccad6eeb5b8b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684030230, "uuid": "47e315ae-bd71-40d4-b3e3-684423a97850", "comment": "Malware payload (RedLineStealer)", "value": "b817a846c29751d233ca7a1ef7882ce22f13e7a60e9bf364c7cf74a2a6b390db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684030230, "uuid": "4a15b867-7537-467c-8d2f-1a544d9f54eb", "comment": "Malware payload (RedLineStealer)", "value": "c91f516d5edf7f4d88e8d0d22ad9f454240a1fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684030230, "uuid": "0cb2b89c-efdd-4bdb-aece-fdad9054f11e", "comment": "Malware payload (RedLineStealer)", "value": "2f9e594cb9c3d846f0299e9e946db4fdd7568bb91094ce9403d1c13e0a8aa0e6a10f7ae500d7b660c5ce7a848ce1351a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684030230, "uuid": "1994c7e7-1823-4b76-8117-cff570e636e0", "value": "T1E0D33AD973886A9ECC6E897094750C28C7F0A0576207E347AD47F4EB6E1DBC29F191E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684030230, "uuid": "104ee5d8-bf65-429c-95fd-60442da784ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684030230, "uuid": "1f20b8d0-c627-400a-b27b-3b43309f9bad", "value": "1536:ZDBWgzc6p4x9s9BB3Sm1xRCh4V5KbVb7d1jpUsYgibfbFDKsRo:ZYgzc6p4oTLDQ43+xB1jpVYgafJlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684030230, "uuid": "2ded3135-8473-4331-9978-d2f5bc9f0319", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684030230, "uuid": "9dd7cf0d-ded5-4feb-96f1-a0eac6664eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684030230, "uuid": "085344aa-7963-4cc2-85d1-55f03ca2ff75", "value": "4fda10dd689cf07faf7ccad6eeb5b8b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aef98d8-f288-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684090163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090163, "uuid": "ede9d46f-0927-40b7-931d-0015261e02a9", "comment": "Malware payload", "value": "326a5545668fd1c0a1dc1e5331bc8d7c", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090163, "uuid": "d056babb-fe49-4d02-b7bf-01c35cc8e488", "comment": "Malware payload", "value": "b848fb7a079922ff2dbf48e8a01c9b9cb97c240f746d496da46dbf732b548553", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090163, "uuid": "c2082ff8-893a-4cd2-b215-e0c93ff86564", "comment": "Malware payload", "value": "5e81b44b9e35029e08869a455f4dc81960a156e2", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090163, "uuid": "23eb076b-c3ec-4445-9660-8e425c9253ea", "comment": "Malware payload", "value": "18fdfa1d9ff4abb853dc3714660415731bbf3f3015cc2c88c8ccb35c0e9b34d88b1eadc4d40502c4ee424281d79cc892", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090163, "uuid": "1a82895b-9a9b-47c2-b5e7-0de1e2a210a2", "value": "T164157EC08C77619B7760D30E5F81BD81F1FC53923096D494FA9EB1C4DB2B0664AAF82A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090163, "uuid": "3be4f6a7-8f03-46f7-bba4-5ea43ada193a", "value": "96:QD/0Og1GRQYOwBZDWAszk7XasRHzw/0REn8Mog5d8sthPSpuuhWhPoXNlV:85g1QJ3ZOSz97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684090163, "uuid": "32c10bdf-c155-4a61-8daa-41c673e2651e", "value": 945074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684090163, "uuid": "b99341ad-1013-4022-93a0-6de2a11c4954", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090163, "uuid": "50eeae50-1178-4716-a909-44f16f131826", "value": "999.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb27132-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056428, "uuid": "2e7b13b8-b7e7-40b8-bc9d-2cfa7ca28571", "comment": "Malware payload (KmsdBot)", "value": "a95b9b0a594bafe686491d40fe9c5a7b", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056428, "uuid": "ff809691-59c1-4645-95ad-361935f71d6d", "comment": "Malware payload (KmsdBot)", "value": "b921f0de63ffae2865f5e1dbe8a52a1da505c902e2e4e2a96b85983029d311b5", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056428, "uuid": "cc61133f-72b4-4ba4-8175-0c94b1ad34d5", "comment": "Malware payload (KmsdBot)", "value": "1efaaaa9ad6925b0be146748ffd08ba37d86d88c", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056428, "uuid": "d7a2d241-5242-48d0-8af6-afa05a033650", "comment": "Malware payload (KmsdBot)", "value": "2a4bad0bad1a43c61111920a10cda56fda84a3fb0aec7e28dbef5c575c97a024ebf03a85ab3ebe28186237fbf2d4f61e", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056428, "uuid": "d8e6e72e-a0f8-464a-9ba1-a57fbdc94528", "value": "T10A365B14ADC02BBAC4AC4B7498F6CB9613B09D0447F157362694EED978A63787F839CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056428, "uuid": "a79e4d8d-67f7-4a17-8fb6-502fcad0213b", "value": "49152:v4abydn9CLIyAzgiL9qBEVhhQcRrF1XskOKA4xZ5QVbv81KqvTj0n4Nm3+R:ZGvLKWDibnqvTwEmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056428, "uuid": "eaff10ef-582c-4725-b9ac-c7db3618148d", "value": 4869529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056428, "uuid": "5f2b247c-f710-4867-a7d2-d9575d21518e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056428, "uuid": "0c70da51-c81b-450c-8f0e-11fc762016e4", "value": "b921f0de63ffae2865f5e1dbe8a52a1da505c902e2e4e2a96b85983029d311b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606b99bd-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089018, "uuid": "e2e43025-eb9b-4a0b-b631-80091f256133", "comment": "Malware payload", "value": "dca5095bcff122ec518f4d1c8d9eb191", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089018, "uuid": "72ac89af-1617-439f-8e3b-a73b11a028db", "comment": "Malware payload", "value": "b9f17eb68663546196a2147c19e6309a752064fc842ecec9567b32cd49cebad3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089018, "uuid": "249deec7-5c7f-407a-a2c4-70ba1702f1d3", "comment": "Malware payload", "value": "a1e806459d6c80cca53cd11141bd504b4ac23063", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089018, "uuid": "f8c72b90-4fab-4f6e-8951-fbc1cd0b92b6", "comment": "Malware payload", "value": "8fc90074ece3f1d14f824c96f25a6f1627db5dcb1a70b9c485e1e6ab88850a6110ecdef68467ce158f651c3d1900953d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089018, "uuid": "82717c13-808d-439a-9f1b-82b777b75a1e", "value": "T19B452302E7ECC0B6F8B5777444FA16931A337E77596C52632B06AA9648F32C1A532337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089018, "uuid": "361c4b5c-730f-4e97-a054-62770b08242b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089018, "uuid": "e9ddfb64-9235-4695-95fd-6c0fd4704743", "value": "24576:xybxOyKzxSI6OhHeQ6y5EEbyIA6KJ3A1XLrh1cIXTr:kclxSpOhHB5lGHtJqnXce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089018, "uuid": "99561755-7a17-4465-b3eb-54d84da957ed", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089018, "uuid": "678a38bd-abb8-4473-a6ea-958e618be0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089018, "uuid": "6019d207-614b-4343-a7e0-40b47bd91401", "value": "b9f17eb68663546196a2147c19e6309a752064fc842ecec9567b32cd49cebad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e8b465-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032741, "uuid": "3f8c450e-3059-4d81-a19e-598c227c1cbe", "comment": "Malware payload (Mirai)", "value": "0c9d88bd920a172f717625c921b5d738", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032741, "uuid": "2bc9e7b2-4d4a-40e5-8821-afed26e629c3", "comment": "Malware payload (Mirai)", "value": "ba0268d8b516f5081eba4e26f0eed52c0ce16ac3fc8146dc183d603e20806a1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032741, "uuid": "aff9e4b3-a59a-40b0-bb1b-9d97a5badd9d", "comment": "Malware payload (Mirai)", "value": "8b02efa45eb166f7f151c469500eaae27f1f10b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032741, "uuid": "1f712a51-4c21-4c88-9b71-d9ad29737f98", "comment": "Malware payload (Mirai)", "value": "bcd8ccf6e513b747d0e20852d4a5a029121b3c7dd26cd2e4c36bf6d069079f5b2e1b601088df342de56c38a3cb8817d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032741, "uuid": "44c98ac4-7e08-496b-8620-1c585deeb40a", "value": "T1D3B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032741, "uuid": "dd53ebaf-fb27-4ee8-84d2-ae1e1d79d605", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1v/LWy:c9sSyzz36YaWWgg1vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032741, "uuid": "37995562-9076-4c81-9b16-3409ac585382", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032741, "uuid": "a7f36701-7993-4211-b5b0-4fd94a6f18d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032741, "uuid": "a3706354-c502-4c39-a71d-a28f2f604fb1", "value": "0c9d88bd920a172f717625c921b5d738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6116b603-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089019, "uuid": "af604341-174b-44a5-afe2-0aebdce90844", "comment": "Malware payload", "value": "3c5b5839f471dcce81a8bdde7d9ccf83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089019, "uuid": "b77bf1a7-3393-4d07-823d-ef65f026d173", "comment": "Malware payload", "value": "ba3f48f7f8cf0aa6e8a2afd4b12930f6d4731cb58d6cbdd8c70b4a5dd78f21fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089019, "uuid": "157bd20b-d993-4e30-967a-34a968af9948", "comment": "Malware payload", "value": "d446ea35d603dbe5b5f80afe49b1297011713c72", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089019, "uuid": "61fef0da-ec81-4129-a5c2-33764e2b9448", "comment": "Malware payload", "value": "d10919170a1faf2d3edbf295354bf385b41444b2a6682b644c14735d412387c9ac6f8b47e274f22567646af18f4d1967", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089019, "uuid": "c58daa35-8817-425d-90ca-a9fef0503f90", "value": "T1E745230B67EA8433E8F9677548FB13931A397C615A38C36F1B45588A2CB36D1B53133A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089019, "uuid": "9237d294-c17c-4f66-9202-cccff1cfaa6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089019, "uuid": "aa7deb62-5fa0-488a-a232-5f093743259f", "value": "24576:Cylgno1gee+wL1z0OHq4jefS9AXiS7Fnt3mVqJ:plgnf+wL13KQ9AX/b3Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089019, "uuid": "cce71d90-d2be-4a05-b8c6-685c06bf5ca8", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089019, "uuid": "f9eda5d0-e95c-44b4-9736-ffcf55e2f331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089019, "uuid": "fbff50f4-200d-4a55-ba02-30271d5bfcb4", "value": "ba3f48f7f8cf0aa6e8a2afd4b12930f6d4731cb58d6cbdd8c70b4a5dd78f21fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e6bff8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089020, "uuid": "093dcab5-9b9b-40c2-9990-b19e1f24190e", "comment": "Malware payload", "value": "0c158c8131d7342d367cddead002c8d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089020, "uuid": "b9abf426-e945-46c3-84ba-d1115daca9b1", "comment": "Malware payload", "value": "ba401da0d62d69b098447b5a07772436f599269929429a61f9a85f6857a66ab0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089020, "uuid": "35f1b3f2-dc8e-463f-98dd-6496fbdc0191", "comment": "Malware payload", "value": "e1b1524857f1e4ae6ea9408e27529b3daaac636e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089020, "uuid": "e4015aaa-6f76-4ef4-9303-9ae0f7be779d", "comment": "Malware payload", "value": "8122ffad5092173b974dd27c4b10876b4fd97293421569adaabd7d2223fd76eb9d3c4fc9a8f73072c2c6a6e249827d00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089020, "uuid": "e8b237bd-d7be-4fd1-8ee9-3130d77ac0f0", "value": "T12F452343B6D88632ECB5077094F462932B367D81AE78535627466D0E0CBB3C6E936B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089020, "uuid": "9eec2dba-02a3-434b-84bb-39c7cbbd56fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089020, "uuid": "76fc3d62-e7eb-46b5-b644-eab5d89d0c90", "value": "24576:zybaVV9byzVhnUeX9+I+eNfKgRDAyU1x7Ssra4c6vwEDURuc2/WH:G2VmzXUeXx+eNfzATtO43nG92/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089020, "uuid": "2b26cc0e-01e0-44ad-9930-07bea5b1e1d0", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089020, "uuid": "c50efef2-6c67-447d-986e-b22a6a9d61be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089020, "uuid": "30e85a47-5741-4727-a75f-d2ab80879dcb", "value": "ba401da0d62d69b098447b5a07772436f599269929429a61f9a85f6857a66ab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629a9f49-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089021, "uuid": "06c9f0be-b370-48fc-a6e8-2f1ec571afc3", "comment": "Malware payload (RedLineStealer)", "value": "3655d07f17df9400ed50b2d3de13298f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089021, "uuid": "df0e09ba-27bf-422f-983c-ec8342bb72d8", "comment": "Malware payload (RedLineStealer)", "value": "ba79a15b3cbda4bd192dcb7b8f97db5cb93f1fbe765e441bf0a3048650f38d9a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089021, "uuid": "6a20faee-687c-4b82-a544-39d4b914fdd3", "comment": "Malware payload (RedLineStealer)", "value": "27d461a649129a6dc1fa2640c897137d47488a90", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089021, "uuid": "f65eeeb4-1d43-4074-9153-d69bfbfae9ee", "comment": "Malware payload (RedLineStealer)", "value": "2817e9972314b995accb2221cf0a7e5ae4c0be5cb1dabdea1fa8056289480d3dcbeffd3774adc543546e6092111fc88b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089021, "uuid": "b8f002a4-737f-45ca-9ea0-aa8e02a1f9da", "value": "T15F152313A7E640B3D8B75B7014F613831A7FBD622A34531B6A84EC2D4C735C89939B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089021, "uuid": "9b4aa496-a9c5-4e4d-bee8-da2630a4a313", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089021, "uuid": "cbbc937d-16a0-4138-ac3d-53790f14b9ae", "value": "12288:FMrOy90/L21jQJLdCVG0ohpxVpBPt3mYIHaladxpHf3deDJJXOr3USK484hJ:/ySL21jLVAhrVvYYXlydhgSJvhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089021, "uuid": "c63be817-73ce-499d-8ad3-c23490924523", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089021, "uuid": "389c9fde-9f85-4c7a-8ced-3f52210eebd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089021, "uuid": "09ec6c23-fa5d-496c-9e6a-32aa45ad9b1b", "value": "ba79a15b3cbda4bd192dcb7b8f97db5cb93f1fbe765e441bf0a3048650f38d9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500fb35b-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032726, "uuid": "9b1c52f1-12ef-4a8a-bf15-1d260bc6731e", "comment": "Malware payload (Mirai)", "value": "aecf914bd37271e23a5619cd60f7cd87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032726, "uuid": "735c649d-4be0-47e7-a317-316b7f6776ce", "comment": "Malware payload (Mirai)", "value": "ba9399ae41d63b0a3429d2000cf660be7ba4702766d93024645ffc09d5ce9b08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032726, "uuid": "33fb182a-e397-4c6d-93a8-c1408880923b", "comment": "Malware payload (Mirai)", "value": "ae9231efab1d493f3313507df31047ab62c3d96d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032726, "uuid": "c173f8f2-c6b2-44df-b9a8-6eb2fb456e28", "comment": "Malware payload (Mirai)", "value": "a4d0cef9a51d05605cd410739e323235c21e5f309fae5dfba75f97a52c435938a5c0f5068fc2abbc92b76696c41bec28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032726, "uuid": "6c50166c-93c5-4dc6-b6b3-4b65dab70ae8", "value": "T13E63A419BF610FF7ECAFDC374AA91B02288D545A22A83BB17930C518F65B64F15E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032726, "uuid": "d0ec5a1c-206d-467f-a22b-577c27696d3d", "value": "1536:4h+EyxOMGOtfjYCYgoFUyVreUeBwZFEXX2g:4h+EyxrGOtfjU1eBwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032726, "uuid": "0baaff45-5a4e-4980-90da-7bb32204e47a", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032726, "uuid": "d7767c0f-b614-4cde-b8b6-0b28a9b09563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032726, "uuid": "5b754ac8-b953-4559-b6ab-3dbaf1a6d72b", "value": "aecf914bd37271e23a5619cd60f7cd87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fecbd3-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057353, "uuid": "21e9dccd-c4be-42e2-ad65-aa134e885378", "comment": "Malware payload (AgentTesla)", "value": "4796381f084cd1a8310ffa14a4791f1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057353, "uuid": "18423c07-2b1a-4447-b8f4-8141b719993b", "comment": "Malware payload (AgentTesla)", "value": "bab0c56e1ac77713136cffb3eeda2c4c3c78070adcbb2bfd427b91e11f5b9e63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057353, "uuid": "1bc360a1-1602-462d-acfa-c29cac325585", "comment": "Malware payload (AgentTesla)", "value": "5bccbbade0f81e11e425d203ad2e2a1f7837cff0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057353, "uuid": "273f1a65-9291-4380-8cb6-56dcddb7ff19", "comment": "Malware payload (AgentTesla)", "value": "c2734bda326d60d3b853f379f40201a8099eeff302e5314ae1b4b83e3fb749f7808c0f9a1ec601cc6709466a367f76cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057353, "uuid": "c9c8ca68-0612-46af-ba42-d4562fe3b69c", "value": "T12514296993C98E52C32D447CC4A053091AB2A2C7571BE75D1EA1DCFB3E967C3323AC66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057353, "uuid": "7fc39892-dfe4-455d-a0cb-db2fd2dadba0", "value": "3072:GsSP0SEU7KO4RLiZIdoLG0eF9AkElSSk6/RQtSxe6S/IA8j0H:GsSkU7KrseWLS9mi6KtSxNeK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057353, "uuid": "c6b63b7c-a1ab-4e8c-b40c-3c2e9039d158", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057353, "uuid": "41c9edb0-f9cf-49a8-91fe-867d32a38ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057353, "uuid": "3df385d2-1a14-4ad5-93df-4a3ff196bde3", "value": "bab0c56e1ac77713136cffb3eeda2c4c3c78070adcbb2bfd427b91e11f5b9e63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b2cdb8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089023, "uuid": "3d50c08e-776e-48f1-84ab-bab42fd0b507", "comment": "Malware payload", "value": "31b2a0344559a04f0f618d0575c19247", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089023, "uuid": "a6826394-cd1d-43a7-b490-bfb2d17cd4b2", "comment": "Malware payload", "value": "badb1536e7e1eb79b0285e6a6f7e9bb17b86f5e1c94571165335cf896d17a5ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089023, "uuid": "9b1078e3-3572-47aa-bc78-0ae64a48be8b", "comment": "Malware payload", "value": "9de452e4115ff008baaaa6b313a6afaa5a7e0f7d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089023, "uuid": "a8ef4844-429e-4d20-a919-b026a180dcc7", "comment": "Malware payload", "value": "a5736a86dd732bd06be759dc0f35df28c07d1c0e4e93096a379e5977299c64757043ebbab7770295860b8b9dc01fb78a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089023, "uuid": "17dc190a-bacc-47fa-aea9-044ba7139948", "value": "T16C45234763E88823E8F6277191FA03C30F39BCF568588B5F2746A54E28312D5E17676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089023, "uuid": "f1c870c3-16fe-4c49-89ed-7cf959b46f99", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089023, "uuid": "513793d1-c143-468a-a4bc-e819305aef31", "value": "24576:oyIuWjc30DU4rGYmUR5iR1vpzrDXPZqbTm8js:vSjcEDUpYmULu9LJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089023, "uuid": "0b925539-52b9-48cf-8a2a-8c293e4ba303", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089023, "uuid": "03df17be-89c0-456e-a99b-85b3f6a3e471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089023, "uuid": "29104884-1714-4af7-91d4-90cc9e589a93", "value": "badb1536e7e1eb79b0285e6a6f7e9bb17b86f5e1c94571165335cf896d17a5ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b3efa3-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089026, "uuid": "1259cf21-0ba5-43d6-8f92-42bda1626c38", "comment": "Malware payload", "value": "f3946e9228fc9e2f6eddbb44c462c05b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089026, "uuid": "1452842f-2711-4f02-a905-39d64689dde0", "comment": "Malware payload", "value": "baee36ba723111ef9aac6a951bc10c1ca22045a6392dd6a1a96751bbda4ab94c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089026, "uuid": "e2b98a40-0d6f-4b1d-9a42-f56b383a39e7", "comment": "Malware payload", "value": "95c134e5252b6f7f34f445f312b0a70ef6752f95", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089026, "uuid": "760abe80-b02f-4459-89d1-259815e2d434", "comment": "Malware payload", "value": "c1266f3a3649cf4760942139263cc751c91bf436770391a2d3fa7be71077126f8d9e9afd6b1a276ed7ddc22c14580f3c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089026, "uuid": "cd91504b-7ff3-450f-bbc7-31fc9cc7a770", "value": "T1C2452307ABF84471D9B0077029F702971F37FDA09D64976A6B467A5A0973AE0E23073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089026, "uuid": "3682ecbd-e64f-479a-938e-d2f748c2a727", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089026, "uuid": "6a7c82aa-a8c2-406c-8508-917d59ee7818", "value": "24576:VylPOpIKbAU682J5KStyxNkHF1R34enxsp38MjdmCUqiSnpbGf7HB8n:wR2rAU0JcStOkHB4YEsL4nFGDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089026, "uuid": "95d2c711-8e8d-4343-985a-3b182c649238", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089026, "uuid": "e662685c-53a7-4239-a0ca-7bb28823b125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089026, "uuid": "7d3f0660-8215-4df7-9d69-ecb342cd43b9", "value": "baee36ba723111ef9aac6a951bc10c1ca22045a6392dd6a1a96751bbda4ab94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66739bb8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089028, "uuid": "7b2879b3-73d7-49a9-896d-e6ce4a033845", "comment": "Malware payload", "value": "f1ea2c0511d681d500a4e365f29a163d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089028, "uuid": "608e447b-e65e-4cde-879a-b06899085eb0", "comment": "Malware payload", "value": "baf36ef90cc9d7bad2fe8e4d4d3b9cbb7567f1b0333f034924009ab26fcc0f16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089028, "uuid": "58285527-2260-40e1-94a0-e26444c5a819", "comment": "Malware payload", "value": "fc6a5ef033a015d2598f78db21d43d9b63453f6d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089028, "uuid": "f879b553-b5f5-4cf4-b293-f49925627410", "comment": "Malware payload", "value": "c3b598f35d63a22f4fec12a000ba7099560b227ccf69272b70674554cc2b10b5e2e84f7ada55e83e66cb1fe18655e13a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089028, "uuid": "78ee503a-b7e5-47d5-ade7-66b0ad5bf96b", "value": "T1D6452302BAF640B7DEB5237418F503870B35FD92AC608A165786AA1B9D733D4FA70736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089028, "uuid": "fcb17f98-206e-466a-b178-595158f3d7f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089028, "uuid": "5a12c14d-83c6-4856-8093-171bcccb9b3d", "value": "24576:LydG5jN0v56FTTI6wed70/fRHnPCkStFcRxQVWkW/loHSZCbZiXaw:+dG55I5ITb0l6N3Vl6aHUCbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089028, "uuid": "d50db26e-8418-476a-abe1-fd5ea1d2982b", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089028, "uuid": "b340999f-97a3-4f82-9af7-d9da44c15fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089028, "uuid": "cecd04f1-a3bd-4819-8725-8c56c1d3820e", "value": "baf36ef90cc9d7bad2fe8e4d4d3b9cbb7567f1b0333f034924009ab26fcc0f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f66949f-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032295, "uuid": "019e07b7-30f4-4fef-8cfb-1d9f62d7b616", "comment": "Malware payload (Mirai)", "value": "27f806d1d42cf0ef9630a97b4d53a799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032295, "uuid": "e0ecd7e1-3b30-4e33-9ac7-8c8a8143a10d", "comment": "Malware payload (Mirai)", "value": "baf9ce6761e551e6a80ace07076521dd89575efe2b94e658bc6028c3c02abf27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032295, "uuid": "a3ada12c-09bc-4c04-b2b9-ce55a585a6f9", "comment": "Malware payload (Mirai)", "value": "be55f8778a891aa42b1f4fb757fe8e94622bc12b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032295, "uuid": "8261a65d-0dcf-43b7-b6a1-4d0d13579790", "comment": "Malware payload (Mirai)", "value": "02aeec330e76250c4887085ced9858c31a739fd3eb8b2274e62097f3da9a41d4f053eb5567d8e77d5622e2365d2e5c36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032295, "uuid": "6151f58f-5322-4695-a9cf-baa45a6c793a", "value": "T161230231490E8EF114703C76EE99978376E12A75C567312396290A3C2FB57131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032295, "uuid": "8ef3c0e8-1f00-4d82-ab5b-61d8bc0381bf", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3M9q3UELbUXfi6nVMQHI4vcGpvo:gECFd+A6YHAxVLRQZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032295, "uuid": "209addcb-8006-46dc-b059-e32b7165c7eb", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032295, "uuid": "f10b57b8-589e-4790-b0ee-2e397cf5952b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032295, "uuid": "8c3ab215-fb76-4395-be53-2925cfdb0a49", "value": "27f806d1d42cf0ef9630a97b4d53a799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c60d85-f230-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052489, "uuid": "7cf21931-0da1-4cf1-a583-06f7ef8b6fc4", "comment": "Malware payload (Mirai)", "value": "46d7556a4ed16034d60d0ade4fea04df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052489, "uuid": "ce677ad0-f3d6-404f-bbd4-9f6c93337aa4", "comment": "Malware payload (Mirai)", "value": "bb8318b5084c1ecd097aab15f85c1c4d244d8b32c34b56bf24a164209f73fc51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052489, "uuid": "8987af42-c471-4d3b-ad39-3611124f326d", "comment": "Malware payload (Mirai)", "value": "e1679d3074eeeee08678ec96b84fb9888a19b925", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052489, "uuid": "03472158-a448-41a8-97b9-1eab47d3a6a4", "comment": "Malware payload (Mirai)", "value": "e409ebdf9ecca23c073d29eae35ecf868f76ea81328bf1c696e51dbac476a93c4cd0aff85bba07b3d7f8e8f10b4381cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052489, "uuid": "3c9ddaed-0c89-4712-9b5e-0a56d14b951a", "value": "T121C2E130A6EE2CB586500572F3FC5AC9BE530FBDFAFA2890114057BA7941D452EDA8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052489, "uuid": "895f6c31-9a5b-497d-8760-e02011c0a990", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEibVvhymdGUop5h7:A8soTAZ3alkXLvFh8nNEiBvs3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052489, "uuid": "bcf5e500-c8fd-4e6c-a5de-9b4491d1cd4f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052489, "uuid": "3823ceee-6201-4aac-84a4-0ffe96e4e420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052489, "uuid": "4466b96a-165f-4543-9c12-60f976b208a2", "value": "46d7556a4ed16034d60d0ade4fea04df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67243aa8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684089029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089029, "uuid": "209760bb-e0d7-4f13-9473-708bed7e20c8", "comment": "Malware payload (Amadey)", "value": "5fc1c6c882afa89442caba1f734db658", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089029, "uuid": "41f49980-f169-43ad-b38d-31cbf226db08", "comment": "Malware payload (Amadey)", "value": "bc3b5fa21d6696615d3745228a1feef234624abca9196339bec8adbfee50a7ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089029, "uuid": "85590258-8f78-45fb-bd0d-55d19023b2e6", "comment": "Malware payload (Amadey)", "value": "2101893800b6f07e39616ec516dc17ddaa56cb96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089029, "uuid": "beb104a7-9a79-4340-802f-0ff084150214", "comment": "Malware payload (Amadey)", "value": "ad4f85f9237822a89ee059e9cdde28eb97e25b65086eb61f475eaece378b6aa64bd9841cba8471c588b28c255e42f1c6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089029, "uuid": "dfe238e4-477b-454c-b2ed-82343d92d7c1", "value": "T11E452306FFD98132D4FD6B7058B607871B30FD624D25524B3A46F96A09B36E86B3036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089029, "uuid": "c6258be9-c215-403f-9be5-01f98c332867", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089029, "uuid": "791af76f-1530-4eb9-bec9-f1607864a475", "value": "24576:tyH1m/qRUmrmCvMM779ZrjZ2+kHrZDy4jX4joFHSLqu:IVSqRU3CvMwoyroI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089029, "uuid": "e95349ee-0c45-4a74-99d3-896707a12e5c", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089029, "uuid": "fc2fed9d-6468-4aa3-987f-389bb6016ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089029, "uuid": "c875fc9d-01ce-4bcf-9394-3ab960c90d68", "value": "bc3b5fa21d6696615d3745228a1feef234624abca9196339bec8adbfee50a7ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d8574a-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089030, "uuid": "d9729974-2fb0-4849-81a3-3594d1f9d382", "comment": "Malware payload", "value": "329ed6e8628a8ee43d6f6f47111b129b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089030, "uuid": "d9a9901e-cef2-4a41-9986-321c338179cd", "comment": "Malware payload", "value": "bc9918cb499f782e8268b555c1244c313fb50b769f3ca9aea4da3eaf4eb14204", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089030, "uuid": "d0466ed3-77b4-4cc4-a75c-ea5398de3901", "comment": "Malware payload", "value": "3ddbe83bb88fdc1ac59805bbd751067adbcb1354", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089030, "uuid": "7b1b4f99-68c3-45dd-b358-20ca24390f18", "comment": "Malware payload", "value": "6616f13926aa519eba50726e303fbd0a08553f322af9655f8b57768265c598c568a882713329dd7aace69088f62b3a0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089030, "uuid": "b53c06bf-009e-4c7f-9726-c4c3b6dff167", "value": "T1DA452386A6E44032F8E16BB48AF107930E32BDA15D6CD33B6343999E5D735C1B5B432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089030, "uuid": "a051582c-2f85-45b4-ae2f-328c3024a8cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089030, "uuid": "8e20bb4c-a8b4-4e6b-89a2-84b76808d373", "value": "24576:Iy/06PJs21K8GRVZVCaXtpVelvV6/vaVfeod5bWOS:Pc6PW21h2fVZvV8feod5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089030, "uuid": "7f918074-d7a4-4e67-923e-10d32dadac88", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089030, "uuid": "901fa46a-0427-44aa-bef0-af90faf00511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089030, "uuid": "f5ed7790-075e-45b7-a7c0-0972c7c1533c", "value": "bc9918cb499f782e8268b555c1244c313fb50b769f3ca9aea4da3eaf4eb14204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f417a5-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089032, "uuid": "dbf63a66-9cba-4bb1-90c8-d6284c3281a4", "comment": "Malware payload", "value": "dfad59edc639f737a1e5d094fc1b2ac3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089032, "uuid": "f51c2c6f-5c98-435a-a9df-44ca02793754", "comment": "Malware payload", "value": "bc9991b9d1b248c13cbdbacc877ddcc984a40bf138f6835112cd4a060c7556f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089032, "uuid": "3fcd00f4-5797-42f9-97b4-b8ab250e8a28", "comment": "Malware payload", "value": "c0f3cb85eb4887a5db8c95db137c9ab39056aca1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089032, "uuid": "9f2224fc-01e4-44da-9f96-f93eaad4b272", "comment": "Malware payload", "value": "5b9c937a44c3a428336a615e10873fd79ff08971ba6b08c33d4ada5527a6e2cedf17a4c7eb7047f83a8e84d723a5d276", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089032, "uuid": "74935961-ba97-48b2-9a2a-b179f8dd252a", "value": "T12845230367F47136EC753BB05EF912830A3EBDB11929471B275AA90B1C337816A357BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089032, "uuid": "c52063a7-7b41-4b45-8193-1aa27c03e5bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089032, "uuid": "0924a45c-4ec7-46d1-911b-cf3a5f9b8c77", "value": "24576:CylCAYD4PQSkzggKp8fqH4rXthOkgPXO/Y3dW4MfYEV:plCHCizJKqfqH4rXthbgPXv3N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089032, "uuid": "d0f1a410-f301-4f23-8b6e-1c617334e313", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089032, "uuid": "2b0680fb-03a1-47ff-ac8c-26f32aa0d87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089032, "uuid": "ead1e06f-b736-43ba-8d56-b195b8cc3a77", "value": "bc9991b9d1b248c13cbdbacc877ddcc984a40bf138f6835112cd4a060c7556f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a7b6bd-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089033, "uuid": "77511765-2062-4c94-bf33-53506ee066e7", "comment": "Malware payload (RedLineStealer)", "value": "9e9cb72513f944accd373e12d220e68a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089033, "uuid": "ef475452-2b29-4fa2-a639-0bdeb490a218", "comment": "Malware payload (RedLineStealer)", "value": "bcdc70c860f3772af96cbf35f4f33e04540489c86fbfbcf9c1df8fb2b0f10daa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089033, "uuid": "a7726102-1bd7-423d-9ea0-e29e4f8fa383", "comment": "Malware payload (RedLineStealer)", "value": "9d79dc246de6c3b25164ec240a3bf4eedd23ec14", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089033, "uuid": "53363da4-8382-4414-acfb-3dc14ce69e7c", "comment": "Malware payload (RedLineStealer)", "value": "41ed8a8fe71bc19ce70d50a7307a06416a955a09b17ecd3cfe01e8cb6a3d6d10c2fed9f2b2de571cf388d54f519c91d4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089033, "uuid": "9b4d362c-24f8-4f27-8a86-0217c2da1c89", "value": "T1F9452302BBC414A3EDF15B3458F242D30F7CBCA269B4076AA696E94E0D722D1F276753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089033, "uuid": "f59c6615-9c83-477c-b678-fbe8d755a59e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089033, "uuid": "d9cedbde-dff0-4804-85e9-0c4ed494402d", "value": "24576:ZyGlANJ9g9Br97Av+8h9LaZfAMacnUoLl6tkAkYg3hOXF:MSANJ9Qz7Av+ScZolUUbgxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089033, "uuid": "ea2f7e69-f431-46c6-bcc6-fb4c2345a40e", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089033, "uuid": "2005e296-6316-41b8-a560-4796817619d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089033, "uuid": "4e22137d-b7e6-4c95-baee-4a1b635aa6eb", "value": "bcdc70c860f3772af96cbf35f4f33e04540489c86fbfbcf9c1df8fb2b0f10daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5805d5-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089034, "uuid": "58453020-18b1-43e0-bbc7-93b9ebc9ad57", "comment": "Malware payload", "value": "a3e444c321fd9235a9559a1776cc5c88", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089034, "uuid": "742e6a4a-5ce8-4f4e-8215-f88b98ae9a44", "comment": "Malware payload", "value": "bcebcb224dbe8bd0777174ae719cb70657a7feb1a19207098bd84d3209da5d49", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089034, "uuid": "ac3348c1-3141-4f2c-a543-c2b67a3a77dd", "comment": "Malware payload", "value": "a5a975a094eba5185aa58cd0964386f174890c3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089034, "uuid": "877bcc58-eb57-4d1c-a974-f391d37340f9", "comment": "Malware payload", "value": "91fda668eebbf218524ba1e93325dac8ab8b60c6300ec74948c3dfcee339a0bc65d83237d955d12d2a9257f6c378627d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089034, "uuid": "315e210a-b7b3-494c-ac7c-2c0b1839da2f", "value": "T176452283E6D04522D6F52FB029F603832932BDF2586C83975247AE1F1DB29C1A57736B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089034, "uuid": "95985d04-e54e-4833-9b15-2c2e6a057fa9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089034, "uuid": "6475d559-d1de-4a3e-b01f-f564bccb7d61", "value": "24576:Zy54jzHvEhSdRlYO5LqzCpkqlFvViA3ySCjrp0nphHNWH:M4DEsjY8qzCpkqlTiA3yS869I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089034, "uuid": "a585a10b-3388-4525-9955-63d2525bbee1", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089034, "uuid": "47779301-b0d6-4fa4-aa8c-7c633e9129bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089034, "uuid": "f15d8396-df83-4e9f-87fc-938faa866b64", "value": "bcebcb224dbe8bd0777174ae719cb70657a7feb1a19207098bd84d3209da5d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0750c2-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089035, "uuid": "c0e33dd2-7468-4466-a631-1b3730834a42", "comment": "Malware payload", "value": "6c8cb1fd23ce4c88eb4778429ebd6f6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089035, "uuid": "52605f49-ec6d-4b13-90f7-ec926f50ab93", "comment": "Malware payload", "value": "bd1102cdf51134a27caec79c2aeaf4c030b974d43b6616872f2974fd5690c8dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089035, "uuid": "fe649924-547e-413d-823c-06f7fb190a56", "comment": "Malware payload", "value": "be99b614913e723ce703bac6cc09f400db79f328", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089035, "uuid": "06b46cf4-ae4c-4598-a53f-5b4b8c94686d", "comment": "Malware payload", "value": "6d1dac4b44956a00907a9e18e817e32b0e4765d3eb355a2db3c6661a56994a193d10d53cf716feaf95cfa35eb60d2a34", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089035, "uuid": "7fc8476a-a906-4064-9e58-8fcd0c87eb1c", "value": "T163452303F7DA4173D4B127B1A4F246C30E27BD7689656BAB2B81D85709737EA113232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089035, "uuid": "f4f02fcb-74b0-4f00-a67a-d17ecdf5074b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089035, "uuid": "d6fc640e-df56-49f2-b894-e5293be538b1", "value": "24576:8ybCbENsaWBwtFkbZIPJToWmTLQgabrwzaimbLJ:ridwtFkbZIPJTokdsaln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089035, "uuid": "6a633b84-71a1-4bf5-821c-02755b1a2a0b", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089035, "uuid": "646824df-032f-4678-9d55-178688cc1c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089035, "uuid": "f4673e9e-68c9-4a15-b79c-04ad1ed845c3", "value": "bd1102cdf51134a27caec79c2aeaf4c030b974d43b6616872f2974fd5690c8dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc4560f-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089037, "uuid": "09677347-c597-440d-913d-aed63ea758cd", "comment": "Malware payload", "value": "1c68b4fd720cad4a8fdf31d431d652f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089037, "uuid": "21fc402e-1847-4e0e-94a2-cc17c188e7de", "comment": "Malware payload", "value": "bd1260616f7472d2f310cc65cb4701746b499d943a7a5fa4c01f7fe0a4ddc304", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089037, "uuid": "b5666df1-6440-462c-b8fe-348b962ad0e5", "comment": "Malware payload", "value": "bef4e9e28c86aa8f9d4ecdac856b04396f5359c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089037, "uuid": "0a4924a9-6081-41af-b40b-53767d46c70f", "comment": "Malware payload", "value": "c89465f1c3d3be4d7d6438cada9b605876214efb763829ec97aa72f150ae98c3d205a71a215abd349baf8f1739cd1b2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089037, "uuid": "a491d8ae-ce37-4283-a626-cfacb351ca45", "value": "T1E5452341F7E5A135E9A52B74B8F602931F32BCA3A674832A5717AD4B0DF22C0B271717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089037, "uuid": "f91b47fb-b74a-4901-be10-65fef552c029", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089037, "uuid": "e0b077c6-2d5c-4c15-90c4-d835ff5ad807", "value": "24576:lyTm85cvY/OBFzY9QQHeer4/Q9NifIoDFAFP9RvRC:ACFbFs2QpraaNoIoD+FVR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089037, "uuid": "e529b5d2-ce47-42c0-8710-fc94f6e33615", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089037, "uuid": "0e0f8e6c-5f11-4fd8-8fe3-d4a898c07637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089037, "uuid": "d45fc234-56b1-4165-96f9-4866db308223", "value": "bd1260616f7472d2f310cc65cb4701746b499d943a7a5fa4c01f7fe0a4ddc304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7141f4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089038, "uuid": "122a9f8a-9ae0-4ec9-849e-80162c6cfc9d", "comment": "Malware payload", "value": "fef72ed0c28324f57f3a09d92548a3eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089038, "uuid": "dc5b68b7-5baa-40d8-9123-8e462895c59e", "comment": "Malware payload", "value": "bd57c9f6dadc4c62d7208db52f903c29aea6ff09f400cfa75a9851cc1aea427f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089038, "uuid": "b9e0b641-159c-4835-bbb5-aec9484f15ea", "comment": "Malware payload", "value": "6a211cfc6e59271f646556c907a3c429488b0379", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089038, "uuid": "45e62ad4-3df6-4d91-b050-9d49d90c597e", "comment": "Malware payload", "value": "9f236d406ddb1d1ef750a69b80485dcd62d46e71a6801fd685a52595c3a0a709b713c220cabbe17b52610850c41deb07", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089038, "uuid": "ad874fcd-dcb0-46df-af78-df77c9f9be31", "value": "T170452303FAF44476D4E42B7169FA03D316397CF1A8B587BA2B059C660D726C8A43637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089038, "uuid": "6066dc03-40da-46b5-942c-23daf65c4838", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089038, "uuid": "c7f16725-f368-42cc-af08-7029707453e0", "value": "24576:iyIqgI30kxLFZ7wEm6e5r/gLvfkb8AEYumxw51iK/3o41Hx/tdfRq9jxvjx:JIqgIdxLfUEmjrQ0zEks17/B1H5t3GFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089038, "uuid": "7520a015-a501-4588-9bf6-ee13deb1b78c", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089038, "uuid": "9b448ecd-ac9b-4edf-9e42-fe4819d4b6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089038, "uuid": "2443abc4-97c8-4f09-a0f1-26bcec178791", "value": "bd57c9f6dadc4c62d7208db52f903c29aea6ff09f400cfa75a9851cc1aea427f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d008da8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089039, "uuid": "d9b91d8c-374f-47cb-aa53-a77fcf9bff7c", "comment": "Malware payload", "value": "197c08674c8e91ff11eb6fdf0c42683b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089039, "uuid": "41cd77e7-0912-4016-90fb-1e7e714658db", "comment": "Malware payload", "value": "bd617ede15a79ede4ac461e6736f133a29ec6d7a79271992270286c2f881422a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089039, "uuid": "0885c212-f1f7-4edd-80c8-1dd259de9dab", "comment": "Malware payload", "value": "0edf97418092ba9073f51c5bb7ac1e81e8d5f729", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089039, "uuid": "f9a56c56-3c14-41a7-bbe2-7e0a2b23d11f", "comment": "Malware payload", "value": "e1969e2403c4fdf8a7cd027fce255ec4b70433475256a6060e285f1736b7532b407adff56d8b7bb68451e8d8cd3af981", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089039, "uuid": "39214369-7b76-4be0-8692-bf1fc73f0d39", "value": "T104F42352FBD89472D8BD2371BCF203830F3A7CA459349B672395682A5CB32E1947177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089039, "uuid": "00e59997-e1a7-40bf-a014-b495c7fc1e84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089039, "uuid": "e09da7b9-56ee-4c34-ba35-59aa57f2e468", "value": "12288:TMrTy907J6tdihzlK1qvzk8gAnz2PDmuR6h0TNrFwxwhtpSK+waQ426zXE3:Ay8J6HeEWzk8jz2rfN5wxgHdC3E3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089039, "uuid": "33f7ae88-0886-479a-aaa6-484aadc8ea7d", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089039, "uuid": "5bfa954a-0000-489c-a3a2-039d46dd5a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089039, "uuid": "eb36220d-aa55-4e12-b1d5-353b4b062c85", "value": "bd617ede15a79ede4ac461e6736f133a29ec6d7a79271992270286c2f881422a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1beac6-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089041, "uuid": "23a84d10-23dd-4e97-85f9-ef23e70517a9", "comment": "Malware payload", "value": "567f9265a98a0b965f3dbdc2a31ba655", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089041, "uuid": "f28d4563-12fb-45ca-b44c-7f47f5b56048", "comment": "Malware payload", "value": "bdcc365f72dd044a23e6175df7cb98d6a9ffca0576a99a358ba0dbe90360a7f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089041, "uuid": "aa636b63-c9ef-42eb-ae07-b3b60c138112", "comment": "Malware payload", "value": "27aebf74729a50210ee2178f87a0c8811371d787", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089041, "uuid": "cd9a4462-c92a-425b-a434-da085a15bac0", "comment": "Malware payload", "value": "9669cc804067c195d7101fcfaea56dbf4593ed0e9529dbb34e64b3050cb40f595c87f4e10121f2cfc35056fdd9ce751e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089041, "uuid": "3737680c-782a-410c-814c-2d71aa8eee45", "value": "T194452357A5D8C422ECB42B308CF702531A3A7CA118B54B5E1B857E9B1CB3694B87673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089041, "uuid": "f86b3a02-076b-447f-92f7-7c5d2094bc86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089041, "uuid": "7db61248-c695-43e1-b659-c06aae1a3e80", "value": "24576:HyWZ10JtFs7LM92gtrY647F+lTxwcKbVCoYYmo:SWZ1A6irY6cYwJbBY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089041, "uuid": "a08062ae-12a5-4cf0-a5ef-e39abb11fabc", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089041, "uuid": "45acd5a6-b0d6-447c-bd32-6d64baee32ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089041, "uuid": "b753051c-8107-488b-8826-827b3f8d6b3a", "value": "bdcc365f72dd044a23e6175df7cb98d6a9ffca0576a99a358ba0dbe90360a7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecfd35b-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089042, "uuid": "10e5bdc5-a60f-4fe0-9a74-572f90551c76", "comment": "Malware payload", "value": "8e8e60160198bdb970ca602db781c6cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089042, "uuid": "9258cdc7-ed33-49d0-994f-74d66533359c", "comment": "Malware payload", "value": "be104b2d7188d37c32e1f61f40cab23fc1390fb42ccba1a9c493eeaf5510f645", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089042, "uuid": "a1bdf282-2389-4b14-ac04-eb15c6a5fa69", "comment": "Malware payload", "value": "5f5ed4dff58df35dfc9d3317d0fea092f3493c51", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089042, "uuid": "7ea22466-873c-4bf3-9cee-25009f993450", "comment": "Malware payload", "value": "4c1db1dfa2d5d26bfc798ceb14a020452bf50c6b9ff5f46473ba54dd5102f90acb49ee86862c405dcfe35a2003644eda", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089042, "uuid": "9612bc1b-c25a-45d2-aff5-98f463c9c326", "value": "T18B45231777F86132D8F5677075B625830B30FFA529B9839A1740A89F0CB3784A9B077A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089042, "uuid": "f6ccc0c0-0627-43bf-b14c-95e3e205454f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089042, "uuid": "5832e911-f2fd-4bf6-b3a4-39d9d62ddc0a", "value": "24576:6yiYOLiomhHsRoSKwebjOOq/C0L4wJpnhjxD5qfKgwv4vzHU3rY:BiBJRJKZ9g4wJppxdN4vjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089042, "uuid": "1cba3920-5cf9-4785-be69-9e49081e02e6", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089042, "uuid": "28c28e73-365d-4529-960b-4335f349f5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089042, "uuid": "4eb61e25-dc4c-41ae-83c9-60ae7f73aaf3", "value": "be104b2d7188d37c32e1f61f40cab23fc1390fb42ccba1a9c493eeaf5510f645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7dc8da-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089043, "uuid": "a2fc46a8-5789-45c0-b7e4-fe8bfe78f772", "comment": "Malware payload", "value": "cf83a70515d4e3f651d90079d3a7cf96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089043, "uuid": "2adc2fb6-d1cb-426d-8225-810fec2e1fbc", "comment": "Malware payload", "value": "be2a25866cd57d5fbcc103cc4487afd47be79f546fa00bf19c51a11f97a5aa74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089043, "uuid": "5df8e77e-62eb-44bf-85b9-041612493334", "comment": "Malware payload", "value": "784ae4d8c33feeaca28d47b8c6f0fdacf0dc961f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089043, "uuid": "4ee3d811-6334-4f98-9087-52c91c02af80", "comment": "Malware payload", "value": "b23f11b94b9df5009009341991426af98503bfdf0b239dbb8279418ca8216dfa7556a5f6b0da36eba9fc4361b40cfb85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089043, "uuid": "e13f6c68-d6e3-40af-bb4c-9279abc82044", "value": "T198452382F6E091A3ECB52F3164F903C70A32BEA44D31965633E5DD9918B27D0A937727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089043, "uuid": "0a214b41-ae34-4c78-95cb-d659d950cd26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089043, "uuid": "ffb293f6-5f27-4f5a-91ad-a292329d0bc1", "value": "24576:GyKacWJa4CpEh7Hrxt+3Rd6N1yl+AniKCi0ljhY:VLcW4HEh5t+3RdUoiKKjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089043, "uuid": "d39a174a-c0ed-444a-85d1-99b91f14f24a", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089043, "uuid": "a5e3e080-02e5-4010-9334-1dfd284ce4aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089043, "uuid": "97f9ed5f-ebfe-4b54-8db7-4a8021536986", "value": "be2a25866cd57d5fbcc103cc4487afd47be79f546fa00bf19c51a11f97a5aa74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f14b20b-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032698, "uuid": "77f3dafc-63d1-4c03-be48-30c1cae51869", "comment": "Malware payload (Mirai)", "value": "45bd4df53807ae643528029700068b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032698, "uuid": "6588260c-d30a-4916-b955-f9638276a5d0", "comment": "Malware payload (Mirai)", "value": "be4c5d806f12581669f3b3ae44ae8ae45129f0445593140363707bc9166019f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032698, "uuid": "bc89184f-232a-4471-9d46-a98b356f8c66", "comment": "Malware payload (Mirai)", "value": "7b4a82711b3a14a63998fa3c09685d96f200c1cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032698, "uuid": "ca1ecbca-326a-4786-aa87-946057b01269", "comment": "Malware payload (Mirai)", "value": "237019bb451b389ee33cfac3afcfee60e77d139efef64985552c0ac31f87a3567c371044cdadf71d19cb063022af9bb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032698, "uuid": "e0241f72-b7b8-4c1d-8530-30d54af2cbf2", "value": "T17563850D7E218FBCFBAD423557B79E20664833D637A1C584D1ACEA015E7024F241BFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032698, "uuid": "7f9744cd-0049-4cd6-8cd6-4b7514fde727", "value": "1536:hq/401CyYlrrdeZ3bs/YhgxVIThJgFKFGacgUtXRmAFt0Do:hq4B1lHAAkGacgUtXRVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032698, "uuid": "97782479-f159-4044-87b8-b30281c553b3", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032698, "uuid": "bea0f69d-86d4-4299-8954-cd69c9f01e20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032698, "uuid": "8122d88e-b5ff-46cf-9cd2-9797a67ce341", "value": "45bd4df53807ae643528029700068b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702fa708-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089044, "uuid": "f625e94c-e661-42bc-9c3a-ce69b36e2e75", "comment": "Malware payload", "value": "47f93fc511264f2ce81bd39ebbcfd134", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089044, "uuid": "de0c1a12-a8f6-49b9-8235-5f3e4d5c596d", "comment": "Malware payload", "value": "be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089044, "uuid": "525c8368-3ef5-4dff-af72-a74e5534eb81", "comment": "Malware payload", "value": "55bb471d491022e9f1a503a9c31782d39e2b8ad5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089044, "uuid": "782a8f4a-7b87-4adb-bcc1-cb00af18d902", "comment": "Malware payload", "value": "e6ca8437d9bf14eb4311b9498246973b11b9581c2bfcc4c7ab0dc8afb5037460545de71067d516b61f2fbb41103e133f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089044, "uuid": "66383566-0a98-4996-b159-21da1eb2921f", "value": "T107452207BAE88472E8F5AB305CF647430B34BCB69CB9531B270A559F08B29D1693173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089044, "uuid": "07c1d20d-e193-44a9-a310-2a0e208a1e92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089044, "uuid": "2177f137-2ba0-4213-8058-417a672749b9", "value": "24576:ryXrcJ6Sc+wUB8HQ0GWqEef/4NJaGOTS9cqxhc1HUx8s/w8T56:ebcJ6SEUCQHtf/IJaGOTNqx83s/w8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089044, "uuid": "acba0680-8595-4f5c-bcda-935d4f6f58f0", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089044, "uuid": "df1ee000-cbf5-4425-b86b-04d379675240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089044, "uuid": "7507470c-d324-4d09-9078-6de1fb60e6d7", "value": "be61b0e11878b01cdf9161f2cd9a799afb2b78e19dcbd557b8138848df38be3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5768080-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089670, "uuid": "09df62f8-8bcf-465b-8caa-38acf6db05a7", "comment": "Malware payload", "value": "1b24dd46ba791acda6bde3f177605069", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089670, "uuid": "b01785db-762a-40b0-98d0-59e79ee3eb92", "comment": "Malware payload", "value": "be6ad6eba009beba8714bb2afb4475ab646c2a4b5129eff0724ec94f14718c43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089670, "uuid": "b0adc961-407d-43e6-9394-c628981d16d2", "comment": "Malware payload", "value": "99d47623a6798ec98af5677529e7c4dbf0d1ba78", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089670, "uuid": "4fbdb66f-3cc7-4a88-aa62-b1b26cd8b136", "comment": "Malware payload", "value": "324e5ef93110d2561f77071a06834437703d0a5cec0150fc09626a5398271301b8fe9ba608a142003c2c462f45481494", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089670, "uuid": "d13c1cbf-753d-4fc1-9351-9d849a46a57e", "value": "T153F2199BE81020F5DDE201F121957B42FBBA94344503AB5E8E44A7BB9C71DA3FA7C14E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089670, "uuid": "2e39270d-769b-4c88-858c-8166cea879f2", "value": "7c2e0427dc9884c5748d925abcb8ce88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089670, "uuid": "21f2ed24-83ae-4833-b15e-2c90744bb310", "value": "384:DmtBHURa5S+o+3hkzpoMe/GCDlO1FZsAwBZkh2QddSG15VjN/6Tu99:CB3kGd/NY1Xs9BZkhHzBR/6C99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089670, "uuid": "5fcfba2d-143e-494c-bdac-8b077a789a9e", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089670, "uuid": "f3fcd9a3-7429-48bd-97e2-bcacd1051bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089670, "uuid": "da9f2bb6-a691-47af-9ba0-02277e3ffdfe", "value": "setg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0846e6-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089758, "uuid": "1cfa7374-3862-4899-bbe2-b569ce10d58a", "comment": "Malware payload", "value": "4bcb1286c4bb2fafeeacb3a434f95adf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089758, "uuid": "0b575df8-978f-4781-b49f-9d557b5bfbbe", "comment": "Malware payload", "value": "befebd730e5fb5645e42a607d6d120dc54f9f202048749fa04959fe49a0242f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089758, "uuid": "188af66c-0020-48ea-9661-a45e100d8e22", "comment": "Malware payload", "value": "b876def380ae085d1cf760ec10f0530611f52e26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089758, "uuid": "148a9c03-f117-4c0b-b117-d5e0b4b7b68b", "comment": "Malware payload", "value": "86c81488f56f810c72baa3008848f4d91656be0e4fd73ad8affa45aae822cbeec3318324004f4620fd2e944632066c86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089758, "uuid": "a0349095-307d-446e-82e9-ef8ddd6cf6c6", "value": "T1C5F29B9856D36052475BF03EB37EDCC6E265091B0AD5690FB91DB120FF9983CCBB0A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089758, "uuid": "4933f72e-532b-47b2-99de-f1803794a761", "value": "768:0pHxUj4S305ZCTYXOnrNkZhkWvEVvnkUXkd:0txN61FinkWvjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089758, "uuid": "4f71ff7d-e505-405f-a4a8-4500759bc8f9", "value": 34530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089758, "uuid": "727e92bb-a92c-49ee-b1c1-d32d06069517", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089758, "uuid": "14782b99-9a89-4c58-a451-1cafae9b21ea", "value": "Versandbestaetigung77906858586.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ca02d7-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089047, "uuid": "ffebf371-ad48-490d-ab9b-516b726838ea", "comment": "Malware payload", "value": "343c18da4b1a037eb44fd6e757b8f2ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089047, "uuid": "29a3dcff-8fa9-44a8-9588-f9d68f72603e", "comment": "Malware payload", "value": "bf54195e7e6de7b9df522867dc4029d47fda0d3424b6aec12993ec293ed9922f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089047, "uuid": "2eeb4fe2-b267-4f81-909a-eb93f7860d01", "comment": "Malware payload", "value": "9c1767924624cd0cc7fe007bc994fc6b07b3abb3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089047, "uuid": "c2463a71-3677-4dea-b20c-4f7705cd8cf4", "comment": "Malware payload", "value": "b9ee7d8440a8284788e039ef5383d59c8fa9377bd553ff15027748e0217f4813f2ca9757d30959f4367564bfbbbe4359", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089047, "uuid": "50f3bf49-6d85-449b-900f-31e6888fdb79", "value": "T1DFF422A3E6D48027E9B51B7028F307A70379BDA5ADB943B31364689F1C726D85931B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089047, "uuid": "57eb20f6-3c07-4bb3-b3bd-7030e5e746a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089047, "uuid": "9441ab78-0e29-4c0e-a1af-11ad94858bd2", "value": "12288:1Mroy90LzfeO+3NCqbcHJcqmisW3EC6phoIDsLiGK7P6njorJkYBfUzNZmP:5ytLCqbOnZERGDKGkkYBfUzyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089047, "uuid": "0c8a2561-04fe-49d4-af72-95bf8226a86c", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089047, "uuid": "27f5782c-8a72-41fa-b694-808cf67db2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089047, "uuid": "fc0cc69c-cb7a-405b-a4bf-ba40454f5833", "value": "bf54195e7e6de7b9df522867dc4029d47fda0d3424b6aec12993ec293ed9922f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7279ccc0-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089048, "uuid": "8fe62d60-9993-4920-a953-9b279d85685f", "comment": "Malware payload", "value": "13455b536e0d30787ecc4c2f0c12cc4d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089048, "uuid": "f75b3645-bc16-4527-951b-269095e58b9f", "comment": "Malware payload", "value": "bf6596759ea62723d53032294de97c753fa51b46db9b49ff16cf14bdbef671f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089048, "uuid": "450993cd-cefc-4353-a692-68a3db0239e7", "comment": "Malware payload", "value": "d8084d2292a71a5b77c348de699157d815de4bd3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089048, "uuid": "ee927709-85c1-4f14-b86a-51901213d8e4", "comment": "Malware payload", "value": "bb6ef95a0d29c24978522331158f5e8b13c746bcc675a15fca7809965c1bb9fd87758b6dd9e8671d99244343936cae6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089048, "uuid": "a6474650-8119-4ac1-b3c4-3e6fa739095a", "value": "T199452307B7E28070E9F02B7098F207631676BF626AB4D7272367246E18F295095B537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089048, "uuid": "7003074f-64a8-4918-bad3-375142557ca7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089048, "uuid": "03108434-3d14-4fe8-af42-1d3e9748bc63", "value": "24576:gy1W2hpikc9STOo5jn3m+mS/v/7YGimVDMStCWl7go+7uMEEzh:nJhO9S6SjbEGim5n71+7uME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089048, "uuid": "454f10fa-4ab9-428d-ba76-8ad042ac8412", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089048, "uuid": "d3f40f98-8a1a-47b0-acb1-2279fc91e8c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089048, "uuid": "037a6e84-2332-4d18-a4f7-02daf07e03f3", "value": "bf6596759ea62723d53032294de97c753fa51b46db9b49ff16cf14bdbef671f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208973fc-f1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684023627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023627, "uuid": "de20aad8-5e0f-455d-8596-1a23b24ee218", "comment": "Malware payload (RedLineStealer)", "value": "ee0da89ff62475fe63a8cd12c7134c5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023627, "uuid": "61222eeb-d471-42c7-ace6-968e1a349304", "comment": "Malware payload (RedLineStealer)", "value": "bf9b23735189bb58ae003a5e564b30122cf9a456af4fcff008a16fabe310697c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023627, "uuid": "2f2d2cb6-8906-445f-90f8-406e8eeb184c", "comment": "Malware payload (RedLineStealer)", "value": "415756cd476276c6987e2328f47f3e4916a9e355", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023627, "uuid": "67537f70-4c97-476f-bbe3-ae567ae19d50", "comment": "Malware payload (RedLineStealer)", "value": "490170161328c42299ba1602b353d764bd81c0feab8b5b16010cb8d847d2fee1d34d39ca765a6588e3a2c5ec3edfb95a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023627, "uuid": "252fa57c-636f-465a-828a-96826d9b8e90", "value": "T11CB5010D2113B3EDDCA0733B8A2AAF55C6F45D15952280AD3AD4BE77E6B2F82053D643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023627, "uuid": "db6f9221-2644-4fda-b05b-70b74c1efa83", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023627, "uuid": "f7e4549b-71bf-45dd-8df5-639c6e266365", "value": "49152:Z0kRpU2miJlm6qoXgjY3MuKlQ8T1/9gu8My7McAO/w81:m2pDmirtcY87QUFgu8MtcAO/j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684023627, "uuid": "43c7f0cf-6600-432e-8422-1d0e0a722188", "value": 2410408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684023627, "uuid": "064467cd-a4ee-4ac5-918a-5653e5053243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023627, "uuid": "4e028f71-8390-49e0-9165-003c86c2252b", "value": "ee0da89ff62475fe63a8cd12c7134c5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73557f28-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089049, "uuid": "7648f375-d47e-4558-927e-71ddf6827858", "comment": "Malware payload", "value": "2fb2cc95959cba07d07fce3de4cd7292", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089049, "uuid": "277f8a3b-1e93-4a39-8a73-0adbc0304bcd", "comment": "Malware payload", "value": "bfa12b1c6e5f3c58b25ab7463050c395c92123ed5a282e8b37f2d600a8ad4adb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089049, "uuid": "3a464775-fcf2-4e82-b58d-254645e57f0b", "comment": "Malware payload", "value": "90755c28a1424c68fadedc42b94b14fc014c2e64", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089049, "uuid": "4cd77245-d78b-46af-81ae-a06fd504500a", "comment": "Malware payload", "value": "a7586ba314e5f53505aa8e5a6d3907129a47452b2411e6372775ea3408636efacdf4121d44785026fc6259cb00ceb443", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089049, "uuid": "73bdaaa3-d48e-4c71-9e32-5bfb14db4a5e", "value": "T171452352FAC040F7C8B52B3024F247831A3ABDA0593D935E6305F99E1EB32DA52B1767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089049, "uuid": "24f49c72-41d4-4b70-8e19-ea6cda8a999e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089049, "uuid": "2f9cb838-3745-4c07-8802-9aff8370ebb6", "value": "12288:QMr7y9003MVP7ShuBfO9dKfW+z6kmZK3dfqbheASbN3tZqzDAVxfaP7xxiFgYWon:7yt3MSkE9IlzOZSl/bN3O/P7x+FFCGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089049, "uuid": "a2a0ddd2-4857-4ff6-88b4-432a859597da", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089049, "uuid": "2c719762-b031-4734-8889-37d08b4b615c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089049, "uuid": "194dd5f0-1248-4814-a5fd-a3f417162d2b", "value": "bfa12b1c6e5f3c58b25ab7463050c395c92123ed5a282e8b37f2d600a8ad4adb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dbc0c7-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "af2a8c93-dbea-4ff6-b73a-3176388b1044", "comment": "Malware payload", "value": "0d3a39e0248ecb08e928512cb5d67739", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "0e3421f0-3344-479d-bc57-d9ff972689c2", "comment": "Malware payload", "value": "bfe771f65311c2f4b103ec164b05acdab89166a8f24064215866de1a14a6e979", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "cec136be-9db6-4298-86cc-44fdb4848acc", "comment": "Malware payload", "value": "aa2218213aa8fbdb9b502e2ce03bbaf8cb494b30", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "05087cb9-981c-4db9-adc3-3ffc09dda38d", "comment": "Malware payload", "value": "244c6044c92548628e348ce1c889f962178744f3a5de7b142c3e27b9e1d6e96fd7a6649f50c3aa0d3ddc6ea6d10e1039", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089673, "uuid": "5bd97b03-9709-4a8e-92e2-890a3d9ffa61", "value": "T12F54F1D2F75CC874E1DB593AE7602797623AC0E51221BB3606067A1C2ECFB7246D8DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089673, "uuid": "95631347-9f3a-4152-a4e5-de052b41a6af", "value": "6144:rTd/XUXXLvLqlUyq6xRdubWgQZX+9Lq6Uro:r1XUXPqlUyq6x2NHqnro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089673, "uuid": "5369423a-2fe4-41e1-8906-6af14304d1ad", "value": 290992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089673, "uuid": "1901515d-fcfe-4a30-819a-60d0f0dd3786", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089673, "uuid": "3fb11f95-a8e5-43e7-ad9f-5e18f01a3f5c", "value": "ShakeToFakeFakecall.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc8c916-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066891, "uuid": "eddf140f-364d-4679-801b-244b6e215642", "comment": "Malware payload (Mirai)", "value": "ec79ed8d5a322267cce6f1b9d8cb8bf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066891, "uuid": "4d93eaf6-367c-4258-aa03-62a160ed7659", "comment": "Malware payload (Mirai)", "value": "bfee34cf8d59f0fc258507d26f53b560fa5388f604dd56ff98bbad888857cef8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066891, "uuid": "760584b5-42bd-4b8b-8c7e-c2ec9503cd27", "comment": "Malware payload (Mirai)", "value": "18b2b3c1ac94f8c93341a554fce8dd3752489440", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066891, "uuid": "f7623bbb-292c-450c-a25b-0d66d634b8b8", "comment": "Malware payload (Mirai)", "value": "695d538a49cb68db714b3f969d2863e8c6aa235ae874d0bb87bc45090f6a243af32538f0a269a7e4ad9447bacf1a2168", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066891, "uuid": "aac318d9-b69a-4a20-be34-021ea3e4c789", "value": "T1D323F18F1CA038C3DAFC94FE685D2593CE1DD054250B4E4F92D96DA39A3D8033BA89A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066891, "uuid": "ce012b79-76f8-4088-9485-8cff5e258580", "value": "768:lAXsyb2m5IWs6QPIMuYrGmf0jXMOrCJREvJZoFVk06b/xnZF8W2DFKdPRcMH3NNk:TY3IWs6Qwn/9bMOgGZoFVkvDxZFJPyMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066891, "uuid": "fa9eeb54-0b2b-495d-8579-7ced3780f8f1", "value": 47808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066891, "uuid": "4f264ab3-1b66-4ac4-8864-d7c52f9370a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066891, "uuid": "9b7bb259-a56a-49b2-ab5f-e2862f50be76", "value": "ec79ed8d5a322267cce6f1b9d8cb8bf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74105a57-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089051, "uuid": "8e90006a-01cb-49b3-a02d-61a37f5fc518", "comment": "Malware payload", "value": "80bbbd2409664aea72ef89b6d61f3453", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089051, "uuid": "3a1144cf-e03f-4818-9099-33b8ec58af70", "comment": "Malware payload", "value": "bfef5a30eca62fa131921d05125a1067bf10939b2370dcfa187befc152ec1d96", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089051, "uuid": "482afb37-d525-44e7-8ec2-15edef8575b1", "comment": "Malware payload", "value": "256e61e6982b8eb8f0132265ff158e89d5b2029e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089051, "uuid": "bb2b3247-b699-4aaf-9d7f-b0e207029b5b", "comment": "Malware payload", "value": "9c233bf7bcce2835ed091700957be11af45977f5baf2b05363142d8392e36c7997fa9dd5ff10e42f3a58aeb81c209967", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089051, "uuid": "990a37fa-6175-4067-9d3c-a5f653883545", "value": "T19345236266D09032E874BB3048F303970B367CB46E78C7BF7399259A4A7261991B573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089051, "uuid": "921bc831-948f-49b4-ad20-67009c5cdd28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089051, "uuid": "67f5a7a3-36ef-46dd-aac2-520bf1418339", "value": "24576:myLXAzwZPQ3m7gdmvZ2kevMcoGZoU0mtjRD1yxNHKLv1:1szwtQ3lkUdvjZTZRD1Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089051, "uuid": "d53cba5f-48e1-4829-90d3-12435512d1f3", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089051, "uuid": "3f6fbb36-3a5d-400e-ad7d-e1afd663bcda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089051, "uuid": "d229e7a9-4d71-4df1-b57b-ebb72c5a4c2d", "value": "bfef5a30eca62fa131921d05125a1067bf10939b2370dcfa187befc152ec1d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768f325f-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089055, "uuid": "41848779-a3c7-46d4-b854-d444248d142d", "comment": "Malware payload", "value": "596bd809fd8c97a9a436ea78d96ad059", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089055, "uuid": "3c01af09-f5e1-4b71-b4a2-c193a37f8622", "comment": "Malware payload", "value": "c046a3ab7b078de30ac65626becc7ed08f88c78aa94b0073f5d857d394edb9d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089055, "uuid": "5aa73e0b-ce7d-4102-83b8-ce98d896da06", "comment": "Malware payload", "value": "9ba93f55a17ff1e5daabc30371aec450357e2f8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089055, "uuid": "a629e118-7399-427a-8288-e575891c7b80", "comment": "Malware payload", "value": "e1bfa70889a982586e0b6784485ddf2e9ece052a2a2da521fd00ac00f3d497f994f58cf0d5dfd8724754db47d1f27dae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089055, "uuid": "327b48b4-19ab-45e1-829b-9aeed2f4abe8", "value": "T1E5452216E6E8C435DCB857B45CFA03C30F367AE25DB8865767869C9A1CB36C1463232E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089055, "uuid": "a893f1a0-8aeb-4724-9922-34e70e62fb10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089055, "uuid": "67de9839-315f-4a5f-a862-07377cfc30dc", "value": "24576:oy7OEJvQlSfQOhgvzVnnc5Ds8k22IZQiI+1TQKM6g+nl85Fn7Nrlep04:vCI7YOhSzxYFZ2AwKM/5B7NhA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089055, "uuid": "b3ad5f10-383d-470c-9274-3dd89ce9569e", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089055, "uuid": "ab6669ab-e2cd-45a0-be16-7789faeca46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089055, "uuid": "c8fc45f8-5c49-4758-8d5c-2e0a6a64b7bc", "value": "c046a3ab7b078de30ac65626becc7ed08f88c78aa94b0073f5d857d394edb9d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4655feb1-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089833, "uuid": "fdeaa815-66ad-4477-966c-ba58325a4d74", "comment": "Malware payload", "value": "b9ab8f54c950292299208e47e6bca637", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089833, "uuid": "bb62befc-adc2-4089-8aff-e34ca15983f6", "comment": "Malware payload", "value": "c05a1bf77942a5cd2ea2cf5c5adf9a3dfdff2f339123d89117d000b2e2a5500f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089833, "uuid": "e2d26e5b-1498-4960-b193-4ad83cabb562", "comment": "Malware payload", "value": "7c341b13eb46d6c594c0dead425cad247d77f9e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089833, "uuid": "256b0385-eef5-44d1-8da5-264d7886607d", "comment": "Malware payload", "value": "c48640c101be30ebe8c46ed769471bb17209f1daa0f166526b859308a28cf367a172bf6d68e96a22bd0667dc94a51b46", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089833, "uuid": "99b50620-7cdb-4cdb-b197-8d6ee4135816", "value": "T10E1454D04B2168659B5B7C76BB20B5A5EBE50EB4C290839FF49B33A1B2CFA0CDDD0514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089833, "uuid": "287d75d2-0389-4f04-af09-36270d67e169", "value": "3072:pTRPVUnFm46kFmt0yKoT0Y0dUYg6AwvitDylzxWu6GXt/:p9VUnFm46kFmt0yKoT0Y0d7otDylzxWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089833, "uuid": "2aee8eb7-0aa4-43fd-87d0-86fd52a2484c", "value": 193861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089833, "uuid": "8467008f-6f48-4105-acf2-750df2b068c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089833, "uuid": "52ddb946-a96c-453f-a382-ebe98d068342", "value": "Zgug.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772c8d5d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089056, "uuid": "aa4c7faa-a68d-4c48-8bce-1c4cf0b9695c", "comment": "Malware payload", "value": "298d09452bc01c05c30b8d67aab9e9de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089056, "uuid": "e1986859-8fcb-4187-b9c1-bd5999a589d9", "comment": "Malware payload", "value": "c06a652f1fe956bf1c83d0bdd807b767a54204a3c42b5e0b9ac70aef7cfec181", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089056, "uuid": "b91b292a-9875-42e4-8677-6a628951d93c", "comment": "Malware payload", "value": "83324a76683d2e0c214c3ab48de430977b07fc46", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089056, "uuid": "52db9af5-8961-40e0-b50d-f86f2ffeaddb", "comment": "Malware payload", "value": "9fbabf97bdf965dd0231b9e8b69fcb20c7dc83805e41d1e96f6b024f56db7d573675ca5556a95e563e2db02c31c79fd7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089056, "uuid": "11b48050-af43-40ed-bb1b-d34e7cb33b1b", "value": "T108152205FBF48062DDB92B7018F642431A3ABCB1CD7C932B19819D6E8973685A47673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089056, "uuid": "02e9029b-a0bf-4297-9262-daf3d57b3341", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089056, "uuid": "5a050823-591c-4452-8cfd-604e9b8bd586", "value": "12288:3MrOy901E0rlO+4F12lyvEP7BR9lPGb1fJQNLzTxa6yIsvHhK32xoJXq2WXM1d3P:Fyr0SF0m0RDPGb1EzTxPhZG72uM1df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089056, "uuid": "221b9315-f1b8-4a5a-8297-6177c56c2c40", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089056, "uuid": "c463f30f-ee68-4e28-8d6c-5a078d8af56f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089056, "uuid": "9cce6d2e-73a6-4e0b-b22f-fe939f3a98aa", "value": "c06a652f1fe956bf1c83d0bdd807b767a54204a3c42b5e0b9ac70aef7cfec181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e13483-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089057, "uuid": "4d0ed2b4-4194-4653-a170-7737621156c6", "comment": "Malware payload", "value": "85658a29a32dd8e2814e10523c9961b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089057, "uuid": "25db41a1-eab2-4edc-9737-5c0d9cef7fdd", "comment": "Malware payload", "value": "c0a6e8fd3592907f68f4897c27a542a5d449bdce23d8333fc52325e1a4a361c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089057, "uuid": "0f8f41ab-19b6-4397-b744-5dd18d30d57b", "comment": "Malware payload", "value": "b96997ae100fdd88809a8e76461019ad3c8597ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089057, "uuid": "a4ae24f6-d8e2-4536-a2ef-ccccba5f27d1", "comment": "Malware payload", "value": "2fa734343829933ae807041770ca51e0c0dc489ea92de928ddef5f1edbd8ec5b89fd76cf7704547619f85b68397358a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089057, "uuid": "14b4ba90-16ad-4e35-9620-e63fedb5bdb3", "value": "T1354523636BE400B3E9F56BB054F603930636BC61AC7A576B2353749D0EB2B98A530773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089057, "uuid": "2e37fab8-22f4-47a8-afec-37d9f3e65a08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089057, "uuid": "581b6aa0-c74a-48ec-8cea-c131143ef9d5", "value": "24576:fykJ9a+dtBLgBjwCKegUeuKOntAeP+9h5TU/gDpiqO:qkZNMBjjZpv29h5TjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089057, "uuid": "28e82005-2a74-4f09-a6f8-74bdb75dfe68", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089057, "uuid": "30ec52ad-5c7a-4612-baa9-9f2dc20acf55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089057, "uuid": "4f4e3965-adea-4c05-91e7-1a0c71fbaae6", "value": "c0a6e8fd3592907f68f4897c27a542a5d449bdce23d8333fc52325e1a4a361c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ca8a75-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089058, "uuid": "0de08eec-5192-4db2-908a-350a7f5f5549", "comment": "Malware payload", "value": "7c32cefa355bd986aff865853a73ebf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089058, "uuid": "bf6495cf-d6ad-4192-9370-a07ce40ebe01", "comment": "Malware payload", "value": "c0a6edc326c4fbf68d2d2921a476312ca4448e95a20052741d6f5d734524a473", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089058, "uuid": "85ca9114-dac3-4c56-be79-324c801388e4", "comment": "Malware payload", "value": "e0db361991814e326e641098708c8118ba0af3ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089058, "uuid": "e374b0a0-7291-4408-af1c-d26d468d8403", "comment": "Malware payload", "value": "d1107f21db68054b2625f4f8fc53b401880c51ebfe6bcbaaad575cddece7f7bf855f262ba5919731a8afe934e17d2bf0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089058, "uuid": "f16a5f2f-9936-4642-8c66-b71f127125cd", "value": "T1F045234396E55471ECB107B59DF602830B3ABCD06E7287376B4A698908933C0BE7677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089058, "uuid": "121bf101-cab1-4066-9d06-61d6a9baa8ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089058, "uuid": "8514ebf9-36cb-4b05-b379-52746ad64b0a", "value": "24576:vy9DqPVh5yRUb8UoWR2TBDbmdOGkcbdIK1qf7wUdrNV84BacDHocgaCUNQX0f:6WXyRUroE29GdOGjbdIKEwUdrNVRsciF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089058, "uuid": "f2cd4381-d845-421b-8017-3cfae49b68f1", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089058, "uuid": "d13b8761-8831-4143-965f-db54a2bf4eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089058, "uuid": "3577254b-008d-42d2-9994-7ca5b52429fd", "value": "c0a6edc326c4fbf68d2d2921a476312ca4448e95a20052741d6f5d734524a473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2488c7a9-f257-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684069160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069160, "uuid": "f5a4b0b0-621e-4250-b598-636098ddc8d0", "comment": "Malware payload", "value": "f63f1b3184000c80f44019b507f23e54", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069160, "uuid": "285ed3f8-1ba8-4c88-8bd0-0f4647e6a52a", "comment": "Malware payload", "value": "c11752e116389754442d17300dca7f3ea668748d495e2307a6a61e1d68b11f96", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069160, "uuid": "e548c335-5167-4b48-b392-05857dd4f202", "comment": "Malware payload", "value": "aa167d3e43c68bbbb08542b26a3073aa7660578c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069160, "uuid": "d42bd2d2-cba1-48d7-ad96-2b93ee0535e6", "comment": "Malware payload", "value": "e73102ab05da52ad750fb60a442ae5b295b60cd29a19ba10b487f3e1b231e21fc10506f6fcd150e64efd519cf640ebf0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684069160, "uuid": "baab9a7d-7b17-487f-a236-364daf69abf3", "value": "T1A1C63328C3186B633D2DE8787795814AD4FB705A174C6522E53895BBB3239F6A3F18C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684069160, "uuid": "d3cdd52f-ef96-4322-bca9-be3dfcf60d9f", "value": "196608:+CkRdbQnizH6HuhPqiTMaoQXmUoGPdGY5y7Lf/8McxP3d1nIUnMYcazq3+tmCgJ:+CkRqiT6HuDMyXmUoKIY5y7DE13PnI3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684069160, "uuid": "9b21261e-7eaa-4294-adb4-6595b3ff135c", "value": 11539001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684069160, "uuid": "d40e62ba-4f68-4f8f-be35-b5bf10f95e65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684069160, "uuid": "f315d38c-c85b-41fc-a0cd-26e0fd1e368f", "value": "ChatGPT-4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a358c78-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089061, "uuid": "b005779a-0f13-4d4b-a866-ca23048f1917", "comment": "Malware payload", "value": "28e80e611423ba3d18f60d6ba20c656a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089061, "uuid": "ea0f4ceb-d432-41f8-b801-db63d9a8c641", "comment": "Malware payload", "value": "c12a6f419e8e511534100fb51f7ddb97f1157dcd7d147c6dfba1dd768017c454", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089061, "uuid": "eb9fc518-5ada-4179-8ca5-c23c75435dc7", "comment": "Malware payload", "value": "4eb0b7f3f06efdd8727b7f0b5ae1bad1655c5e4b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089061, "uuid": "62c6690e-8773-49e1-9ec7-c840bff6f7fd", "comment": "Malware payload", "value": "c8f9b99d148a22c6eae05c78742685f30772af50a31fd91401ee380b2ac6e0bbdcc124fd44099f953e9f04dd536a7e26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089061, "uuid": "872258ed-10d9-4e2d-b161-51b526296f07", "value": "T1B4452323EBE48471CEF897344CF353A71F367C62A92992A707456C58AC333C5A57136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089061, "uuid": "8e221ce1-7ea5-4e19-9fc7-291e83447d95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089061, "uuid": "b425b7ce-8a78-4eb8-8e9d-c66f97119aea", "value": "24576:RyJKxO+ct10XG6lLytdBpcTUPuERuPaG8DDLD5hvLmUdJ+cYAP6fWM:EJKx61vEyt6WuoDd/L/VdJXnP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089061, "uuid": "25bf0f78-4040-4965-a708-b5cea04d71f7", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089061, "uuid": "6ff5925d-142e-463f-95a0-9fe06f6d8850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089061, "uuid": "b988b5c5-cf5a-465e-973a-cac682fcbca8", "value": "c12a6f419e8e511534100fb51f7ddb97f1157dcd7d147c6dfba1dd768017c454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acebee7-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089062, "uuid": "034ebf1d-cfd7-4b94-961e-ab23cac0ee7a", "comment": "Malware payload", "value": "c1c132a8b1001bf5addba89b2bcc1847", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089062, "uuid": "33e46a6b-fced-4ceb-9a96-0989100a16ca", "comment": "Malware payload", "value": "c1369a03eb8015db8e474ae1afb7e9a3773f455da3f4795b34ff428017f1fd31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089062, "uuid": "f2c8f821-4f3d-470b-9138-c01cdd69d6c5", "comment": "Malware payload", "value": "83c86bccb24c0a7a94bd7c37e1daeed08496cc67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089062, "uuid": "aebc666b-82b5-44d9-ab9a-42224810f8d9", "comment": "Malware payload", "value": "ca94811ef3894698c8e661c059dc4da53e92895175a8956a81b04a6194795f8494f8c0d8c94e9e86c751306702d93605", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089062, "uuid": "8a4b1358-9e38-463d-9655-f1a0587a6c10", "value": "T1A305229287DA40B7E8F0277058F617D32B397C766538827B3302A8DF4C726946A7572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089062, "uuid": "e6e35c39-ca0b-4d83-aacf-a32222b3e892", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089062, "uuid": "c093c6e7-46df-4297-832f-fe580a963191", "value": "12288:IMr5y90Tu5tvCWoqtEwLukrX7mPsBUdlAR2CaTnPKOVUdkZt0rvpT1lDE:hySuaKV5rrJUXAR2LTn4dkZtGvRDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089062, "uuid": "a45db6c6-0aaf-401b-ad63-31812622d96d", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089062, "uuid": "d0095666-9c18-48b7-a23b-6df3a213f213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089062, "uuid": "3f6ad236-e4a8-4760-9b2f-772a1d59e39d", "value": "c1369a03eb8015db8e474ae1afb7e9a3773f455da3f4795b34ff428017f1fd31.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8c7e67-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089063, "uuid": "3efcfa72-90be-4189-b6c9-6c1359fd8d94", "comment": "Malware payload", "value": "99790e893348ed77852fb1a984f21f5d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089063, "uuid": "c92b712a-22db-4faf-a576-e189637b8410", "comment": "Malware payload", "value": "c1466a5ab7c78f4e1ecd1c6a84c6b5e111adfd420b5f78ad407616fb74d1dbf1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089063, "uuid": "27b52931-53b7-4e6d-a4fa-a4014663135f", "comment": "Malware payload", "value": "647cf23196518d4ac00afef4840ea3a8b88aed6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089063, "uuid": "a5d5cfe7-4585-4eb3-bc5a-f3831c49922a", "comment": "Malware payload", "value": "bb04940c5b5cf5c6e144832883407bda31c2a4a491a318b5acd648de01582e431c7d2893d4a0691c940fb04a9619c9e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089063, "uuid": "897abe2c-8f70-45a7-b3f1-ae6577d2d9ad", "value": "T157452302B7F56131C9F01334A9F356D31B32BDA22D7443FB669A9C891C72580B6B8767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089063, "uuid": "49824aad-e7b3-413f-be09-cfb581269e37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089063, "uuid": "4885e105-b176-41d4-81f9-e25875b466fe", "value": "24576:GyNIzOj6A1fqikUVbKnhX1jURHelOxIfGvEdCkxLk:VNICj6YvkSbKnzURE+Iu8df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089063, "uuid": "1959877d-aa40-4c2b-8d29-7d99c292cb2a", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089063, "uuid": "50a5d4d6-3231-430f-b87e-f1a497e25f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089063, "uuid": "47e40180-d1f9-456b-84a4-f018fae0b812", "value": "c1466a5ab7c78f4e1ecd1c6a84c6b5e111adfd420b5f78ad407616fb74d1dbf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d44581-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089557, "uuid": "ec7fde20-a7ab-493f-9e80-1ed8f0636bcf", "comment": "Malware payload", "value": "f89bdf006dfc2932a86c8b05e6ec8aab", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089557, "uuid": "4b6dbbcc-5012-4a8b-b642-c567ded3b72e", "comment": "Malware payload", "value": "c15093cf81adaefa9172a9907b8abfef5bc41f6f4984d46d371173ff27e227a2", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089557, "uuid": "84b2e317-2a0d-4b68-9786-7b0c56f78ff6", "comment": "Malware payload", "value": "5ca348715893e5653f9b1ff133d0ea8024688bb7", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089557, "uuid": "0686f778-569c-43ad-b42e-f6545991708f", "comment": "Malware payload", "value": "6c94d53ea1d60ab0836828b9072f2029626d7130cdbb01feb4df8fe87f46177abc2c0f16647296afb37d55d783d72a07", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089557, "uuid": "5f2c2784-43c6-441f-81aa-0727830f9a3c", "value": "T19E8523839E1BF492F244A23272F49FC624E26D8142819F6A34CDF67CAFF5B51940479B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089557, "uuid": "2e68861f-915b-4eea-86e7-87e5e85edfb8", "value": "24576:fBsk6/rSToHwcBpx05vFM7tId8bDd4UdwPb5pxfQIzjMhS9aw4skC+Vy8DzGOxS:yZ6Q05tutIy/dhSb5pxl/MhS9ysk/gBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089557, "uuid": "cd2726d7-418b-4caf-83cd-561918eab4ca", "value": 1786938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089557, "uuid": "9a174a86-5808-41c1-829a-41ac9492051d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089557, "uuid": "8192a50d-e548-47b9-a149-74e1562b3c62", "value": "F89BDF006DFC2932A86C8B05E6EC8AAB.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c432f5e-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089064, "uuid": "b6662a6e-88ee-44fb-9e35-44cd622efe2a", "comment": "Malware payload", "value": "3736ebac8ad2662e6d17cc78fe6f6673", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089064, "uuid": "1130e36e-6353-422a-82e7-1b16a06300a7", "comment": "Malware payload", "value": "c179666ae4c3450919dfeb0d6cadda88547b75badad6207f87cb8bfab7fb1d83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089064, "uuid": "8c4717b7-db67-4c02-8e90-0d190ef64936", "comment": "Malware payload", "value": "25186ff77d11241b277de2c29d59d72accf5f24d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089064, "uuid": "45f7d449-05b7-4f41-a3ef-0665816fd9a9", "comment": "Malware payload", "value": "a96ac9b538bbe5750c9d44c7045e8398b826cc9a2d52a1f1495507db8f52f1cf4c353e474a87ac705b3c502685f90f8a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089064, "uuid": "0089d3a4-fea3-4ad4-8b7c-938834e9b8af", "value": "T176452302D6E4903AD8F51B315CF602C70B32BD929A7987BB15CA68260D331D9DEB17B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089064, "uuid": "6cbaddb6-dd84-4e6b-9e03-5530c86ef228", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089064, "uuid": "d9e91f59-cdc4-4a50-a4ae-21cc77796f41", "value": "24576:+yZ54Ix89ywkUynnRX10jS9+pTDWF5rXu0fuQ3TSJTyjFkC6Bn:Nbuypdnop2rXpmQ3uyjen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089064, "uuid": "7b97bd50-69a8-4447-a535-2dad650fef16", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089064, "uuid": "5ff3c7bb-2713-4c73-ac2d-548ed5b9f591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089064, "uuid": "00b6c6b8-ae9c-4b3a-aa91-31f82c8d1227", "value": "c179666ae4c3450919dfeb0d6cadda88547b75badad6207f87cb8bfab7fb1d83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d81c80f-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089066, "uuid": "9c6fff33-dfce-4add-919b-ae344555919d", "comment": "Malware payload", "value": "cc0e622f7749bd9aeb885942b91d8e1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089066, "uuid": "3b794278-f72c-426c-8aad-cdfad0433692", "comment": "Malware payload", "value": "c1cfacdb58118e9d7766a5621dd7d9b0a6f50db8bd59b6fc694c109ecb001d42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089066, "uuid": "257fa193-5607-477f-98cc-34ea35cfe4f1", "comment": "Malware payload", "value": "fa3d212c83ad69a57b432a06392ad4dd7fffc2ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089066, "uuid": "8de0ab4a-4168-4a2a-b58f-66f5ea5cc50f", "comment": "Malware payload", "value": "bdf694f5f0319de0e040b29b50bccab69c4b2371087457e4f494e1b930027604b512d6b0a1901f62938aee205ffa71cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089066, "uuid": "cce01e3f-2f43-4b32-b2f5-d9660ed98847", "value": "T1BA452389B6E89165ECB42BB189F743D30F31BDB1793842273756048A0CB39C597B5B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089066, "uuid": "7612cd47-a3fa-4304-baed-c81910d7b29a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089066, "uuid": "520b1a3e-f587-4bc1-b283-f3b4241e1dd1", "value": "24576:2yxC6UrBDFGoL0k5CArkAsX8Qh8LHwaELnxtuKd3RuXucJ:FRU/I0rEh8oLuKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089066, "uuid": "1ab61cdd-589b-4648-9a8e-81f9ab9c132d", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089066, "uuid": "afa823fa-a866-4f76-946f-42d9fe3bb23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089066, "uuid": "944722c8-542b-4e6c-bb70-2faf1d3c06bb", "value": "c1cfacdb58118e9d7766a5621dd7d9b0a6f50db8bd59b6fc694c109ecb001d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e35c61c-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089068, "uuid": "f59461f0-a2bc-4ff6-b70c-63601fceb58e", "comment": "Malware payload", "value": "a5d928a181d059e0fc5f5026cffb2986", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089068, "uuid": "24a907bf-73e9-45ca-af8d-0ce85ab8d5b1", "comment": "Malware payload", "value": "c1ee5908dd2d0273bb18b08f0dcabe2a4614d894d69e81420a565be0f0c69ab0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089068, "uuid": "64ae6f26-ec9d-47a4-a3f8-f4d58e2ce262", "comment": "Malware payload", "value": "89030bfb0fb4b4699d06488fcbb061cf841b1d66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089068, "uuid": "469cde53-85c3-4a95-a3a9-649f46755620", "comment": "Malware payload", "value": "46c9a56878ed81ad334f4aa6f7ec81cb89339706ca6888ed184372505347086cc494d8557d9db104474200dfbce0595a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089068, "uuid": "f60d740b-5d66-44b2-be43-99c7ac8276e4", "value": "T1D4452313A3F56435DEF62B7429FA06831F3B7C616978436A1385A9CB0CB37D0A4B531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089068, "uuid": "62d9848c-11fa-4d7d-b5a0-7ef0cfc56d56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089068, "uuid": "7679e5e1-3ff4-4152-b33e-a31d229e93bf", "value": "24576:HywN2pJ45HMIN2WGD7XrRdWKukaXGbUJTyzx+zuPZ:Swko5HqdXX9dWKdW+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089068, "uuid": "39a1b737-5a3c-4081-86f6-7985aa93104f", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089068, "uuid": "2ceabb27-529a-4ad0-a39b-8cdcfb4727c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089068, "uuid": "db4c6647-56e4-4a80-9e5e-8cc8329ee7bf", "value": "c1ee5908dd2d0273bb18b08f0dcabe2a4614d894d69e81420a565be0f0c69ab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f65d86b-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089070, "uuid": "01e9bcf8-c67c-47d4-9798-a4c2505fc683", "comment": "Malware payload", "value": "7462a01ffb03452824889d6d17653e7a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089070, "uuid": "0f33228f-bbcb-4f65-97af-89c87260783b", "comment": "Malware payload", "value": "c249e16fdbc5f9c8b653752422151e6577ecb3586881dc51203a9ecf471a354d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089070, "uuid": "ae3a4f97-bc94-45a6-bd5a-acd727c9c234", "comment": "Malware payload", "value": "ebb99a7549eac4a1f32a3ab61634c2680d2c0a52", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089070, "uuid": "d460b5f3-7d7f-4f58-b333-bed5e208624e", "comment": "Malware payload", "value": "f1a17c93e9099a5801a4a6084a219592546f9a294a83bc3b0a313f67af76326360c57c6d66a00c1dd1e8c05f0e615b6e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089070, "uuid": "50f53f15-42fd-4b95-8cb1-6468d8c301aa", "value": "T19D4522128BD98271FDF617B46CF602832B39BC965475926F2BA1685B5C333C03A7136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089070, "uuid": "72bf6254-9fe9-4c2a-ad07-d26e2f6e2bfc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089070, "uuid": "6ea8fd68-3b7d-4f54-b2f3-4fa3a6b5db32", "value": "24576:6yRypuhuMbKTyAG2rfvp6cWHsvhO3lmY7+F:BREOfjAGcpam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089070, "uuid": "fae9c0b6-c404-426b-84e3-7143666ae2ff", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089070, "uuid": "9d7907b5-8884-4acc-a34a-11d3a727731e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089070, "uuid": "eadb53de-0c40-48fb-b8c1-475c90d3e685", "value": "c249e16fdbc5f9c8b653752422151e6577ecb3586881dc51203a9ecf471a354d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd46f56e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089710, "uuid": "8ca8cb3e-73e3-4994-847c-3816b5fad7c4", "comment": "Malware payload", "value": "1253145d0abfa67210c63ceae3d30715", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089710, "uuid": "f2f585fc-5d40-4bed-91ce-428eaa8eec1c", "comment": "Malware payload", "value": "c27ba0d3118130b9ab1edf2d2586850b6aecfe7136757fadc9654d9acafaa8f8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089710, "uuid": "c812aec5-0a04-4bc3-83f2-ac23f4350124", "comment": "Malware payload", "value": "4999355ddefa68e34ee68233b8cd50e42baccc42", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089710, "uuid": "4954c7fc-befc-426d-a8c1-7a4d96e6dcb2", "comment": "Malware payload", "value": "ba7281359072c37cee4ec2560089213929c44b5cd0bc77fa1db6e44b1bbf097f5cefe898f214a102dab3b33dd92da6e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089710, "uuid": "ee1ef483-8795-445a-a430-50b4a02744a0", "value": "T1D9148640429568775B5B7EA66A38D4A19A7E0E7482CC568FF46E3284F6CFACCDCD0331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089710, "uuid": "5333b1a3-0833-4e3c-9e3b-d159dfcfcfc1", "value": "3072:WotWt2hezvQ4/iLW4CCG3WqOaBZW9h+eh4O4iIJDrUU+PWvtj:WotWt2hezY4/iLW4C73WqOafzDrUU+Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089710, "uuid": "1c06a575-25c5-4e5f-9202-ab400423845a", "value": 203714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089710, "uuid": "ae8c7234-6034-4958-8f19-cdff8ee05df6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089710, "uuid": "d2723e3f-3bf3-4db6-a14a-2ea4652d7287", "value": "Swgyhn.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8002d083-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089071, "uuid": "9ce2ac1c-f058-41b8-9406-541f2323ea33", "comment": "Malware payload", "value": "6b7475147a7123217388c6449cf15aae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089071, "uuid": "5ebbc6cf-af59-4b52-9271-91abdb1e6cdf", "comment": "Malware payload", "value": "c27f551766140e14a35f04c230ed09f28a4df423db1f53dba3bba5046c65bb11", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089071, "uuid": "5bd8a6ff-3e47-41d7-b17e-834206d3ed36", "comment": "Malware payload", "value": "64dc14c525e1ae63193556cb96211075cc964d8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089071, "uuid": "ab87ebaf-428b-4f86-b10b-8a7609103d5d", "comment": "Malware payload", "value": "40433d237f304626429c9dab2e608762aba9a3bba07d8c090da9ec1fbfc5a2a15936dc243bcb4d935bee569ceb2dab76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089071, "uuid": "9e420268-dd63-4527-badf-52688f31af05", "value": "T1BDF42315F7E88032E9F52B701CF612D31A35BC62ADB4976B2789AC4E59722C4E431737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089071, "uuid": "5344d8b1-f2cf-4a61-9008-b1933e827bf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089071, "uuid": "b0a80175-f983-4468-ae39-351a9569f57c", "value": "12288:GMrAy90wnp0c4f/Sv27rMMof6j2VFqBJj+IePaNSxo92KYJNP7PFui18o4:mybqc6Svntftk+iNkdzwi18j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089071, "uuid": "e7d9b849-aacb-4f73-99f5-182f4e8bec01", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089071, "uuid": "869e5546-48fa-4afa-9414-65a27c6c66ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089071, "uuid": "cbdb407e-9a5b-4832-b0f5-ddb117d0c399", "value": "c27f551766140e14a35f04c230ed09f28a4df423db1f53dba3bba5046c65bb11.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c07e11-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089072, "uuid": "ae698349-3b10-42b9-9d6a-4c8ee15d3c10", "comment": "Malware payload", "value": "dd1ef7726d0a1bcc2bd72350c45fa808", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089072, "uuid": "934dac4a-ef61-48ef-bb15-76072eecf461", "comment": "Malware payload", "value": "c287e82212a2881629244095db5fd45d1cdc781eb626799d32c6f32d46539f3c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089072, "uuid": "053ac0bd-a1c4-4adb-bae3-a7beda90a011", "comment": "Malware payload", "value": "195bf80b83bdd1e1c82c6d338e2d2e1c8dfb36e3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089072, "uuid": "45e6f054-b115-4e30-9e64-846089c643b1", "comment": "Malware payload", "value": "f66a17455af5b55a79a046b9e8a7759a8dc296f372ce3b97adaaf267fd5e65efde5929e017201a9a9bcc4e6e4fc0f2b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089072, "uuid": "c3f46a95-743d-4e22-9017-3d851b0670d7", "value": "T1CF452343B2D856B7C4B01FB418F983831B3FBCA21875922B3758994A5C77BA43570B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089072, "uuid": "fd0a8c21-3517-49a2-af88-96f8f86df75f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089072, "uuid": "4c627449-b6e4-4f49-ae27-fc1cdceb9b4e", "value": "24576:6yNaYRuyP60Qw5s6Wa9RQEZ9MliiDzD6Iu8wIbyH0Y3F1E5E4F4U4R:BvEyBQwakAEZOXn5wIA0uZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089072, "uuid": "aed9a7af-5159-4d0c-87e8-582034ad0c6e", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089072, "uuid": "11866555-4773-4a9f-b6a6-492875c655cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089072, "uuid": "5cd6403b-e54a-4967-8d02-f1366fecd819", "value": "c287e82212a2881629244095db5fd45d1cdc781eb626799d32c6f32d46539f3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817ecdbd-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089073, "uuid": "b7ce4811-8807-485e-b7a2-5532627bf4da", "comment": "Malware payload", "value": "a868467b628b6bcd9e1a4368191c1d3b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089073, "uuid": "b8638946-a35c-4229-8c3f-89222a0a105f", "comment": "Malware payload", "value": "c28d1ecc6f937ecab31d839949883796fc93bab11fe62601124d2517eed9116d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089073, "uuid": "e83cde14-d365-4190-b126-f356d3280232", "comment": "Malware payload", "value": "dc0346caee3949a3edf8af562f1a4d9fcd98ac7b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089073, "uuid": "b716720f-37f6-47fc-96b1-457dc891c6bf", "comment": "Malware payload", "value": "484f95841893170644787fb7cf12f9f2ff0053fa8691a45e7d49d8ef53f216677cf97e14a2cd8f78451c03ef45acb657", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089073, "uuid": "a456adc0-ee39-4531-abf7-c136055bd2aa", "value": "T16A4523139ECCD9B3E8B527B568F622C3083A7CA19D3462AF3346584319B75C461737AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089073, "uuid": "f3a10699-ad7f-49b5-bd5b-cdb2c373feec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089073, "uuid": "5a2bcaa2-c985-423f-8f38-78aa31721314", "value": "24576:pyzdaIORl93fVtdSLxcb5D5G/AORu7D9Olu:cR6pVoC2SMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089073, "uuid": "6b51c02e-da6d-465c-a138-4f003aa605c9", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089073, "uuid": "a30db00e-f983-4f81-82d4-5577b7a2093c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089073, "uuid": "a4e3476b-2490-4160-96e7-3c31f5786b08", "value": "c28d1ecc6f937ecab31d839949883796fc93bab11fe62601124d2517eed9116d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823f671c-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089074, "uuid": "425d58c8-3b94-4209-b959-29883f4e65f4", "comment": "Malware payload", "value": "1e2d0dd52144721afead69f8ebf3f8f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089074, "uuid": "4e65bc09-15df-4c58-9fdd-5d43d89f2f9f", "comment": "Malware payload", "value": "c29c1438f18368081f2034be5502959d09a150f6a92538acccc2a359ea6a7a0c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089074, "uuid": "66b3b3f0-d766-46f9-aeb2-05709ac92273", "comment": "Malware payload", "value": "bae8eb90a709a488cc78ac096e26175f7a90ef0a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089074, "uuid": "59626635-c7f9-4cce-83d5-8862c5d083f7", "comment": "Malware payload", "value": "94cf9858986404f311c6c63fe648ed1dd9fddd514cc351db0912a8f996dada5e683a6db0fdef75ef3d4ca31a7d9be428", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089074, "uuid": "33fca495-c056-40da-86a8-6a020382efa8", "value": "T1F2452356EBD48133E9B66BB044FA02D30FB6BD949D3C426B2345A99B0C31E8435B53B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089074, "uuid": "21fdd6ec-f47a-40be-b3e1-cccb14534159", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089074, "uuid": "2cfc0b66-2655-4a9c-8f80-9e070c1fdf92", "value": "24576:xyG7k+mUyk0Ehe2BZ/f6/4Ei7YrmXWQY3qYb6E:k6mUK2eCXc4Ei7Wm1qzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089074, "uuid": "4b9562b2-0994-4abb-8378-93063c89b0c5", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089074, "uuid": "20a98e1b-ac2b-485a-9773-f52ba2840ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089074, "uuid": "6a0ddf1b-e618-4d08-92bc-d0103b1f2b1f", "value": "c29c1438f18368081f2034be5502959d09a150f6a92538acccc2a359ea6a7a0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f7af52-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089076, "uuid": "57376786-1983-48c6-b39f-34bbea23f112", "comment": "Malware payload", "value": "eccdc29e2d773318bd4bacdf204f6e49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089076, "uuid": "fac9c675-41af-4ed1-9f41-8aebcd1eaa1b", "comment": "Malware payload", "value": "c2d979e1ebeac35a2ccc90cd023d21a75425cf254b7cf41bd60ff830d5405d82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089076, "uuid": "033abd92-c6bf-4772-a22f-0fe4b3e2616c", "comment": "Malware payload", "value": "da6a69c0776697ab68daf59cc557ddadfd053cf6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089076, "uuid": "d4fafeca-d3de-4715-a9a7-7ac1a87774f8", "comment": "Malware payload", "value": "69330e5dc1997a171e0796916e83fdad9a76ee50534e10da39753feece22e4bb4f3fb0d2e9d752e5386aa9309ae5dd1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089076, "uuid": "97e4f3ef-244c-422c-bd3e-8e213d785f92", "value": "T1FA45234626E84872D4F91FB538F906A70F3BBD9148B8C3992B48580D1D73AC5947AB3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089076, "uuid": "4d8fefc3-166c-4033-8bd1-06d3785d79a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089076, "uuid": "e0bdf7bc-e243-42d1-98c8-5bbe13fb7de4", "value": "24576:Oy4wcCc1D4UO8FwM70xaiDSK/kEWsy0VAi8rOLJZ1JKU4N:d4T5D4Urw80lW4VbLdJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089076, "uuid": "5a4f5b83-0411-424a-bc0a-5f5075722734", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089076, "uuid": "d2a6c2a6-7879-4b8d-909c-91ed8928f70f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089076, "uuid": "c174d576-ecfd-48f9-8495-58199dd2c51e", "value": "c2d979e1ebeac35a2ccc90cd023d21a75425cf254b7cf41bd60ff830d5405d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83accd75-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089077, "uuid": "c1e992c6-c2ac-4a7d-88d5-dd265c30eba0", "comment": "Malware payload", "value": "c2d2c2abfa0804f6f007301b70a04340", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089077, "uuid": "69d2a02d-1ddd-4bf2-84a3-58362f440c4f", "comment": "Malware payload", "value": "c30b4fb833c6e6c5cc0307e82746de060e08980c10d9113fbcf16324ed43841f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089077, "uuid": "97fc4258-d169-41b4-9a88-ba58cf2f69bb", "comment": "Malware payload", "value": "4b0ccb4a94a42861cf511fe91d930b2064b40dcf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089077, "uuid": "32142d62-6f4a-41ed-9ac2-e79a490d26e5", "comment": "Malware payload", "value": "d2e1bbe54dba2c59d99bd28685667882dcbb4c5c198b7bf6c14a25d825afb2c31eff256d914069de7ffff4f6ca5d2434", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089077, "uuid": "fca28be1-5393-47a9-a6b4-fd82cea0e744", "value": "T160452341EAC89533D9B66B702CF247C30E3AFC91E938020D678959851E7368879B5B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089077, "uuid": "8bb003f4-f047-453f-b6d5-02b459489c90", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089077, "uuid": "b5d3823d-73dd-428c-82e2-9dad9f5e7185", "value": "24576:myHsfkwIO9IOmD9IlEokBl3SirSAykdEpfKhcVQmMytMpEKcYsnGVw5:1HsMjO9IO2yEokD3VuAuJKhetMpvvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089077, "uuid": "a4acb2d1-14b4-4f1a-a081-ab8a3274e5a0", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089077, "uuid": "2a06a5a3-f63a-4700-ac85-7b2514b6989e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089077, "uuid": "7bd89476-baf1-4f94-b98c-8c0353d48363", "value": "c30b4fb833c6e6c5cc0307e82746de060e08980c10d9113fbcf16324ed43841f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84683a5e-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089078, "uuid": "7cf567cc-504d-461d-91ed-3a295ae2ad00", "comment": "Malware payload", "value": "a0d407bff7723d89f3a17b3ed1824a85", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089078, "uuid": "39ef85d7-7f43-41e3-8d2b-d01016a58cec", "comment": "Malware payload", "value": "c347081ec0d10ba6c004ccfc0fcad5b3e8f18c3dd03db909763f8558faec9f92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089078, "uuid": "f7240d1e-a7c1-43b6-9610-de58a7428c61", "comment": "Malware payload", "value": "1f5d343a4e51b26e97432b59d4c6cf15922c8e11", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089078, "uuid": "bc3c59e9-d26b-41d4-b6ad-23912c3334a0", "comment": "Malware payload", "value": "5aa806f03eb7643291c22abc455a4bda768c9abc8dcaf4397a697a9612fa0f604c39d3373ef55e70618dbb70b04fd474", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089078, "uuid": "6af42df6-d273-4fe0-aa8c-280b0e00bd1b", "value": "T12F452342F5E59165C9E13BB058F94383297AFCB158BC833E1305AE6E5C736C48A7633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089078, "uuid": "a612f948-c882-41ad-b2a5-35819afb248a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089078, "uuid": "9d2978f0-92ba-42ea-ac01-024062f72965", "value": "24576:tyVtgWQsf890Vew56gK5+JeE5YmnrpF2lb:IVCWQsfcwl5PKej5YmnNF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089078, "uuid": "53706a1a-005b-41ba-8697-aa8a2a9ebd1a", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089078, "uuid": "3641175d-ce8b-4788-b5c6-90398555c643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089078, "uuid": "362b656a-97dc-4fda-99d7-0fc6491567dc", "value": "c347081ec0d10ba6c004ccfc0fcad5b3e8f18c3dd03db909763f8558faec9f92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8514ccca-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089079, "uuid": "5dfa3a26-8a27-41dd-868a-b5388b8c0089", "comment": "Malware payload", "value": "44472a56e2eabd5f3e71775bf35f5fe2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089079, "uuid": "3663f21e-fb50-478a-a729-23caf232090e", "comment": "Malware payload", "value": "c352e43ccbc8d777d8269a166687370c5ce3b2214eed91388f0b526986d5872a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089079, "uuid": "e36ba4d9-239b-4f52-bb06-44615f6a22be", "comment": "Malware payload", "value": "e9ac1e9b3f504a7ac2fe963de20aa2ec22d65f82", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089079, "uuid": "bf42c4dc-5fb1-44c1-a7e2-dc604336f806", "comment": "Malware payload", "value": "ad3483662383486b7297293a299f3910dc3739ac946451635b417c9a429012fa0166eeb28b10d316782ad9a5652013ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089079, "uuid": "faad1038-e723-4f9a-9cf6-52f443596f9e", "value": "T16915231797E88133C9BD277009FE0793193B7CA359B983AB2765189F4873A41F83275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089079, "uuid": "c33cd998-0e56-4194-a3e1-31ab4d377a5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089079, "uuid": "4384fcd8-f5d2-4ae0-b8c6-6411a7949aad", "value": "12288:DMr2y90X4GK73aMu3y6CaH0J8BbcpbXDmfQTkMKFbiXc7CtRnKb3T06RMva8rBlR:ZyS863y6+8KpXEbiM8Kb3BRMvTFyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089079, "uuid": "234a96d1-1ab8-4820-a569-1e10f07a3c62", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089079, "uuid": "afee30c6-23e0-4029-91dd-84565aeacf74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089079, "uuid": "047d563c-c5b1-45f0-a31a-4e2396011a0a", "value": "c352e43ccbc8d777d8269a166687370c5ce3b2214eed91388f0b526986d5872a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c00aa2-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684058289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058289, "uuid": "0e644db5-5a70-4849-abe3-d2b534420367", "comment": "Malware payload (RemcosRAT)", "value": "d13a703bf3ddfd76e3044754c94dcad3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058289, "uuid": "0c80df33-88ba-43be-9f29-3052486bd3b1", "comment": "Malware payload (RemcosRAT)", "value": "c3653e6517e48603a356a5978cdc1b210bd20e023146fd561c611c3b82c0736c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058289, "uuid": "b7361aa3-24df-4750-85ef-167f21ce5d22", "comment": "Malware payload (RemcosRAT)", "value": "2b1f0ef04ee121819be9123109c9447879826b16", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058289, "uuid": "97a6457c-7b62-478f-8fd9-3aee29a3a99c", "comment": "Malware payload (RemcosRAT)", "value": "5d734b5ec94b2671da457b14dff1b84719f0752cc9c88979ea95e605b8187eba4b6f67f473273252f649e0e8a1d11e0a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058289, "uuid": "06add77a-183d-48a6-a1b0-2063052b1a30", "value": "T15025232C2BACE106C5BF4F3DC8B2260583B65D15FA21D7BA1FC418A61D73704E9A1B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058289, "uuid": "4b6f8b00-4922-410e-b282-23469dafd4ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058289, "uuid": "18f12ad7-ec78-4cf7-8e10-581201729664", "value": "24576:NLvXkGKkj3a9ELZjnLIm5Xx2XkW9BxbzSsCp8alWvGsa:9v/a9ELZjUoh0kW93CTWesa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058289, "uuid": "a179bf18-530d-41f4-a804-0bd3a067aead", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058289, "uuid": "2b5a3da6-7438-488f-8ac2-552c1d72d84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058289, "uuid": "ed78e7bd-d630-4f95-8de2-c443de497246", "value": "c3653e6517e48603a356a5978cdc1b210bd20e023146fd561c611c3b82c0736c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d897b1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089080, "uuid": "74473486-a1c1-4722-abf9-c92365edb1c9", "comment": "Malware payload", "value": "c547f12dc84c06594c19a198915c2ea8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089080, "uuid": "a373de44-2623-49b6-be5d-66df0eac3a5a", "comment": "Malware payload", "value": "c3a9a512fcc4ad2fa0abba4177de5e16573fedf0b4f72dff212f26e5cd2f851c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089080, "uuid": "094c26c9-839e-41e9-8b67-fefd1dc6375a", "comment": "Malware payload", "value": "0da23d2c501b8074ef3874501e5346f8250334bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089080, "uuid": "5c7b58e6-f9d8-4b9b-b539-4dd133e4e65d", "comment": "Malware payload", "value": "2e2037865fb9a98a5a4571f891dd63f43c067af75bc39ac9c9ae381d36642f0b3e2ae389095ed0d283572f4f16374dc9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089080, "uuid": "22116e94-8f76-473d-b30a-82992671eec3", "value": "T1B8452383F6D9A173D8A617B45CF702D306367DA2AEB452CF1345B41A4DB2788A13137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089080, "uuid": "0f167174-553f-41b9-91dc-3f3d29978231", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089080, "uuid": "727a5602-9f3d-451a-b489-2da9aa6320ce", "value": "24576:KyHwrmRyG5DE5QN3ASLdWzskNBHwKpL5VuYTnqZ82x:RHjRyG1E5QNQSLdE97HwKp3dnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089080, "uuid": "68740935-db49-466e-bb4f-7b65cf5051f2", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089080, "uuid": "1afcc635-f79d-4d5e-b52c-b89fb3a272fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089080, "uuid": "66eb569c-f227-4b84-a389-44841ea0947c", "value": "c3a9a512fcc4ad2fa0abba4177de5e16573fedf0b4f72dff212f26e5cd2f851c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba77399-f23a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684056851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056851, "uuid": "31760957-6ccc-484e-8fbc-04d3afb6f129", "comment": "Malware payload (AgentTesla)", "value": "7535801edec66351fde7f3fd34bf0fce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056851, "uuid": "06384f2b-c6c5-4f2e-ada6-02f108647f7a", "comment": "Malware payload (AgentTesla)", "value": "c3d484451f9d0cf5aa68dfeceed67b5853cd2780512129668e9fdd98bc5490de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056851, "uuid": "3c98c908-c57e-40f5-b325-05ccdac0df7c", "comment": "Malware payload (AgentTesla)", "value": "6f536090d7c40d99fb3985ba918c38721b045464", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056851, "uuid": "97bab02c-c59e-453b-bdfb-db8c0e350b0c", "comment": "Malware payload (AgentTesla)", "value": "2574625a3887501cb3986486b3af92a45d67205f5c6ec1fb8647ca58b345bf4b997f174e2c74a13b53a4a458c23b9e78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056851, "uuid": "0bb96059-a05d-4439-8c8b-0ce86f78c1f1", "value": "T1AED4E074D0AE45F2E10E89709C38BDA61F7270D3F9F546343B396544CFABA943E8864A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056851, "uuid": "4db72e15-f0f9-45ec-aae6-3e1304380f24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056851, "uuid": "b430b014-38fa-4ea1-a8fb-61d5e7ac963e", "value": "12288:4APNj5AyHHwQLFpmPg6pnSb8YIQjIgtN5H+Hlth:l3hsRpnVQUk5U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056851, "uuid": "5906144f-dd0a-4e75-a0e9-d3d724bfe844", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056851, "uuid": "dd5ae9ad-0ac6-4e27-bb1b-181ed2541d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056851, "uuid": "8566c9a7-506b-48cb-ad2a-5be6f739f4fc", "value": "c3d484451f9d0cf5aa68dfeceed67b5853cd2780512129668e9fdd98bc5490de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c3254c-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089082, "uuid": "fa0020b2-d852-4d08-84f7-753c063c712a", "comment": "Malware payload", "value": "ea277d02b5051ca2a6fcd0f24e9d204e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089082, "uuid": "db4fddec-1e97-4577-86ff-93908d0b6daf", "comment": "Malware payload", "value": "c44317318188e0baf2846602013697f7c9aa7afca2b872c1b8353f4658843c94", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089082, "uuid": "616095a5-4950-4962-ab5d-1d6a046a809f", "comment": "Malware payload", "value": "7aa3853e37a5a29bc94537cfe82930ee5b242a4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089082, "uuid": "da2c8725-1722-462c-8bbb-7fab2f29b85b", "comment": "Malware payload", "value": "b968a12d92dc4f49e6fc8d57c22da84823517e7dfcf6cc337b45c8c7e670571c8fc90936703a34dc1992dcbfdd59c131", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089082, "uuid": "b3d38de2-ef6d-45ad-8473-245e943eeba3", "value": "T18445234FFBC95435CAFA03324CFB23C30A76BC9295389776568A98191D23594B4B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089082, "uuid": "6edb033c-27e1-47db-b85d-a33abf1b661b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089082, "uuid": "7a4ad862-3e6e-4f7c-bc57-3f0348968b17", "value": "24576:ry1ktCHOyhPuWXKvMHqyLDprG8kv5fJ5Sb9NlrpkzNLU5NIO+csUY:eACHOyN1WMHqyLDtGhxJ5Sb9azNLU5mW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089082, "uuid": "3ac5069e-6e30-44be-9ba2-6b3450432ce6", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089082, "uuid": "1a5f2212-8d35-48ef-8535-6bf95123491c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089082, "uuid": "da8d38b5-5f15-4dd6-8c1f-24318718e9eb", "value": "c44317318188e0baf2846602013697f7c9aa7afca2b872c1b8353f4658843c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878ce1b7-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089083, "uuid": "a00ef609-f85e-47bc-aa5b-dc324ea920c9", "comment": "Malware payload", "value": "4b8a519411dc1ed17be7ba4f65f87412", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089083, "uuid": "a6ab8839-ec34-447f-a5be-e3022e3bc99a", "comment": "Malware payload", "value": "c46e12e7a08cfd17858543a034ae370ec8d3568c99e92d50913af07b365ca804", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089083, "uuid": "56473f47-a71a-4c7c-90f8-7cbe03a15275", "comment": "Malware payload", "value": "492df258d68db191ff69786ca91456901f24a4e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089083, "uuid": "7129d2df-12ee-4ba2-a35f-935044c6e392", "comment": "Malware payload", "value": "847698d681cf841a8e725903f63ebadda08244e5ab909f6d7aaabf6f4566ac267dcd45c87009e14d6a830fdb7859b7ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089083, "uuid": "b750aa93-ed4a-48e1-8c77-b0d94d0ddf90", "value": "T1C5452346D2D411B2EDF1577AA9F280830A31FDF68938475B674568AF0CB36C26470BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089083, "uuid": "b54e4a0b-aa6b-4645-8bb8-e1bac6b0afd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089083, "uuid": "0a99fa10-026a-4bfd-9583-dc1aaeb09985", "value": "24576:xyTKavwsxDN8rkNXw0c9FI5eg33Jxaf7snPYxyZRoFHTN6VvHA8:kTFvTD3NXRACrxlEyZRGh6Bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089083, "uuid": "a8957cfb-9179-4422-bcc7-4a517b7baef7", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089083, "uuid": "eb3fe471-03d0-4cf1-bf56-4b0feafe763c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089083, "uuid": "45a4aeeb-8572-45b1-809c-68fa8a6addea", "value": "c46e12e7a08cfd17858543a034ae370ec8d3568c99e92d50913af07b365ca804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885092ca-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089084, "uuid": "35721276-7ba9-41b6-af36-672aa2246eca", "comment": "Malware payload", "value": "d4b2c2ca18eb3cc481c0e2a47825136f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089084, "uuid": "6e2c17a1-ff0e-406a-a4de-8f77737f1ae0", "comment": "Malware payload", "value": "c48fb819ec1a07bf07738e7932f202b06b0e9a27df933861aaad911a066c912c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089084, "uuid": "aad98112-4eee-49f7-a742-7d97b61a7ebf", "comment": "Malware payload", "value": "5bf18a9cbef3ae759959580a2a1245eecb5b86e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089084, "uuid": "9518d2f8-499a-4b4b-b1cc-b68c5f842011", "comment": "Malware payload", "value": "d7e98514263cf05fd264ee66bb65a66727612f6cb7d130479fed9f4fb3b25769075c2d87400da7c41fb16b7be4a6d7d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089084, "uuid": "626cfdd5-4f78-491a-ad00-95cf010e417f", "value": "T144452317F6E84132DCF52BB01CF9028306353C969EB8A76B1B65689A0CB36D1677136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089084, "uuid": "92d437de-95e1-41e1-a6bf-5ebe35de234c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089084, "uuid": "c606d483-1c9c-4a01-b1f2-a7acfb5b7492", "value": "24576:8yjYsCLY3jUprItAmkB4hJnAPMvCaOpmT3fwGufev+K:rxCLeUCtAmkShRAP6CVyYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089084, "uuid": "98a0ae29-1c13-4e45-a674-7bb7ba2ab3e3", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089084, "uuid": "35d46513-2880-4a31-aac5-56245bb641ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089084, "uuid": "ece48b29-cb9d-46c5-b82e-58add1e9d649", "value": "c48fb819ec1a07bf07738e7932f202b06b0e9a27df933861aaad911a066c912c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e240e4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089085, "uuid": "9d8c0711-5c01-43d1-8bab-ef951a9b670c", "comment": "Malware payload", "value": "f45ec5927d33dd67134d7e8e525b7508", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089085, "uuid": "cf0d862b-cf87-414a-9d1c-ffd889265122", "comment": "Malware payload", "value": "c49568920474576b9f841c14e04b64ba315395d15ed3e7056c83d0e883344796", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089085, "uuid": "ede7f95a-1774-4b81-a996-c2320aa63ff1", "comment": "Malware payload", "value": "0c74288a31e9e0790c6e911ea51488bac549c595", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089085, "uuid": "96a68f50-8757-4c80-b2c6-4dc7a4a46715", "comment": "Malware payload", "value": "65d99806a9ad3ef3864850e1399bfc2bd831dc20d5925849a23db5211deee4f6df4e4a372a99a1c36a4e966ddba98ec0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089085, "uuid": "50c5ed0f-d91c-45c5-8f93-ef89e6f8957a", "value": "T1C5F42346E2EC9433C5751BB054F607970679BCE06E7842BB2786AD6F5CB22C0A53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089085, "uuid": "483a1153-2c2f-4c3c-933c-89267a13c51d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089085, "uuid": "1dffdf49-af34-46e4-8fd5-a7314d654eaa", "value": "12288:qMroy9046DAfc17aHZoHOdFRXtWcXU/kW1gpYYO5qprhd/iMpznnO97X/SOQRnsr:Oykl17qZEOdFTI8WYdaqRhd6MN275r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089085, "uuid": "1180405d-24f9-4235-a890-4b220f153e1f", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089085, "uuid": "8b57c2a5-6ca8-49e6-bf0c-32ce5b11157f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089085, "uuid": "be6aecc2-30eb-4268-8930-7800111a5032", "value": "c49568920474576b9f841c14e04b64ba315395d15ed3e7056c83d0e883344796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5c6c3e-f22c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684050869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050869, "uuid": "f2f002a9-ec7c-41bb-95b8-fc2a72a88e1d", "comment": "Malware payload", "value": "fa02c9d77ff9a4e78dc5ee3fafa52368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050869, "uuid": "f787bede-89b7-4777-8747-d6f7e3d14d6c", "comment": "Malware payload", "value": "c497a3e8c25a1c85ee5da2db05ff2226fd8df962643fa46be4a1164b09c8a25a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050869, "uuid": "f3bfbb89-7cec-4912-9f3f-dc23f9b3d5ea", "comment": "Malware payload", "value": "2905b05aa3a6f8ee9dd68bd8bd9a975f92e4f9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684050869, "uuid": "3bb3d7c2-557c-453c-8d2e-24b59b3d936c", "comment": "Malware payload", "value": "a7c2354b7e8338cded571d01c3c348b93ac3124b3ee74ab7917e9834e8c8548cde47ce56b66869c033947f68f99a47ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050869, "uuid": "002f864a-93e7-4939-b3e9-69b28c5a6641", "value": "T131340220FA93C9B1CD86257010B497A66B3F56B263B04EC71B7516399EA07D1A73E30F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050869, "uuid": "20591dd4-6885-47b9-83cb-03b3bb9b78d5", "value": "6144:ImFjKLxXGLvpC69PHJCL23tam04TiNoCT+9PEVgC9+n1sC:IVVXGTIIpR3tam04TkdisC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684050869, "uuid": "2c47d1e1-81e1-4799-ab23-6eef1826bedc", "value": 238728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684050869, "uuid": "f293f6e9-124d-41b5-a938-477f3ac58e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684050869, "uuid": "431a1fa8-542d-4b7f-b7b6-55aa1c39713b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d561a7ff-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058290, "uuid": "7c4f48c7-9ae9-4b2c-a338-bd0707e3d4ba", "comment": "Malware payload (IcedID)", "value": "4065fe2b6941170db3b6889e87507478", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058290, "uuid": "5a57b10d-f99c-44a6-9ed5-792f90121098", "comment": "Malware payload (IcedID)", "value": "c4ba3aadb1038cddb6aa2500e4e36966a487cbecfc672909f81a95f1e2a7cde3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058290, "uuid": "51232efb-5dbc-494d-a9b0-476e1f6861ae", "comment": "Malware payload (IcedID)", "value": "7a579a36eba74a2e66b23c74ad85925ab5cfb837", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058290, "uuid": "f9a17268-9bfd-433e-8a11-b9843ce443eb", "comment": "Malware payload (IcedID)", "value": "5452fdba9fa30c51ca764d70b4d7b01905d236d11f1b4116718daef75e0b64cb50326c119813dabf03ea280a968ec768", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058290, "uuid": "8f55265e-df61-4fdd-b68d-1f1517ae268a", "value": "T157D4BF06F3367C57E14BD73BC5E458A64FBE7D2D2716C7081A4183323A4A6D8AC6236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058290, "uuid": "973462c4-a51d-4935-a114-62a728968704", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058290, "uuid": "b15fb113-54e1-47f9-a54e-b0f054e53d0d", "value": "12288:9E2AHQq0zng8dtHq7t+tLPIpu3AmAR0D+q2c99vvUIrAk:9E2AHQqyngclq7t+uVrKvvUIMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058290, "uuid": "f3fe3f48-b5e4-47d3-bd2c-485bb4512750", "value": 621152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058290, "uuid": "da653e38-70e0-4660-b260-59d3687fbb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058290, "uuid": "15eb34d1-204e-41f3-835b-3be327a0f92c", "value": "c4ba3aadb1038cddb6aa2500e4e36966a487cbecfc672909f81a95f1e2a7cde3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c085775a-f22e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684051813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051813, "uuid": "c418053c-291f-4b00-ba08-66fa9ffc6b6b", "comment": "Malware payload (Mirai)", "value": "da421f5ba45e1f8418f24437f1dc7181", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051813, "uuid": "fe6ae9b5-5db9-464f-818d-bd2f6046275d", "comment": "Malware payload (Mirai)", "value": "c4ba5f055f8dffcc0b404969ace82feea6ead7f476e2e6a065cd25bb5a768dbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051813, "uuid": "a39038b3-70d9-4050-87a5-8961e69ae5dd", "comment": "Malware payload (Mirai)", "value": "916ee3ba7a87249ab4b0cc46fcc7ce2a0e7e9ffc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684051813, "uuid": "c4138f0d-f85c-4be6-9104-e5457db63130", "comment": "Malware payload (Mirai)", "value": "18e97f3df15e7c122053efbc1d744fed671a9a6d0643b552ae33e08f650d9e03053e021a6e7e235774ccfbff96e461bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051813, "uuid": "5bb4b133-662f-4ab1-b6da-03f71386a096", "value": "T149B2D03C1B111E98DE1EC0BE839D1B203DB82F2591829D4B6207EDD7AF968B47453AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051813, "uuid": "53165e81-6279-4e33-bf6f-93eeaeb02f28", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiiAmdzJgGlzDpH7uNj1JAF:neD8ZSWvZHZbs1row697qohQvg9iAizh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684051813, "uuid": "9951546c-bc89-4772-8fb1-7cbbc1bb75da", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684051813, "uuid": "9448f033-ff20-4b02-8775-81774fbdcc7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684051813, "uuid": "b96aedb9-6093-41d4-94ec-e65a319839f0", "value": "c4ba5f055f8dffcc0b404969ace82feea6ead7f476e2e6a065cd25bb5a768dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e56bc5-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089087, "uuid": "ee6e1708-f19a-42cb-a506-84b0bac5e85f", "comment": "Malware payload", "value": "21b791844338b0ce3d9524552f332f53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089087, "uuid": "60ec48a7-5087-4b41-99cb-f6eb37395b80", "comment": "Malware payload", "value": "c4bdf6cdfaa4548f3c055527d93546f218b888a494955975b2d4e772867761ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089087, "uuid": "a513b1e7-ec4a-4562-a75e-a628aacf77ae", "comment": "Malware payload", "value": "fe2fd89f27bb1e0df82e5eb211f9512220179cb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089087, "uuid": "39b55715-7421-4a66-a79b-9c3da5ec6790", "comment": "Malware payload", "value": "bc2d866e424e191ad4fdea184d13096bd93915649d2f40136a364363ef88b637242aeeab8c7291ef373ad4a4c9a9244b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089087, "uuid": "b0382752-f91b-4e1d-a2a3-ea9e1e44a573", "value": "T1A7452303ABE44176E5A41BB4A9FA07430E36BDA529F5872B675A589F1CB32C0C43137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089087, "uuid": "496ece74-42c4-42b5-bb34-1a43ff8a20df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089087, "uuid": "45b6699b-5dbc-46c5-82a5-d08ae3facd57", "value": "24576:Vy8JB9KXqW+ekgtzAiyMYjMZecLC5TCYYTfis1H:w60DxtciyCpW5Cbau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089087, "uuid": "1ba86984-d23a-4f17-aece-95a3aec9c285", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089087, "uuid": "3c25ea61-6770-445d-ac9b-9cdaa9bc6435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089087, "uuid": "01893d3f-c090-4c9b-bc62-d22016395372", "value": "c4bdf6cdfaa4548f3c055527d93546f218b888a494955975b2d4e772867761ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e411c8a0-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089668, "uuid": "38639c7b-b24f-4549-8ca8-7bef2281fbb8", "comment": "Malware payload", "value": "09945f90517e823c6f7414128a940009", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089668, "uuid": "b6fb4b67-3ce8-48d9-818f-dde012ce88d5", "comment": "Malware payload", "value": "c4c36ca422175cae34fe3f6974ea5ebab6bf2125d2205b59ab4941ec30d5275a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089668, "uuid": "70a19511-a260-41db-a0c2-0cdeedf9127a", "comment": "Malware payload", "value": "d36b8e342c27c51895579e2137904cff4660a705", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089668, "uuid": "b7cba513-9ecb-452c-8cbd-eb8a6ac21576", "comment": "Malware payload", "value": "161dc948999ba0db06667ca7f1b8227b9ee8dce51d5001ff166524e1e0a5f09ec14f24cd93bada891b7b5d731974b275", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089668, "uuid": "41444d2a-fa02-4949-839e-2de09f7ed7d1", "value": "T1F9231B5EF181D9B2D02048FD8DA3E2D8765D37342D2444977DE96F8C98BA2CADE0D18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089668, "uuid": "9a145728-51a6-4763-aaa4-7355693ee9e3", "value": "1e012d3e709c2a7acbface8add45986b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089668, "uuid": "39a8d4e3-1b5d-479d-95d5-2e25b4c5f1b2", "value": "768:0ShMqdlszCuJLaOzitI8TbsVEqgXA6IhNoNmZ11B9hAPjfjN:ThMqdlsuurqHXAphcyt9q/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089668, "uuid": "230cb6ff-4581-4592-904d-dac355aa37a8", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089668, "uuid": "58ba1597-dec4-4167-970e-ba992b8bcf88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089668, "uuid": "98d12b1d-1c31-4ee2-989b-fd4ec6d5a95d", "value": "Server.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7fbb57-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089088, "uuid": "753785fc-c8e5-4e00-9903-6d10b8bcd55a", "comment": "Malware payload", "value": "aaedb856067b6d90eedee4b971c4033d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089088, "uuid": "c728dafe-d0a3-4c48-a4b4-2cd90830a43b", "comment": "Malware payload", "value": "c4fa2f7088f5b8e59f83c6d7542f6f8e16c9e52a3295c35f78fc16fb1749ff81", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089088, "uuid": "d8484f65-5362-4a26-873c-654d10ee2895", "comment": "Malware payload", "value": "b6b5a4683203299f6914490ec78d0228feb1616d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089088, "uuid": "35631190-fbf0-4cb7-bde9-fa45aca4e978", "comment": "Malware payload", "value": "92f15104064f48777579923bb973c2a11873e50968935f7325ad567462ca032f886a4c5141a5443972c6c814ad7d07f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089088, "uuid": "be2c9d51-d3ea-44da-9b94-680d64354c01", "value": "T1E3051257A2DC8072E9B617702CF603C71E357CE14D3442AB2786B49E0E73B88A975B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089088, "uuid": "eb9fe684-ec5a-4ab5-80d4-229c2b6a8a8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089088, "uuid": "ef67825e-7bbf-4165-9a28-b81b700b19b8", "value": "24576:AyAjrGVWb0fEHR806I/UC48TjiEld/sE10/cML:HA3GIb0fIS4lWGfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089088, "uuid": "d56297c1-d533-4001-9747-3dba96c6d421", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089088, "uuid": "e1f316ed-b23a-4240-86eb-99c02695dd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089088, "uuid": "c09d4a09-ae0a-4085-a52b-48276d8c4f34", "value": "c4fa2f7088f5b8e59f83c6d7542f6f8e16c9e52a3295c35f78fc16fb1749ff81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9e7573-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089090, "uuid": "28782972-70d2-43f3-a519-ad32fdda199f", "comment": "Malware payload", "value": "fd4c5588866fc90beb0e4085789da1c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089090, "uuid": "15dd88cf-d5be-49bc-92d0-4deecd01127f", "comment": "Malware payload", "value": "c526ee0d3bec6aaa007be4cfe73e9983b2f429e425083cccfa41010da49cd28e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089090, "uuid": "371f2c8e-b778-48ee-bffa-3aec52a96172", "comment": "Malware payload", "value": "a212a3baea64741141701934d7dd143d81dfad13", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089090, "uuid": "181fe59f-1a3f-43da-880b-fcc36e1f272f", "comment": "Malware payload", "value": "dfa6c541716eea89c75b8053503f12bd5356c65e4828a1195170e9589cd8e1d6138bcce65e51a2346895a0bc41600534", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089090, "uuid": "1cc7e86b-d5f7-490d-bc70-123d7011550e", "value": "T110F41257BBE89073DD7527B004FA07430F3ABCA29E38425727859A6E0CB16C458B676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089090, "uuid": "513eb6f3-533a-4d8e-b497-09e625156893", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089090, "uuid": "3028fb61-b851-4d98-bbf0-ceedfe0c8850", "value": "24576:iyXaFbEVG9hRgPtjseKAMliB9YCj4b0hZGHI:J+bEVU6lY9bi14b+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089090, "uuid": "4684bef0-22be-43dc-9552-bba647c1fd72", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089090, "uuid": "733cd9a4-4164-43ed-9de9-36554e791e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089090, "uuid": "b9cd84c0-81d6-4cab-a4fd-d76a3e3ce738", "value": "c526ee0d3bec6aaa007be4cfe73e9983b2f429e425083cccfa41010da49cd28e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbbe994-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089092, "uuid": "3c2ba157-751b-4d31-b17f-378dd750795d", "comment": "Malware payload", "value": "889897f53dcee3aa5b5175350d9a38c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089092, "uuid": "423dc918-5346-46cd-a068-e80e9a8a2339", "comment": "Malware payload", "value": "c53c69daa322933fef183795fd85e044cd6aed3e4d90f60d8eaca9f65fbf6b99", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089092, "uuid": "93847d68-136a-4b94-829c-1d7fa88657a3", "comment": "Malware payload", "value": "50922b232534435f3582ada8ccf5997289af7d94", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089092, "uuid": "2e5cc61d-c78b-4132-b8b2-b8dcc69baad1", "comment": "Malware payload", "value": "a24ebbca53e42346cbcd65a0849e7841c798f55f3355a04290fae2a0ebc655b71632ecd045fc651f00b79feba5ef6b16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089092, "uuid": "8a027d20-e128-4522-a0f2-cf688fc72353", "value": "T13F4523517BE4A07AE8B0177048F703A31B3A3CA248B4576F3B867D2B5DA27D4D438766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089092, "uuid": "0c2fd2b3-aa07-4e92-9f31-88dadbc91a20", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089092, "uuid": "cb5272b8-91fa-440d-a371-96c0270b85ef", "value": "24576:yyA0l+rqq1WN8uIwDWJ3mJqoeWztZgUxT:ZFcl1WN8uIkWJO/z7gUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089092, "uuid": "99320798-0bfa-4435-9660-65e6443134f7", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089092, "uuid": "71730bc5-6f91-4e58-9b5e-ece7b6fca230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089092, "uuid": "0857ff8a-1c86-4106-9801-6e6ea338697e", "value": "c53c69daa322933fef183795fd85e044cd6aed3e4d90f60d8eaca9f65fbf6b99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d791b03-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089093, "uuid": "b8dd71e5-4f82-442d-bdc2-e23f5a2d88eb", "comment": "Malware payload", "value": "ce7bb9dbdc4b7d073feee6d7c77e2d23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089093, "uuid": "867ebc89-be2e-4ffe-90d6-26869408cdd8", "comment": "Malware payload", "value": "c54b0e6503641821eb500899f6c823a9e1063991b27de8fbb901c7d3392c1dee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089093, "uuid": "1e34116c-96be-47bc-a3a9-177bb2f6f732", "comment": "Malware payload", "value": "b34f1daf7519fef95d0b65b6e4231f6bc6821675", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089093, "uuid": "c1cfbdc4-5892-4635-bab4-36461bc5425d", "comment": "Malware payload", "value": "ee1f76cb93d3a33c0d200fcbd9e9ee98d283ef71aed37bcd702b7595d2ec8371203dc14c9de057d815575a2f13161ec5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089093, "uuid": "e29c25f6-19c3-483e-bdbd-3349a6e77e24", "value": "T18C452353ABE04122E9B16FB118FA53C70D3A7C529A3887FB1385A82D0C732D1B5B5767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089093, "uuid": "79ede6e7-1434-43a6-bce6-c0b60b572c2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089093, "uuid": "18f02a6f-fc0b-4bc2-940b-66b7f21cde79", "value": "24576:5yf+AwQZ2ZTmu77wLy06NukF+AUsN2VS8a3++JL4A6ltP:sGW8mu70Ly06NnAAUs8E8c++SAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089093, "uuid": "d8c6737a-b8be-4b59-9e3c-e8bf65508338", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089093, "uuid": "3cbdcf18-f43a-4541-8d23-0f5f3bd5130f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089093, "uuid": "b1bed395-b57b-47fa-bdfe-3dd63df88f71", "value": "c54b0e6503641821eb500899f6c823a9e1063991b27de8fbb901c7d3392c1dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1b7821-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089094, "uuid": "7c4ec7a2-edb5-4ed0-a019-51a0d7114049", "comment": "Malware payload", "value": "06ca618d4e1ffacc750ed06dffe58bec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089094, "uuid": "798bfed4-66da-4851-8849-9bc3b96a7a22", "comment": "Malware payload", "value": "c553d0cc29cfc2f0dedc5708534efa4e8c2d174281c6983759ef5e8c0534cfd7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089094, "uuid": "4a43a354-d542-4ec3-9105-3a56614bf16a", "comment": "Malware payload", "value": "8a2d120a1b8914b0fcf60c773e42fd5f577fb1c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089094, "uuid": "a22a75e0-ae12-472c-8bdb-5d6122557dcd", "comment": "Malware payload", "value": "3893d53e07259f1ce0ea6df401eab30a99fd7f5ec8be7d37de40e188fca843a13bb6285f057063202138ac3f4dfc27ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089094, "uuid": "1851beea-58d8-43c2-aad9-3d7813ea670f", "value": "T10F152303E6E84163E4F85BB458F707C70A3FBD715E38879A274A685A4C72354A432B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089094, "uuid": "29590c22-38f9-470e-b91c-92fff628dd84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089094, "uuid": "3b96b462-b66a-4601-aa1b-36bc10810fec", "value": "24576:MyEcxwKXm98rPBi46ai4TupEuTG1Ack1qIRawaemy+V2s:7ZwKXYcBi9kTupEIPceqJbe9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089094, "uuid": "a6515bec-e579-43c7-bdc8-ebb45eeadefa", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089094, "uuid": "c0bf99d0-4293-4d40-938a-064c3d497a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089094, "uuid": "7865acdc-cabd-4b9f-8419-157954e989ec", "value": "c553d0cc29cfc2f0dedc5708534efa4e8c2d174281c6983759ef5e8c0534cfd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7549a7f1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089053, "uuid": "4d70d8df-e50c-4a50-9241-cd0a4d9fbca3", "comment": "Malware payload", "value": "0c0ebd73cacb79b19dfd95dc3a5019ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089053, "uuid": "40e8083d-4f9e-45f1-925f-aee34454c2f6", "comment": "Malware payload", "value": "c61a3b75e95ea37acb0d7653126ce080c807caf182c5002d2a2185e87f533dd6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089053, "uuid": "ff221b38-8114-4f45-aa87-d758ab4475df", "comment": "Malware payload", "value": "ce62969554656e30765ee7eb27a51dd79367392a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089053, "uuid": "24ee2712-9902-47df-9c54-79dc6fbbdbe4", "comment": "Malware payload", "value": "d8f21508e02b66c62dbb8699d2aeac713a9b619617b166d1778b261c67466d8872305b0b3deb0f0a23c06154491073da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089053, "uuid": "e3ba82c9-fee2-4450-8e6c-c84ed4e3b466", "value": "T1DE85D021BB42C035E8DA11B052BE57F70A3CB6255B6484DF67E02DA91A304E3B67FB17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089053, "uuid": "fcca29ed-bdb4-4c4d-9982-5d90c2482e4e", "value": "e5f285b8e49d243627585d8cc4bcaddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089053, "uuid": "689d0b0c-0552-47de-bbe8-642ad7873c1d", "value": "24576:Tr+6Dr8GSUAAvCl7Wf3F5zrcqz5lIhHqSTUzO1Sp7z2wIEQuboC7:f+C0jAKeRz7sqSeOgdIEQa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089053, "uuid": "eb47a1f1-4f2b-4865-b99e-c53f0f85c104", "value": 1755648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089053, "uuid": "ef5f6558-02a4-4d7b-a191-28550155e37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089053, "uuid": "796a75ee-2d46-4532-87be-1a68fb14d726", "value": "bkbc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee4bf5b-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089096, "uuid": "35d7568a-2613-4dcc-9118-b1506b932ee5", "comment": "Malware payload", "value": "d4ea5890118eb320acb7749e38086c16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089096, "uuid": "8a78a143-e598-46fc-96b4-bff09fed3d4e", "comment": "Malware payload", "value": "c62650b32d272546189183d4fe29418d58772a33c686a483589f03c2eb5ee2ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089096, "uuid": "bd3ae8d3-6b87-4a28-a5d9-e9121819b46d", "comment": "Malware payload", "value": "7be914c34e496f52778aac2ba6efbcf6e7497c60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089096, "uuid": "094dfda7-0004-496f-8820-4cbc806d6c68", "comment": "Malware payload", "value": "fdde4f246569431ed3df1d23c20df3d9e4371e55d03e3e7fc18fc96ee6d59462eb88dedec628af4b40457e017d0759b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089096, "uuid": "551a7a95-2157-45aa-b09d-a3e51d896d3c", "value": "T1A845230BB3F81466DCF5277099F982D30B7EBDA15C64851B2252B95A2C323C0E6B537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089096, "uuid": "ef6eb2ce-f367-4c47-99e6-60c8ce7d069b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089096, "uuid": "5018a199-9d2d-4325-bf28-3a4c4125b526", "value": "24576:syiV+K2yHWq4f3B1zYB3raoY2GZq5VM8y9RQlOHVZo:b++KvHHsx63xJ7y9G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089096, "uuid": "9b9d376e-61b9-4d89-b325-e2a1943463d4", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089096, "uuid": "2a850742-116c-4486-92cf-7bfd781d3022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089096, "uuid": "df3b76ee-afbc-4a15-90d0-3b6681e7e6c4", "value": "c62650b32d272546189183d4fe29418d58772a33c686a483589f03c2eb5ee2ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb5b69b-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089097, "uuid": "2bc58d59-979c-4f78-8973-4ee26ea033f2", "comment": "Malware payload", "value": "ce8405839877abea2f3362e0537a2c9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089097, "uuid": "604eab16-1791-4dfb-8b79-a109b6b25daf", "comment": "Malware payload", "value": "c62e2f633d9286e4a10a19a8f73941c036c49e616ad62b0cf6f260ecf922ebf0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089097, "uuid": "7c273f91-45c6-40fe-85e3-116bef10f5bb", "comment": "Malware payload", "value": "f6680eec9375cff15c0dac277f9a016a9de88e45", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089097, "uuid": "1285b5de-aafd-45ad-9835-e467c8796372", "comment": "Malware payload", "value": "b117a10dccfa420356781ab6fcbb10bbc9d7faf8f21866354c6284f6f1e1da114cf6e63bea53792e178321b54059347d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089097, "uuid": "11ed160d-0f49-418c-b535-15192022e23c", "value": "T170452353D7D94075EAA113B07FF602830936BCA64CB8471B2267696E48B3AD1F435B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089097, "uuid": "6b587872-039b-4eae-aceb-d296e9dab794", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089097, "uuid": "539ac3ff-8a07-47cc-8542-a6ed00300165", "value": "24576:Kyk3bXXlAXVnd0S8XITbThDrLfcjBaEIqm46Aur60uQ:RGjluqS8X0b9PfkIqm4BYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089097, "uuid": "668b1d99-4ebd-4896-94b4-b23b69fec243", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089097, "uuid": "7b9bd9c7-6f9c-4ae8-8482-2504c5ad3fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089097, "uuid": "2475571c-6b37-4f14-aa79-cb36dcdb3cd1", "value": "c62e2f633d9286e4a10a19a8f73941c036c49e616ad62b0cf6f260ecf922ebf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9073ac54-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089098, "uuid": "8a01adb8-726c-4258-b9f7-3ddebc7bde0b", "comment": "Malware payload", "value": "97b738c5cfba2ea41a439640caf3dcf1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089098, "uuid": "0543c3a3-087e-4e09-a242-d97e971b2fe9", "comment": "Malware payload", "value": "c6926926e12faf5ba629b861c85b2622563502d17ed11ea898d52defe70c24be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089098, "uuid": "fb61fabd-5622-4b35-b7cc-6571101c55c5", "comment": "Malware payload", "value": "0c2093cb3bc8c321197332fde2540b68992778ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089098, "uuid": "91855788-a7f9-466f-b04b-f7dc615a3ef4", "comment": "Malware payload", "value": "7152fc14f2bca4bcacb45a76f1eefe54d3f8ed456a0b2d75912bc11241328b947ab11a4c1c542aa2193c35a65f2a4ff7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089098, "uuid": "5a2b0674-da33-46d0-b2be-8fa7ec732ff3", "value": "T148452397F7F99122C8F047B078F603931631BD506D6503EB66A668BE8CB2789B471723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089098, "uuid": "ab07efa8-f186-4b18-9808-1bd205707294", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089098, "uuid": "846bdeeb-8fdf-4b43-b9ca-46379b381661", "value": "24576:Eyipjz3+iuF3/fnFkyfcPLe9MJSOiZFAmelBLOzose3qSc:TozI3nFkyfcPLe9MwenXD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089098, "uuid": "aaf45ef4-8383-40e0-8828-b55939d0570a", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089098, "uuid": "ed5942f7-e7a4-4f4c-b52d-684c9efdb901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089098, "uuid": "942bdb32-f0f8-4867-b284-3dbf0c576b4b", "value": "c6926926e12faf5ba629b861c85b2622563502d17ed11ea898d52defe70c24be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91382bfc-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089099, "uuid": "2bf45bd4-89d8-4102-a2a1-bb0441486ad2", "comment": "Malware payload", "value": "6730b6159f6998b88ec7e7b99de29f63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089099, "uuid": "d55bf02e-a65b-4217-8055-76626845906c", "comment": "Malware payload", "value": "c6b438e9a9ecca45b041a939b725fe28bad50b47c29430da8dfa48cdb3cfaed9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089099, "uuid": "e2239ea4-4855-41d2-88cf-f7e3d215c203", "comment": "Malware payload", "value": "d09f6baf88f45cfab35da364c45769b24e8a4e31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089099, "uuid": "d76a3aea-db8d-4c17-a7c2-669d73478241", "comment": "Malware payload", "value": "451e57023ef7a4b7bd478a9885d98fe327b7fb4299023c079ac6377545494613457db0f69271e306eb48c9037d5620f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089099, "uuid": "988a480d-4c1b-44db-a4e0-ba6c49b80db1", "value": "T1C94523476AE08471ECF6677494F716131E36FCA52878872B1B096C1A2C727C0A979F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089099, "uuid": "d711ddb8-aef0-4a64-8d01-4685d3fdb48e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089099, "uuid": "d8dff9d9-9cff-41e3-a2d2-cc646e08fc1e", "value": "24576:ByXxvbSygOU788AUwPtm39cULsUDbmDZmmbjNwuIOFv8X2/iz8DO+V34+:0Z1lUfApMc9UDKhbpw/s8GKz8DTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089099, "uuid": "0a0819cd-ca41-4bbf-9671-4e48c74594ca", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089099, "uuid": "226ea321-3297-4978-b9f3-c4db1af58665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089099, "uuid": "ecf73379-01b1-42f4-8f0f-5417a03df5e4", "value": "c6b438e9a9ecca45b041a939b725fe28bad50b47c29430da8dfa48cdb3cfaed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f34105-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089101, "uuid": "46abddab-2551-4cf5-8598-05367c2ee92e", "comment": "Malware payload", "value": "2b54c41f2ed23e7a055334ce2d57e878", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089101, "uuid": "ed482327-ddf5-43d0-94b0-cc70938dbae1", "comment": "Malware payload", "value": "c6c2cd26485e431ae5b0b94632872486a944de793c5fb3d0482c468782c59b0c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089101, "uuid": "1ee50505-db2f-4e3e-8870-03fc522932f1", "comment": "Malware payload", "value": "b908f72b784a35bb54590288f5587a46a1767e53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089101, "uuid": "990109ff-3a59-4367-a457-959ef7a5ece7", "comment": "Malware payload", "value": "015007e77253b6476a4b3841c412d196b8ab5b4b0d95fa5eced89e54f81d01581d375d781296ca1231d639889b6885f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089101, "uuid": "045aced4-4c40-485e-b045-e50c12ffd10b", "value": "T13745235BB7F85031CCF9337499B957930E38BDA15C3CC2A623396963A873980A57136E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089101, "uuid": "8f080069-ddb8-4543-9470-648641fbf90a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089101, "uuid": "a458d66a-e2b5-429d-9d74-b15c890a0d6b", "value": "24576:vyxg+GA2WAII549eljDWD4TI4V6TJ0dG3H:6xGAMtOgjrTIRKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089101, "uuid": "4f27ddc1-4e5c-4658-9fe5-9844910f83fd", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089101, "uuid": "1406dfae-4559-4fef-aac5-10421df02dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089101, "uuid": "695173ab-d9c1-45e3-8ebb-04cb3b79bced", "value": "c6c2cd26485e431ae5b0b94632872486a944de793c5fb3d0482c468782c59b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c5fd4a-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089102, "uuid": "b7cd0c74-9164-48aa-a3c4-e68638394bee", "comment": "Malware payload", "value": "6f986d95d1a5973490924140d56614df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089102, "uuid": "fab531bb-c563-4067-95cf-67be98609160", "comment": "Malware payload", "value": "c6d3abab8d6856278495cc4c02eb0bd937b6508971f505dec72573a01df6f19b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089102, "uuid": "2cb98b32-b072-4749-85cc-b5a7ae90a503", "comment": "Malware payload", "value": "e4ed18fbeb341dd5ddc49b70850ec276597a25ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089102, "uuid": "6c44eda0-30f0-440a-a3cd-90d9e48f053f", "comment": "Malware payload", "value": "28dc74560bbd3cacce7664a0a6bf82c79d092ce3115f632c8318ce0ed1ef6ede5a88c8f5a373155146e6d3fc028aee93", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089102, "uuid": "40ee76fc-09d3-46ec-af16-20ef99afd9f9", "value": "T140452353B6E85061C5B46B70A8FF07830E397E21DDB8A2275745598B1CF32E1A53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089102, "uuid": "19441525-d079-4843-974a-98a3479f0aac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089102, "uuid": "ec430290-7690-4a3e-b358-50826ee8e001", "value": "24576:ayy9XtiCAqa+ivLkHgHOqahMXmQpqSm6Wjqcq9R:hyJ/a+Y/OqahcmQpqx6W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089102, "uuid": "6dbddc98-6319-4f55-85ce-98e90c254887", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089102, "uuid": "4091004b-2bb6-4602-b519-ef8b5c5ce387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089102, "uuid": "ad9ef390-7c1b-471f-902d-ba8ddf37512e", "value": "c6d3abab8d6856278495cc4c02eb0bd937b6508971f505dec72573a01df6f19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9382764d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089103, "uuid": "7a1397ad-4995-4839-97aa-97633af0dbb0", "comment": "Malware payload", "value": "ded432a644ec2446c36f2e494714d7c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089103, "uuid": "55013935-25d4-459d-9cb5-8a621268d0ac", "comment": "Malware payload", "value": "c6dba2c0456235db30427c458b548ce3bea9a7b31f3b9d7bdf63d33b5e322bea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089103, "uuid": "731884a6-a8c9-45d3-8819-06bcfc6b4d24", "comment": "Malware payload", "value": "93b9833ff6637f8feebc027ff8c14077f070401a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089103, "uuid": "f3155de5-3a44-48a6-96d3-575ab6ff5548", "comment": "Malware payload", "value": "c15bb3d03c7d09ab89faab39eac84315e82d14a2a0a2662a6058cc65c5035db6d695dd591b9627e6701070abfa380ef6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089103, "uuid": "eb09a711-a173-4623-ab3f-197da170c388", "value": "T1AA45230BB2D52072DCB637B064FA43530F367DA2696C475F1F25A88B0C729919A3937E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089103, "uuid": "19dbcbe8-4bcf-4cae-a98d-061dfd5ad1fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089103, "uuid": "ae23e2cc-d73e-48ef-ae31-9557e957bf53", "value": "24576:0yTq3eNZQKrmfysYrhXtOxMi+7TOcCoBDIzazAO/p6vrYVyLkAH:DTqunQKZsA1tvi+3OMIzZ8pQsVU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089103, "uuid": "3e22f93a-9719-42c8-8545-fa15e453f97f", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089103, "uuid": "afb99f1a-a352-4d23-a152-f54e1432f002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089103, "uuid": "1cb30807-36de-4529-9c5f-3737014e625f", "value": "c6dba2c0456235db30427c458b548ce3bea9a7b31f3b9d7bdf63d33b5e322bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942a11bd-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089104, "uuid": "ccc840a1-4110-4474-9507-a16b5251885e", "comment": "Malware payload", "value": "230ef8b366ca9af1d7a50025fb8f7cb1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089104, "uuid": "c7ba5a4e-16a0-42b4-a817-b4ea06f65632", "comment": "Malware payload", "value": "c715b815f4ea57106c66eb3b030142aa1c2a2be3f3686ad2d38872272f06b898", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089104, "uuid": "16a7034f-efc8-4be0-853e-f193fc78b00e", "comment": "Malware payload", "value": "3165ebe8354fc8a4f4be40fac3af04d84fb72563", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089104, "uuid": "caa8f040-155d-41e7-b822-ed2ddd65c678", "comment": "Malware payload", "value": "7cf4489648b3eb276f4f70da31c99222da0acc8849f1f54671f676cf29ca5a8af20631d60a0326d6b9dff823778dcfb9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089104, "uuid": "5b02d901-9174-4785-bfe0-113cb3cd89d5", "value": "T1AA452317DBC84172E8F143B098F546970B34BDE69CB9432B270299AE5CA37809E35B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089104, "uuid": "70627ce1-fa12-4354-9cf2-66d41ded95ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089104, "uuid": "309cbf0c-d57e-4ba0-8bca-2702ca34be18", "value": "24576:ay0Ko72b429pagUJr71F5Sr2UiZKA/sPOPhr3ql38Al/9+NLOoxwZShi8:h7oD29ggUd1F5vS/POUlsA3oxwMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089104, "uuid": "68cda947-2b3f-483d-9aca-d2e79321cda9", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089104, "uuid": "41a5ec6b-6129-41bd-9c6b-1e2e587c6f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089104, "uuid": "26a6de6a-23d2-4dd5-8162-9e607d8afb69", "value": "c715b815f4ea57106c66eb3b030142aa1c2a2be3f3686ad2d38872272f06b898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9541d1c8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089106, "uuid": "4e446d3a-1fef-4c10-9126-63b0b13dace1", "comment": "Malware payload", "value": "a5d2653c4b298322f6a8f7e10cbab4b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089106, "uuid": "c1c479ba-e4e9-4bc5-a77c-41af692db00e", "comment": "Malware payload", "value": "c71a3942498f86078a3380785fa1bac76b4b011d574adab4dabad41af05a2585", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089106, "uuid": "4b1fe899-f4d9-4425-9577-afa432098bca", "comment": "Malware payload", "value": "7790c633e87f381a5b2a4a1cf1a514a367077d32", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089106, "uuid": "d69c7710-2128-4cb9-86e6-e08375510c34", "comment": "Malware payload", "value": "7849832bb8f9555b77c406fd5f6dc76b9cf85d22b3a8206ffd44dd2843b637771f9c7993a61aa9298b95f61e4f322249", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089106, "uuid": "ad63d14e-c8f9-4a54-ae77-30016b3c76c4", "value": "T1B7F42202EBD844B3D97853702CF603C70B397EA5AA74975B2609686B6D73280E47377E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089106, "uuid": "ab750c39-6df3-497e-ae29-5d58f8602390", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089106, "uuid": "e9fae045-27a0-4c40-8be8-ccd2a4941d10", "value": "12288:bMrny90ZNqz8NE89Q9hdWO2xDi8KbO6HatCCVTrR9w2/ZcSj+cz3jv95sqV:AyucYE8mhJe6HaoiOhs+gQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089106, "uuid": "ec875b32-f1d7-4ae7-a420-f0129bdee585", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089106, "uuid": "df22340b-2bce-40cb-b6ad-22db5aa4d50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089106, "uuid": "020b502f-dd2e-4a80-897f-722255f9014d", "value": "c71a3942498f86078a3380785fa1bac76b4b011d574adab4dabad41af05a2585.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f310a1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089107, "uuid": "32cf92f0-a916-4e36-b303-52dc8988e8f4", "comment": "Malware payload", "value": "94458da484b431fbddd64f08220c7e9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089107, "uuid": "ac04a0ed-64a3-4594-b074-3ef6a384179c", "comment": "Malware payload", "value": "c75f15f840f85cad04d4e78357f3df8bce7bc5cf201d16115b90f6a68d9a87c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089107, "uuid": "02ef7738-138b-4583-bd00-d6cb5a2031db", "comment": "Malware payload", "value": "55e6920e025fbbae8413dc7763c46adff9976456", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089107, "uuid": "ffa47390-600e-4f86-8f64-d6a92d519960", "comment": "Malware payload", "value": "fa9814f1de6fa5b34e2d94effe9bc9884ae7ed6b60d293c4cd5f62013641d67e37f9347ac400da12e794019383620161", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089107, "uuid": "d1545a2a-6ffb-4b59-a650-f85f11c07eb8", "value": "T12A4523526AF4C073E9BA2B3058F313D71A3E7F816878932A25984D490CB29D5603B77F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089107, "uuid": "3e068feb-1c4c-4bf7-9f7d-2e983173faa1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089107, "uuid": "26fc1f10-b082-4725-acc7-95a86dd56fa9", "value": "24576:2yQuook6ROQ0z98Ociu9aARoQ+qBOe+hKOXYrKkyxis7FzNZ+:FQ36QQ0ztJu4dJKO/KKkyxZzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089107, "uuid": "82fa64c1-717f-49df-ad53-aedf07264367", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089107, "uuid": "3b0b60c9-f178-48e5-a39b-eca91304f037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089107, "uuid": "26c5b149-d098-4cfa-ac26-72e33f8db90b", "value": "c75f15f840f85cad04d4e78357f3df8bce7bc5cf201d16115b90f6a68d9a87c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ad25fe-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089109, "uuid": "eec95c9a-dfe6-4714-9ca0-d517aa77c559", "comment": "Malware payload", "value": "6f33f77931b6fcfef8b072ae80a9c6e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089109, "uuid": "36547844-a6c2-492a-a290-2528007002df", "comment": "Malware payload", "value": "c76a7e2f1fe0f8037c82eb595a1ebd66010f5fcc5ca030774d85c5583465bf3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089109, "uuid": "fdc44c0f-26aa-4073-b05c-03e285412d7b", "comment": "Malware payload", "value": "0ec4b08345f43a221c92c43f4ad09d5360ba9039", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089109, "uuid": "d6875a43-3496-4eb2-9dbb-76828745f4d7", "comment": "Malware payload", "value": "8dffa3c3d66c13fec7af77e4f7fb92ce76128024797d4b64ae55af94ae238c1efd6682af4bc2a2512bc46a42639b6d10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089109, "uuid": "66354668-e5e0-44ef-a261-5a3aee152c5d", "value": "T137452312DFE49073F5B217B049B202931A797CA6987483AB3A45A48B0CB37D5DD7272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089109, "uuid": "0973452e-7267-4ee0-a5ae-a5e998377b55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089109, "uuid": "166f4266-4668-41e6-b7ad-14b4b30b8911", "value": "24576:1yt8+PRULrVIxKigtDh+rw/YRvvXjZNtNhBXEpAtg+Y:QK+PRUVIxKdaw/Gv/jZbLRZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089109, "uuid": "a65d97ca-2171-4f93-9c74-84e4bffed7e1", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089109, "uuid": "87025dec-64a7-4528-b03f-5cc8b8daadb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089109, "uuid": "bcfeccc1-8c88-421f-bd0a-28a3fe737ccf", "value": "c76a7e2f1fe0f8037c82eb595a1ebd66010f5fcc5ca030774d85c5583465bf3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808fd90d-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056430, "uuid": "4ebed64a-2148-42d6-8e9a-8ab1af4c33c9", "comment": "Malware payload (KmsdBot)", "value": "8b436fcdfddb2f7b0b033530ebfa45d4", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056430, "uuid": "f927cf01-5a14-49d1-b702-6cabb4d50647", "comment": "Malware payload (KmsdBot)", "value": "c7a7a77343869f30004d02cba1bb24fd6c34770b40a19f37eb11c1b1d814446f", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056430, "uuid": "57091f71-3452-4162-b1c9-8877e560d9a4", "comment": "Malware payload (KmsdBot)", "value": "4ddc7718ea96f98e6726cadda20d3fcbeb563c0a", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056430, "uuid": "9bc94d66-2b43-4306-b9ea-414cb0ce8460", "comment": "Malware payload (KmsdBot)", "value": "24914275880809d1b5c1124f128a4208b6d973366f13efcea1997b83f0b80912543b63bf78746321a283689fc27261ff", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056430, "uuid": "543218e5-74fb-42cf-9eeb-03f33f598083", "value": "T18D368E0579157AAACB1542B347BB4F65237AAE551B72870A8304F6EF9DB320F4E10ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056430, "uuid": "eed02f85-64e5-43ee-b5f8-3131a7db1e17", "value": "49152:luMfdpC93EJRIkiAuvX313yXlvOl2GFIuEplCz1cMR2bpy:sMfdk93EJRIrJScsGKvCcMRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056430, "uuid": "10b6bcdc-eb34-4214-b530-aa9d31b7c1e2", "value": 4864551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056430, "uuid": "8ee45d16-c95b-4e6d-81de-5c9935987b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056430, "uuid": "94d22c7d-d650-4917-bdda-ecddbd4c444d", "value": "c7a7a77343869f30004d02cba1bb24fd6c34770b40a19f37eb11c1b1d814446f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2703588-f1f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684026932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026932, "uuid": "e5e9ea26-dd6b-44f1-8480-8430d8afda08", "comment": "Malware payload (njrat)", "value": "b598203809aabb461b2864d1d3bb3eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026932, "uuid": "8e145d39-0662-4a50-b5e3-4202ffe2e4f4", "comment": "Malware payload (njrat)", "value": "c7aa41d62466569740cf53a9d90bed12aa0895f296f5e7e51c33bf81044cb78d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026932, "uuid": "15eea410-fba3-4955-bfb5-3d7f5f9b4b4e", "comment": "Malware payload (njrat)", "value": "57af56fe37f9d35a16f430a9796d10d84b077264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026932, "uuid": "7a2a597a-d709-43d2-bc45-cb27ec7260e7", "comment": "Malware payload (njrat)", "value": "722be5ebf0f52b654937da736c67e5888f37117983854e41f8d83c4835d92a4c32507360effa7de909a6d70d1ca36f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026932, "uuid": "212e6495-17bf-487e-b023-e3cf51b1198f", "value": "T14E03194D7FE18168C5FD157B05B2D41207BBE04B6E23D90E8EE564AA37636C18B90EE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026932, "uuid": "66a808ca-5ad7-44c6-abd5-57b52d3b8034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026932, "uuid": "a46cd9dc-6aa8-42f2-b282-edf850b9b791", "value": "384:JYqgUiDrblmJEpRGyEfdDPTuWCYqAlLrAF+rMRTyN/0L+EcoinblneHQM3epzX6/:KqyHpR9EfdDCWClAprM+rMRa8Nuslt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684026932, "uuid": "2e8d6258-2357-406a-81db-42f1760cb087", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684026932, "uuid": "030cc835-c5f3-4df5-8d85-9b7252cef424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026932, "uuid": "cbe40735-feaa-4342-a387-d58c0c5f16cb", "value": "b598203809aabb461b2864d1d3bb3eb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9760825e-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089110, "uuid": "693b95f2-b98e-4a52-9486-69bcc88308f9", "comment": "Malware payload", "value": "0065a9afa72f8f60d68d0b02a2ab792b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089110, "uuid": "6414c144-0181-45f1-b66b-0589970013c4", "comment": "Malware payload", "value": "c7b35a041438f4e28e5fb0f3775055fdfa4d1450b41d2becdb0f38d1cec20e8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089110, "uuid": "4aaf61da-2488-4631-b674-3b9fa99a41e8", "comment": "Malware payload", "value": "35460c8ea2244982a20ae8dc2ddd76e584229a83", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089110, "uuid": "92af29ab-f619-4f2a-b00a-de97e8ad6821", "comment": "Malware payload", "value": "4c08cbbb1821db2ccd8f803553f2d209868f00854e8b583de794036744e9bb419fbaa05fb3aec9dc73d4e6fa8a83cf0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089110, "uuid": "942c44e9-85bb-48ad-ae3d-a271939b68e4", "value": "T181452311F3D40072E9B0A7B064F702C70B79FCA1A9F882BB2659A9465DF368171713EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089110, "uuid": "b64f0f99-76b6-48d3-b8fe-40b3269d6bd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089110, "uuid": "10eda45a-b74e-45d3-8b97-6144fcfce23b", "value": "24576:zyjl0EbQaMsx93XgaVED2i919ajsq+lAFrjj43L54KvYZ+:GazVsx9n7Y2i9rajs3Ss3tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089110, "uuid": "e3cef298-6862-433b-a3f5-bb08e269e8e1", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089110, "uuid": "ea4198d7-6349-4a8e-995b-f4959511ecbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089110, "uuid": "1413a9e3-e34e-4b2d-bbb4-947d59611406", "value": "c7b35a041438f4e28e5fb0f3775055fdfa4d1450b41d2becdb0f38d1cec20e8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b47039-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089112, "uuid": "78ce94cd-82a7-4ef9-81e2-f23668b75f94", "comment": "Malware payload", "value": "0b6c244414323589362c08fadce18d32", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089112, "uuid": "0b96943c-6b49-4639-b7bc-8527ba9799de", "comment": "Malware payload", "value": "c7c4015628de6c22e953876d26e30bb5364eb03e40d3a59f48f548d9e4a853a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089112, "uuid": "fd78131f-b4e5-4ef7-b5c6-e4688c4cebed", "comment": "Malware payload", "value": "0c7c6fe43f2e44aa4ac6c43c49ca2b41d9ddff49", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089112, "uuid": "6eabf7f3-a2e3-4c8b-bcc1-ffeb5784bf32", "comment": "Malware payload", "value": "c1ca99164a215c2ccaed246eb193318fdb2b7fa1bf1c75a30292b988818c4583cfa21ff01b920d81c752b20eb51d6b75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089112, "uuid": "9b82af0d-270f-4556-8113-d2c363dcfdfd", "value": "T17D452385B7E50173ECB1ABF12CF642A70539BCE08936437B6745588A1D73A8CE93137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089112, "uuid": "436bbbcc-d271-40ef-8101-fd1a7e9e2db7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089112, "uuid": "389ed1d6-854c-4ba6-9b06-7b8eff741e6f", "value": "24576:qy4neMHPHsX/tWzU0/MzWRufWhEg2blH/kdhmsJhpn/QseT:x4e6PHsX/0zvyfsEg2pHsdAsJhpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089112, "uuid": "87a9d6fd-64cd-41b4-a4d0-4edf197a8de3", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089112, "uuid": "24a218ec-a7ce-4ae5-b49f-0c877bb0bae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089112, "uuid": "b769b77d-b5cb-4bce-9ae7-440ee8959c28", "value": "c7c4015628de6c22e953876d26e30bb5364eb03e40d3a59f48f548d9e4a853a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3abb03-f205-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684034114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684034114, "uuid": "cc05c093-e6a0-44b8-843b-1c102bf67365", "comment": "Malware payload (RedLineStealer)", "value": "f48349e7dfc25d0d5adfea8ea1277e74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684034114, "uuid": "6c5a34a3-eb31-4969-8b04-d4037ad5adef", "comment": "Malware payload (RedLineStealer)", "value": "c7d060c9074cca55e9e04d61d0caf3dd9934b45dedd890ad5a3208022a35425e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684034114, "uuid": "5cb562d7-39e9-4661-9601-36e4e69eeddc", "comment": "Malware payload (RedLineStealer)", "value": "37bbb5782c0604fa1e29614e5ac05325fbcfc400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684034114, "uuid": "624b8d1b-ad10-43b8-b0b0-442d748dbaec", "comment": "Malware payload (RedLineStealer)", "value": "8714f4ae87c9bf7255419945d4b5cbc53d2b5be71a0ef1274a0d2242a6db8cc0ab9d3034912bb1f682a4d96bede60113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684034114, "uuid": "d7d66dae-186e-4e21-a37c-f9584e170479", "value": "T16F452307A2D48472D8E56FF449B347A30A37BCA1DC7CA7964B85A84A0CB36D476307B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684034114, "uuid": "d9283df2-1285-4dc1-b4e1-a2835587d497", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684034114, "uuid": "3e926fdc-1af4-4e87-8085-ad98b0227c87", "value": "24576:WyDmehoycwUQ8052Sy9Tc4g47ri1yeH2bXN3wmvYbRDLHGxBXs5xyi+:lDmeUwUQ57y9Tc4gpmjNXYbRVei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684034114, "uuid": "59493aa0-f8ee-43a8-a7c7-4b5c60611207", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684034114, "uuid": "8d76e0d5-b346-43b1-b625-b599097993da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684034114, "uuid": "5cd4d0f7-bd79-4263-9249-21fcd37b8eda", "value": "f48349e7dfc25d0d5adfea8ea1277e74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f9456e-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089114, "uuid": "17c0476c-8ab7-4205-aa95-b963ea38c47c", "comment": "Malware payload", "value": "92e67b13ee0cf3488be404b9a48b1fde", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089114, "uuid": "1424bbb7-25e3-4cd6-8a9a-08621b69767d", "comment": "Malware payload", "value": "c7e1696ee91dacd0412b58893443f4b4e7dc3d33406e9690eee6646e9d8e875e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089114, "uuid": "dded3050-0cb5-45f2-8053-07f89aa5d445", "comment": "Malware payload", "value": "015b1736939ae7bb7f507d774b2765847886fb8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089114, "uuid": "700b4a5a-c059-4109-8925-cde072aebdb0", "comment": "Malware payload", "value": "9391359712b0a5af5ce49ee58836bc7631e7ee8d51bc958ea226fd182bd1e02147e37abb25322e61f3e6fdf86b4bc9b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089114, "uuid": "c55584dd-c61f-4304-ac46-53538a132986", "value": "T18C452352E5F89026DEB703B018FA45832E357CA42A78D76F138BFD190C369C5A476B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089114, "uuid": "8a95cd5e-4a42-4993-9a8b-5801123fe0aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089114, "uuid": "9e6b4709-7aa1-4eee-8bc7-811449213265", "value": "24576:qyYZmPGAjK+ocOXWVI4lS4nrJ+KZ1gVcSk58HFeNmyR32cEquQ:xYZmI9bUwKMeh2HkzR33E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089114, "uuid": "84e0cbd1-b0c6-4ac6-bd12-07286fcdf7ad", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089114, "uuid": "65c3c4fa-1192-407f-838b-f405304e6d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089114, "uuid": "ecba6670-cb69-408a-9006-8aa6ea530eb0", "value": "c7e1696ee91dacd0412b58893443f4b4e7dc3d33406e9690eee6646e9d8e875e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9dd1f7-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089115, "uuid": "228fd54a-b763-40a5-a916-fd9c539df3a3", "comment": "Malware payload", "value": "a6d256eecf7aff465d13d0b7e84a6bb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089115, "uuid": "7285d9c8-d366-4d9f-81f6-e89f9b75eec8", "comment": "Malware payload", "value": "c823a995bb95ef332eb1d2f0cecf40168a977067826c039928c4208d79f1b8a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089115, "uuid": "c0b41c47-a88d-4121-a53a-b3484757d0dd", "comment": "Malware payload", "value": "b56f7b853f063660fc3b7d80eb5c3146f841202a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089115, "uuid": "6b4e7c3c-5f4e-4472-9904-3c86683ddfd8", "comment": "Malware payload", "value": "ca60925f28ac54241604f77e90e860bc86bae13c595293b11403545344d810803314b658304a09410eb357a85fd42c41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089115, "uuid": "98cfc48f-5387-484b-88b6-bd417f526637", "value": "T1E4452381A7EC4572E9E93B3050FB03930A37FDA6992C876E571659871C722C0BA7473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089115, "uuid": "4a52b08a-8ff2-47bf-b5f8-88bffb783dc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089115, "uuid": "4907e1fd-66ec-4c38-8d48-010ed1def4e3", "value": "24576:uyIu0vuyOht7pwa06AkBpNbjyo2EsWenDnDH8KBxxqg:9IuwFOrqa06A+DHnsWMnjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089115, "uuid": "2f730b62-0cab-48c7-9fce-28e92f7b55af", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089115, "uuid": "30446fd6-d3ea-4a37-964c-af01d0b81bd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089115, "uuid": "4572524c-974e-4c94-b31a-f711ae33bcea", "value": "c823a995bb95ef332eb1d2f0cecf40168a977067826c039928c4208d79f1b8a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773d65d7-f289-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684090774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090774, "uuid": "1a87652a-450a-4f31-8c33-41e3aa1ef410", "comment": "Malware payload", "value": "46b23e41aeba2bb731b8ae3e22a7e5dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090774, "uuid": "4ea46a77-1475-4d8f-85fc-651c23afecbd", "comment": "Malware payload", "value": "c8277e88b37878917b46d509324a57846d58e285c3e06720a282e7bb34fd9bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090774, "uuid": "87b892fd-c4ca-49d5-a38a-1b9ee8958d47", "comment": "Malware payload", "value": "a180b34c6f9cc519d1d3773904c56c3d952ca423", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090774, "uuid": "c8953b59-00be-4255-9ff7-ca30af2880a8", "comment": "Malware payload", "value": "c2226419d2261ee41a1eb47427111916f5db2e75b31f15d9ba9c56a0e2f83a9b9558cd1c4c8be18d82071d0f5cbf1f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090774, "uuid": "52e09a91-1379-468b-a08f-9b7d6b96eed6", "value": "T10C748C6373A4E93BD1BD1B3AE436061587B0D447BF0AE38B5A5851BA3D233868D503B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090774, "uuid": "28fc36bc-217b-497a-bb94-0458f219568f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090774, "uuid": "99764c51-03dc-49c4-8be4-5eee4d4ab866", "value": "6144:+2NHXf500MGQqCgPsccwxdbNNepgFVswka:1d50yzVteGjswka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684090774, "uuid": "a847dd60-ff43-4c53-b8b0-e449551425f4", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684090774, "uuid": "90f068b4-c831-4617-8c63-1428be4413b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090774, "uuid": "c811c9f1-0ff5-4d19-be34-f83967fcd7c9", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3c5874-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089116, "uuid": "5b7e124b-0a76-4131-84ed-b9b75ad95b02", "comment": "Malware payload", "value": "22798a73b643a6fcc9c85bacafefec2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089116, "uuid": "1948012f-db06-498f-b45a-71e6f4cbb9d9", "comment": "Malware payload", "value": "c82e89afab7e10d02a7def8a80d879fa562c167cdb94f55b8ab624bafe789c31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089116, "uuid": "2f9b46e9-db4d-4f3f-bc1a-3c0efd297e35", "comment": "Malware payload", "value": "ba304afa530ca83ac62b1b91ccc5b280eea5710c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089116, "uuid": "8b2eb34e-e379-4016-9dbe-58e97c433048", "comment": "Malware payload", "value": "5466e0db01a4210ea1928974ec8940e0022b987af73577c221809b97bd0586dd2ef16caf8b59e54692aab9c1ca794f7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089116, "uuid": "519fb2d8-5bb5-4bb3-909d-65fafab65a5e", "value": "T116252352BBE9D533E9762B3049FA438309747CE64D38436727D2A8954A73EC09872B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089116, "uuid": "626aa1e9-7d47-4330-8533-47e48ee75d80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089116, "uuid": "ccec0e53-a578-4727-9aab-d1f4659aece0", "value": "24576:sy2ALqXadUfRSgWcL5+eevWhDV2ijeAUTRzW4m:b3LTMPWE5nevWhpFeA6R64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089116, "uuid": "178f2bed-9f7e-4c70-adf4-24d484c883e6", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089116, "uuid": "681e170f-a222-448d-b9c9-63a0222fa5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089116, "uuid": "20817da6-f999-4d4a-94e0-d27c410d1cbe", "value": "c82e89afab7e10d02a7def8a80d879fa562c167cdb94f55b8ab624bafe789c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf4a510-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089117, "uuid": "5712a42c-203e-407d-9f93-995e20f57882", "comment": "Malware payload", "value": "4ba0eb9893cc55e99abfee6c185355f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089117, "uuid": "1f8e71e0-e3d1-4257-87a9-5365ac978ff6", "comment": "Malware payload", "value": "c84f9ac78cc2c870d9089272e201eab88c63f756c687e4f36c65c36f9167c134", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089117, "uuid": "86447195-00d3-4332-8a85-5065937293c9", "comment": "Malware payload", "value": "4bfc5272de875ceead07e51607129acc32bcd236", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089117, "uuid": "c71213cb-063e-4574-8d3f-bf5e50a79605", "comment": "Malware payload", "value": "f686aee79b585f8118c5814d7d5668e68b20cdf99b5c3e2ff89d1f10dc0791d7f921495b0d3b958112d1ac963445abf3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089117, "uuid": "f49e38d8-f606-430e-97e0-bd8793a991a6", "value": "T1D0452353DAE190A6D8F52BB028F212831E35BDD15EA9835B23492D1B38B37D0B47572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089117, "uuid": "3e753eeb-45fe-4576-9a74-5ae135fc9e17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089117, "uuid": "8ed87435-c50d-4b21-8fa8-cf5bbeaedd57", "value": "24576:nywOVTmaQQyWvfHIlwLFxb4nVUgilj40velsGGm0:ywLaQMHHIEknVU1jxvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089117, "uuid": "802af814-95a8-4d7a-a5da-aa7bee08e196", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089117, "uuid": "1745f18b-3cb3-4b74-b8ce-901a05ce6e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089117, "uuid": "84926885-41f1-47a1-b88b-d27765543941", "value": "c84f9ac78cc2c870d9089272e201eab88c63f756c687e4f36c65c36f9167c134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca39def-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089119, "uuid": "3d65f50c-3010-43bb-8299-e15cadda50e5", "comment": "Malware payload", "value": "014252b97ac035e4310e4bd7674fddac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089119, "uuid": "05fef8e5-cb8a-4011-ba1e-a7b8dbcac374", "comment": "Malware payload", "value": "c865344a337f66669c895acfc0d7aba9cf3d3998eb9cbb5c9825aa33d749f887", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089119, "uuid": "f29b81dd-798a-4c24-8000-02733953feb4", "comment": "Malware payload", "value": "1755484aefdc83a4e33cc63c3fbe4e3277a80dad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089119, "uuid": "76f491bb-a2d4-4920-bfa4-8c652a4a72b7", "comment": "Malware payload", "value": "fb1076c75f09d5d006f8e82dc6d754e2c04cb6a8a4067ad548d05f3ebdeb540b727090b4db8e0ea29f3bc5e9ade939fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089119, "uuid": "8bc809e8-4bc8-46b5-adc7-4ad8ae2569a1", "value": "T1AF452307F6D8A231EDF12BB06CBA63830E327D215C749B6B6B96995718722C0707537E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089119, "uuid": "e459c260-a2c2-4cf8-bd7d-869f93da4ac9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089119, "uuid": "60c4bdc7-d4e1-40b0-9c3b-80a30f5b8b5c", "value": "24576:qyywL9R+UhHiB9OE7w9K2VVTtDpB5s8ilF16Yt2DoW:xz+WG9Oew93HTt9kcYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089119, "uuid": "247e46d2-d215-4eae-a05e-824dd372bf3b", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089119, "uuid": "fb2c23c6-6991-4054-8345-8b622b407650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089119, "uuid": "0c532e43-6fdc-468b-889b-c838c532f46e", "value": "c865344a337f66669c895acfc0d7aba9cf3d3998eb9cbb5c9825aa33d749f887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d64a381-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089120, "uuid": "b5a5d9a2-4b54-48c0-8494-7072c768e980", "comment": "Malware payload", "value": "d0f94d66b46fa4735c3560b6a580e418", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089120, "uuid": "afc33384-4b3f-4a33-a166-118f7ca41ba6", "comment": "Malware payload", "value": "c8678e7aec0887bb0e42abe0c4c86f54b67f3b7b7ed25cd607fbdb60a8f4cca3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089120, "uuid": "bf6058cd-8e58-40d2-b816-f90c9f243865", "comment": "Malware payload", "value": "b6f84d41a9c8c6d3e18e1836a60418abe3d0339e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089120, "uuid": "c5b01c35-7764-4228-aa09-91a3990427d9", "comment": "Malware payload", "value": "92f6c055fc936d6cde54c5dbede010edd939c912531976c1bf5052cf041ad9f7428b5f478be6e39a54386cba89b268c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089120, "uuid": "4d171030-594a-48a2-b2b7-a1e095fd6d32", "value": "T1094523C3A7CDC172E8B667B01CFB02570F787DA26830D3AF23459A9B2532184B57576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089120, "uuid": "c7eca1a0-0f9a-435b-9116-677f57b3923d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089120, "uuid": "c1f2d987-de12-4bde-996f-890b9d376341", "value": "24576:yyqXoWA5vq9qZkfmTnm0OJ0ROHnAr2jlwXen47ubfIgOtm3W/f:ZqXoWAZq9Wfmt9aGWOn5bfIgOEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089120, "uuid": "fc3be957-186f-4ed0-9e9f-e1a8c8d64f2b", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089120, "uuid": "2f4a4dc0-a042-4d87-b21d-bee5f0008ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089120, "uuid": "b7661675-f0fa-4c58-a25d-10aebd7c3780", "value": "c8678e7aec0887bb0e42abe0c4c86f54b67f3b7b7ed25cd607fbdb60a8f4cca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816b2ab0-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (KmsdBot)", "timestamp": 1684056431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056431, "uuid": "bde722ec-4d59-4d46-b1cb-68e77ffab891", "comment": "Malware payload (KmsdBot)", "value": "dfb0e814724aa87ec71f93e1cd6ed970", "object_relation": "md5", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056431, "uuid": "cfaacffb-d13d-4670-b7c9-bb26b44907ff", "comment": "Malware payload (KmsdBot)", "value": "c8995af31396ef03270e847c1f40e1b860f3b838b7a6b0cde9decc2a3d01cad3", "object_relation": "sha256", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056431, "uuid": "3b41f63e-54d1-487e-87f5-9e2c59d0e07b", "comment": "Malware payload (KmsdBot)", "value": "9925f8e540c000eec27c097999699270c952a1d0", "object_relation": "sha1", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056431, "uuid": "7a6ec848-181c-4aa2-b32a-67b2b5480db6", "comment": "Malware payload (KmsdBot)", "value": "64170c2a539b00645da8e2c2f4949d36f5249aa1dc4d19204efa58552603bfd867a36d4ec2d7f057f75337df24a116b0", "object_relation": "sha3-384", "Tag": [ { "name": "KmsdBot", "colour": "#26664C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056431, "uuid": "16782fa0-c098-4192-b5eb-deabbdc3661d", "value": "T1ED366CC0AD90C24AC62E2A31EFE6EFD8D3377A305C846B4AE9D9F73D4DB624444B5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056431, "uuid": "139c8fb6-d37f-4369-9906-48df66c1562f", "value": "49152:ccrZwhdtcJd2i/tJoawfAMZ8J9ayGHu1ijzKqm5xFn5+:7rmhdtcJ7/xwLaQO1ijMxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056431, "uuid": "0aa7a896-e484-4095-870e-a462e7cba3d3", "value": 5160981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056431, "uuid": "d9ecc339-e611-4dd7-87f6-7e6739ac1cdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056431, "uuid": "fe88d3ce-958b-478d-a4ba-27e374170940", "value": "c8995af31396ef03270e847c1f40e1b860f3b838b7a6b0cde9decc2a3d01cad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e15fb45-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089121, "uuid": "a4a3f88a-0a34-4540-84dd-2d4f677b971f", "comment": "Malware payload", "value": "42362864f5733b6b75470200cd91a013", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089121, "uuid": "09b51e40-ee34-462e-ba94-cbd681340677", "comment": "Malware payload", "value": "c89f102496d157011d6dcff368011b84d54ec2ea22847eb1c9bc4dde9b2dacfb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089121, "uuid": "8058eb9d-db95-40a0-a0b3-2dd756d16963", "comment": "Malware payload", "value": "58706bf1f9aab708b24a8887ea0059745f7e96fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089121, "uuid": "9fb3c243-2786-4fd6-be5d-71f739e488a5", "comment": "Malware payload", "value": "7fc31d96fbf1e12adaaae22cdcdcec4c69d220c25f612c03047b58713d37c1117613af870886708e6a72e045deb455eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089121, "uuid": "6439ba20-ccfc-48a1-ac2a-1b6a4d818a48", "value": "T16145230367F4A831EEAA337419FB0BE30A3A7DE150A8C65AA3465D9719721C5E57033F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089121, "uuid": "3906137a-73d0-46c4-9137-a1481fdf07db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089121, "uuid": "6607596b-debf-4a7f-af68-a62b70ddd3d1", "value": "24576:SyDnfN8kD60UOOuHM8kUdzpDfNvvsn8FEt+iPT:5zVlDn5g8nVDFfSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089121, "uuid": "aae85afe-3438-4b23-9b80-190e9bde77d1", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089121, "uuid": "d36d9dc7-2cd4-4f0e-810f-b4f01d5358e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089121, "uuid": "794b1feb-59f1-4946-8119-6cd61a877a84", "value": "c89f102496d157011d6dcff368011b84d54ec2ea22847eb1c9bc4dde9b2dacfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebfebd5-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089122, "uuid": "61fb8cc1-396b-4a77-8d83-94729ac2a984", "comment": "Malware payload", "value": "6f0d28c48436e26762d5440db4bb1874", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089122, "uuid": "dc744fb1-8b26-4d24-8217-b12594a70b41", "comment": "Malware payload", "value": "c8a44b14f1fc17df9f9c70e2896351b57fa33328b6e0618874626d1a065ddaea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089122, "uuid": "11b02da3-7451-4c45-b4a0-954fb81ac327", "comment": "Malware payload", "value": "fa6b684702e3de010d0f24399d4a5d9d738f422e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089122, "uuid": "fcabb591-dd8c-40eb-8ef6-ac7fca289cb3", "comment": "Malware payload", "value": "a6a5992172b253e32db2c48cae73af23a36978b646f4a0d4b719176abf2a2e08c43d6c6e0e18d6d4ef380df491cda87a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089122, "uuid": "d64a49e3-2368-4eaa-89e0-02533e14360c", "value": "T172452322E2E44475D8991B7041F743C31A3A7E909979431B234BEF9B5DB27C2A63633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089122, "uuid": "12ad01d6-6c80-4e54-b9ee-74831b8de523", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089122, "uuid": "9fd149d7-42e9-4e1e-a2e9-b97543837dd6", "value": "24576:py9Nc7uf3Acq8B4pX6cYusx45dxCqfTiqmUJaofdPr:cHcOwRk4ZA4Iw+pUJaolP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089122, "uuid": "dd599d6f-7a53-4e0d-94cc-ee989f395e70", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089122, "uuid": "595ef2e0-bbbd-4bfb-9335-5b1d64cd2e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089122, "uuid": "4fcb56d0-7b1a-43df-bfbe-4de7db19f2c2", "value": "c8a44b14f1fc17df9f9c70e2896351b57fa33328b6e0618874626d1a065ddaea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f86392b-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089123, "uuid": "41643a13-b80e-4e3d-a8a9-3376cbfdaabb", "comment": "Malware payload", "value": "5247f87a4e453c596cd50dc3f82ba576", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089123, "uuid": "2cc57076-928c-4b22-81e6-ba3bc0c1f6d2", "comment": "Malware payload", "value": "c8d709e403b7861eea6ed676e7554acc519699b529aaf27f0bf9b1abbfc9688d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089123, "uuid": "7eb18f5a-8ec3-4b5a-8718-749468f568ac", "comment": "Malware payload", "value": "b0c734dec17c6ef571e31d9f3676151879ab1245", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089123, "uuid": "a6eab7a5-56fe-411e-9153-e72cee6eee93", "comment": "Malware payload", "value": "b69cfb319c2f928076377ead1435a6907a94e91a0cc66c77d4d9eaa22d12526647fcc110436aa57af7dbc83d46b337e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089123, "uuid": "1a632d31-38c4-400d-9434-a616926897b7", "value": "T15A452303F7D4C4B2E9F547B058FA07834776FC518C78A66A2A59AC1E48E22D8953273E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089123, "uuid": "40ca9860-2623-430b-a6b2-86c0670b26cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089123, "uuid": "8fff5355-9add-4add-bb88-1d902756865c", "value": "24576:eyrRK6qvpruFFlhUq8XySsCdLgy4NsGUwKwgi5yScmNcEphP:trU6qOUZypqL0NrUwUi5KEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089123, "uuid": "22ff2ea3-6798-4a64-8be8-0fa388f3cad7", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089123, "uuid": "1bc5067b-5aa0-408b-99b1-7415a2b9870b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089123, "uuid": "96a999b7-8410-467d-8543-4ef4012c4256", "value": "c8d709e403b7861eea6ed676e7554acc519699b529aaf27f0bf9b1abbfc9688d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de9c742-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089389, "uuid": "331907f2-2ab2-4992-a87d-d398de8a91e6", "comment": "Malware payload", "value": "e153215c0fd015d95748d98c92957c6d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089389, "uuid": "9712f348-f383-4186-a2aa-3bd39274af1b", "comment": "Malware payload", "value": "c8f1dead98acecde9e80e8c2599c0482c329d0aa0089d025f644b69a9897f39e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089389, "uuid": "05e7070d-4a99-4139-b7ee-bd502d76e3fa", "comment": "Malware payload", "value": "8a312de632f23bd678098692796817ce7c59337e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089389, "uuid": "d63af129-32ee-470d-8d67-89e637807278", "comment": "Malware payload", "value": "5176f962b5e21d218d1bc91ec16eac4fb2438da790a2fb9570ceddb98ed5f49b6e1b951ed27f44653be1f666c9292e7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089389, "uuid": "c7706837-4caf-4b7e-bb65-a2a2eb26d1ce", "value": "T1C324010BBDAE85FAD557447B4104A63AFB5C8DE9D04CC82F25FD58490C7AC2D260EA8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089389, "uuid": "aa359aa9-6982-47ea-93df-ff3d33ceedfc", "value": "3072:hO2A7Gs1fZj56yUNlCAJ+smQk+Y6QPXsIjvR6kVbACZecuYkf7ZLnsfZfy:A7GCTUrwDQ1QPXs2vR6kCCZ14f7Zr6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089389, "uuid": "a5c10822-def7-4228-a50e-15c854023995", "value": 225197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089389, "uuid": "38aa60b3-fd7f-4b3b-b5c5-2c02636ef605", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089389, "uuid": "d98cb00e-3746-4595-8d93-a7f5f4d062f9", "value": "e153215c0fd015d95748d98c92957c6d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02e75bb-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089125, "uuid": "70779912-7abb-4b6f-bde6-c95769f5bb91", "comment": "Malware payload", "value": "e9e1fbcaa431ac98513aae4930c17708", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089125, "uuid": "99244278-d73e-4ec7-b43d-c799744a0af1", "comment": "Malware payload", "value": "c91b34e20d6e23a75ce79c51bd6536f0366b759730476b0d6fdd2346efa04839", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089125, "uuid": "0df372be-66fd-4e9c-9413-b56c058d03a0", "comment": "Malware payload", "value": "bf358250fc3b2bc12a5a7375d011000038ae9ec2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089125, "uuid": "a1db096c-ed13-4ab5-acdd-4f237aa87f79", "comment": "Malware payload", "value": "a36660b62e2938ae3f8ab64d70e188bfbaabb4c01b7f0cdb25b3b5f644ee47b92184586d471c78531241069d1fa79fd9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089125, "uuid": "6e3309f0-f514-4579-8947-feaa0119f960", "value": "T12345230AEFE44032EAE25BB054F203931A3BBD72CC78836B2B5679491CB25D4657177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089125, "uuid": "09944021-8e25-4c80-9bcf-02a58c5a841c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089125, "uuid": "b1b90155-b4c4-4afa-b9a0-5bdf7640cec1", "value": "24576:ZyU8D7z/7dZhwycGnul6SVHSCQh1VNqChxtGT:MU83z/7jhjuldVyCI1V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089125, "uuid": "56d3789e-58c7-45ec-ad11-336d193bf826", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089125, "uuid": "7bb1efce-3a9b-45ee-b587-990185d0f18a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089125, "uuid": "2dec526d-92d1-47b9-b033-e67e5deb321a", "value": "c91b34e20d6e23a75ce79c51bd6536f0366b759730476b0d6fdd2346efa04839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d70c58-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089126, "uuid": "b8a8ae16-f7e0-466f-82d5-465d1d80e858", "comment": "Malware payload", "value": "622b266b1e29dc459b9a97f0341cf6d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089126, "uuid": "30abaec3-d421-4690-8cf8-733b4ab90ed9", "comment": "Malware payload", "value": "c9388dc97b2dae1c29c91f87fe5bc3ad7c451e7f2f49b4baf6df374c718ed755", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089126, "uuid": "dc76b173-7265-4ddd-abd9-5a6de98850c4", "comment": "Malware payload", "value": "c856cf21867f3ddbb7ed38a2f961b8424eae472c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089126, "uuid": "25d2f467-6b9a-43ed-9dc0-9d02db32133b", "comment": "Malware payload", "value": "1db3be745dc27b0f50ee7d80f3d86fbe94cbc675ad5899fe4da624580315bdd4879f8727d99dfb5210686d0fcb902984", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089126, "uuid": "602cb5e5-a718-4c73-ab54-a273bfcada57", "value": "T1F7452312F6E49535DCF567B0ACF242C30F347C91A6B187AE5782E4972C726D0A83276E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089126, "uuid": "a648846e-a631-44a4-8bf8-1418cd77f658", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089126, "uuid": "318b8527-1703-4501-b91f-a51042c95c5e", "value": "24576:+yLjpZxck7mzcHP5fAWzQ1j/YZw4z4H73G:NDH7ScH7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089126, "uuid": "d0dd6065-ec90-4c3f-b1ff-a00ccd95db72", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089126, "uuid": "a4f099bd-f8ef-4a18-8e9a-deb55efec175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089126, "uuid": "17f83de1-5ad8-47d5-b79f-c137bd9b42ba", "value": "c9388dc97b2dae1c29c91f87fe5bc3ad7c451e7f2f49b4baf6df374c718ed755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee44561-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089820, "uuid": "d0eb089d-3af9-4b96-beb4-3b1979a29754", "comment": "Malware payload", "value": "44ae702fcc221fcc1fa166f120f4a8dd", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089820, "uuid": "8b312e8e-53d0-46f1-a474-3b3841dd5620", "comment": "Malware payload", "value": "c95dadcf9a6915a7594f3440dc57ed054fbd9bcf88a97d86ae79da6afb2f0034", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089820, "uuid": "c2e9fe28-a4c6-489e-ba8e-b58af9e430e8", "comment": "Malware payload", "value": "8ed8cf96ecf078449de98c26caf7da9dd4fe4776", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089820, "uuid": "1a01c33e-5247-44f7-b7b0-8220ef905d7b", "comment": "Malware payload", "value": "e1e0b2557929ce85e81918fa841f782a397fd70f9fe3fb6e29c5f75b3418191926dfb7f5827d4f44c61e59e0e97ca240", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089820, "uuid": "52db6cfd-d2e0-4130-99c0-feac0dd19372", "value": "T10EF412A6FF1EAA62DA17B03687611352F9245CA05101FE172E82B59C3EF7D04C689FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089820, "uuid": "aa1aa8b3-fd9d-4546-a85f-d458dd1c5fa7", "value": "12288:7RSWA4aoK0koK5S0njzE6Np3BdXnkk4PA4OaxEHyZ6l6AyESXhhAcOJMR+mw:7AgK1nSCc6VBdXnjWA4OacgAFyw20mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089820, "uuid": "a7d20dca-88b5-4e3a-ba5d-f84c740d8f23", "value": 746221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089820, "uuid": "dcafc0ff-ff36-4fe1-a81a-4d4f90e86c9a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089820, "uuid": "8d8de5b8-f913-4481-930d-00634e40f384", "value": "XTaoAd.A.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60f2f95-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058291, "uuid": "e0d7ee70-3a2b-4e3c-9558-828165de57a1", "comment": "Malware payload (AgentTesla)", "value": "74171776b29e523f9afd4d075fc55c63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058291, "uuid": "13f1a41e-3140-43e8-b572-d815f39c1ded", "comment": "Malware payload (AgentTesla)", "value": "c95eabd64c7bd54273fcee058c9af7b19d4183fe1c6745f2753bd1aac0bd3abe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058291, "uuid": "8ed47c1e-5a9f-44a8-9e02-aa6c7bb715b0", "comment": "Malware payload (AgentTesla)", "value": "9992e9934ae19a570a36a36f16615a7816c3c8cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058291, "uuid": "a51f24d9-3186-473e-9ce8-7ac3785b8599", "comment": "Malware payload (AgentTesla)", "value": "64823945e8895f799513925aa6ef5fc59af252b7babe5a110b894d1b0efa14dcce82eb8a46cd97cb47a754a30f5264f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058291, "uuid": "0aae33b2-56ee-4234-9b6c-9c2ea707c4cc", "value": "T1E4D4D074619E8B55E02ED7F12478BCB1037134F3A9E9C5380FA2A6C4CE6BF501995E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058291, "uuid": "1bcf9e67-f5ad-4b67-ab9c-f7a401bf439f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058291, "uuid": "032a3827-e631-43b4-abfd-54cd50fa4856", "value": "12288:Np9SLLBpPCVAJ58T38qQKEVlN8nzLRVo7sEBsZn1f9/fxi:Np9Sx+XuKwv8zLRVoQEBsJ1f9/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058291, "uuid": "3335bcfd-39a8-4789-983f-c00df5818d13", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058291, "uuid": "1b848fa0-361e-49c9-a0b5-589bcf1aeaa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058291, "uuid": "da65116e-3f15-4036-baaa-150286517fa6", "value": "c95eabd64c7bd54273fcee058c9af7b19d4183fe1c6745f2753bd1aac0bd3abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1710e80-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089127, "uuid": "9bdf3c09-6e7a-4c62-95bd-28447b19d942", "comment": "Malware payload", "value": "d03823a205919b6927f3fa3164be5ac5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089127, "uuid": "3a697a40-3e84-40a8-82eb-bb606c0e031a", "comment": "Malware payload", "value": "c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089127, "uuid": "d31a8fde-3035-4635-881c-1ce1c0d457b9", "comment": "Malware payload", "value": "409181132564166a62ee867321ebc07089e49085", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089127, "uuid": "a09cb26b-b8c9-48b9-9dd6-8ad304a74231", "comment": "Malware payload", "value": "8e8a8290e2ae998975bcf044d63be562a2f9e1d862592c6953574961b80df548fd269cf1e54be65ffc58c3ebf822fd80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089127, "uuid": "3f2c6290-2fc5-415f-a5cc-194e1f9847df", "value": "T17FB4021031C1C2B3D5B7613548D6CB369A29307107BE96D7B6DD6B7A2F243E1A23A2CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089127, "uuid": "7ece51bf-0250-4d4b-9bfb-614f3d6c4192", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089127, "uuid": "a429dfa1-490e-4652-9986-f794e21f114b", "value": "12288:yh1Lk70TnvjcrT/6wla486fIcf4cA5eBRDpPKAha2v:Gk70TrcrRlH86Acf4cAEBdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089127, "uuid": "5a3987d1-7b28-4612-9480-d6f85fbdb76b", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089127, "uuid": "e2d1cfaa-07a5-43e2-83da-40c85fdba4f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089127, "uuid": "f3c28d23-3203-4cdb-8180-e779c84b6039", "value": "c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25869f8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089128, "uuid": "bc8c588d-c59c-415f-a9c3-7aa2a7c1d8ca", "comment": "Malware payload", "value": "6194b0417544edcdd770b1bc7fb8b62b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089128, "uuid": "15f2ed76-dcc2-44e4-8051-e9321c3a1f17", "comment": "Malware payload", "value": "ca3a55dd946cad30a880e70454231f3e876be72c33d01a01284151f73ce1774f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089128, "uuid": "01ade06c-34a0-440c-bce8-efaaa6d85d88", "comment": "Malware payload", "value": "08aae9ccd2238ad0c5b96683a88c9d1c86e8d401", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089128, "uuid": "e14593ee-0282-44bb-b9e6-84c9dce2b585", "comment": "Malware payload", "value": "f5cdaa78a51e3c29d18c5fd267b232f03d9deec8e1fac5c693b4f017df32ead58d109dcf9176e1206738cac5f099276b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089128, "uuid": "3b1924c2-c505-49a3-900b-d21bb3099ffa", "value": "T1AF452357A7C84133DC752B7598B306930E3A7C941D39C7A61B82F96E1C72AE85A3133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089128, "uuid": "46d54b7f-e68e-4e9d-902e-5257f0b38576", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089128, "uuid": "73497df6-82ba-4a74-b08c-8453bc88679e", "value": "24576:/yDwP+vzZ5hix05K0KnX44EaKqsvjuV03NuzuO6gFMz3:KDwP+vz/hi6K1cQGJ9uzulL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089128, "uuid": "58810b24-6325-4605-9db4-461a9c449779", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089128, "uuid": "84b15caa-1ee7-4000-863b-871802186bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089128, "uuid": "b49a678c-7565-4c31-a7b3-b0ecc5b5276e", "value": "ca3a55dd946cad30a880e70454231f3e876be72c33d01a01284151f73ce1774f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3059bb0-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089129, "uuid": "e2632963-7b82-482b-bc1a-2f2b8e5a0b55", "comment": "Malware payload", "value": "b0b34af5c43a4393c8bc7dc1e841cb8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089129, "uuid": "44ac1e9f-cb5d-4053-8324-2d12e95d8281", "comment": "Malware payload", "value": "ca5ca10b7c8b870385b05d3460df7ab13b8b7960b3bbd1b7254d3d59a8c66f02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089129, "uuid": "5060ddb9-0f17-4102-9583-f0a2023f3f26", "comment": "Malware payload", "value": "3a7362df1a29bf212af375d9c01cb2361de3fe76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089129, "uuid": "82f94098-f256-47b9-b453-a481ccad2282", "comment": "Malware payload", "value": "a49038ea7273643449ccfc94cec485a8b9e515b08851d8853b55033f645cb5ef0da7f8012adb9b90678c801d8828cb50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089129, "uuid": "18c87447-8d1f-49ba-ad75-d2fa890c8465", "value": "T16E452343BAD88567FE77137068FF0A470E34BCA16934C66B2758E9974DB21E52836332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089129, "uuid": "cd710299-f128-4217-9f16-ef423d130b22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089129, "uuid": "1568f731-760d-4d60-afb1-063f5f51916a", "value": "24576:zy7ouuymfK5h7UetI4YjpBXepSEbPKvhHjCSfILHU26Q0GPDa6W:GUuuBfKn7hrYjpZefbsDJf202wGba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089129, "uuid": "3b40504f-001d-4d59-a4ba-4df065e56188", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089129, "uuid": "68055c27-a814-48f4-ab46-ccb2766a0e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089129, "uuid": "8fcfa50c-4e63-469a-a1fe-ada6893442ba", "value": "ca5ca10b7c8b870385b05d3460df7ab13b8b7960b3bbd1b7254d3d59a8c66f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b68e01-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089130, "uuid": "7fba5e52-18f3-49bb-9554-60e0cf3d38c3", "comment": "Malware payload", "value": "db571888628881afc4bfeb498f73c162", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089130, "uuid": "654ac402-367b-4edf-8a1d-48dd31f3c0f3", "comment": "Malware payload", "value": "ca96cb7a3759726c8b0b4251f82d3bb469c2ad052e314ab62e4788e00a256353", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089130, "uuid": "039d4508-093f-41a7-89e1-961cd3929058", "comment": "Malware payload", "value": "ac636357e8f79cea891e90b715ed1b8c3112dca7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089130, "uuid": "a99d105b-eefb-4e45-a5a6-a03d526cf847", "comment": "Malware payload", "value": "ba33b6f486f4f81aaa07d679db6ff5963e4218f0192e592eb81a62c735ead0dcb7a24ae88a627a4db12932a19e2eabf2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089130, "uuid": "4a2259b4-240d-4d7c-ba36-2864ea192f53", "value": "T170452312B7D88837E8F627740EFE12930E353C869D6047AF33B699491D7288059B677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089130, "uuid": "eeb09e3b-6039-4db0-bcfd-223daf50f27c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089130, "uuid": "2696d800-8ab4-4485-b58e-fc327cd38003", "value": "24576:tyhr1vRdcMPbcmSu5QprZp8cN0Z6Pd2Tt4To8X:IN1Zbg//pnI6P48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089130, "uuid": "67c1a9a6-b44c-4a10-8663-3f46bbdb3e5c", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089130, "uuid": "a3697dce-082f-48a4-bedf-1aa33a0cfaf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089130, "uuid": "79be568c-230e-4ecc-9f46-b0687cbfdc43", "value": "ca96cb7a3759726c8b0b4251f82d3bb469c2ad052e314ab62e4788e00a256353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d510257b-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066879, "uuid": "89e66f4b-ac5b-4676-8dd6-00329fbf2f29", "comment": "Malware payload (Mirai)", "value": "a62a8c55b16b68a39f0b913063944685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066879, "uuid": "d2a44fea-acc0-4081-b203-1230f9bf7d1a", "comment": "Malware payload (Mirai)", "value": "caf6b33307b4025a585b33de58e9f04bc4a0d3a0686adbe3b8981837b9ff3580", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066879, "uuid": "d2f4ab6e-06cd-4316-8386-74cf25d7a13a", "comment": "Malware payload (Mirai)", "value": "71f60545fa5f99a81f89e0c242fd9e075846eb8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066879, "uuid": "9c39d140-5e2d-48be-9e06-13b11f645c25", "comment": "Malware payload (Mirai)", "value": "47cb24cf1994a662e1cee331dacf00c5639761d72bc4408d6474f08ffb82c1aa9041b6443c1e408e29979958a37111aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066879, "uuid": "ee7d4fea-77b6-428c-8307-89262c9f26be", "value": "T100330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066879, "uuid": "49e1305d-a55a-4c8b-ba74-38c737394734", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGf:r/hqaJMDg9eqK806MHdkfQX6HuCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066879, "uuid": "1b1acd81-96e9-4d20-9677-e0505b559b15", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066879, "uuid": "0f10fe0e-6dd9-4592-a08a-ee906448cade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066879, "uuid": "8c36cfd1-1ba4-460e-9869-e6552ce1b667", "value": "a62a8c55b16b68a39f0b913063944685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45ed72d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089132, "uuid": "83a2c15b-f492-4cba-b4cb-8d36abf3bbb2", "comment": "Malware payload", "value": "7f44c46e008e66a5f59ce2f4c59d949d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089132, "uuid": "d51244a0-910d-41ff-8cfe-7efd23d0dec9", "comment": "Malware payload", "value": "cb09ed1b73be067529c3dea5c21c7aa9991de1a8216bbec65b44f8cdd4d46ef0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089132, "uuid": "802f133f-1c60-412c-aad6-6b4d85dc4b32", "comment": "Malware payload", "value": "c405739561aee05ae352c15cb253bb65845cae27", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089132, "uuid": "3e1efb0e-6545-45c3-b022-f772b45892ab", "comment": "Malware payload", "value": "af6fc9e0c23d8681cc86fffecbc9680b6b62d7d0e97a4195e2f96bbc0d6f9cb79f860edb6edba035167ab4053d4ea37a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089132, "uuid": "8be8a382-5a62-4284-8dbb-f60db65795a3", "value": "T10A452341BAE8A436ECF12B70A8F743830F367E816974AB57364B2D4719B27D0953136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089132, "uuid": "b84e1f99-c82b-4d44-80f3-e036140a7fb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089132, "uuid": "bd45bb55-3ef9-4829-9ce6-f5e48cda271f", "value": "24576:Yy3jGv6uP++y7OXvy3MxcS7W3pih5jy8q/jRWOU0Fqc7aPPd:f3yCuPNy72ygW3pih5m8qrq08c7aP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089132, "uuid": "21322746-60c2-4ce2-9d6b-a6045a985c01", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089132, "uuid": "8b389831-7caf-40f9-8493-d080a9741c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089132, "uuid": "7babd800-9fde-455c-a03e-92a340f6a47b", "value": "cb09ed1b73be067529c3dea5c21c7aa9991de1a8216bbec65b44f8cdd4d46ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52190fc-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089133, "uuid": "7bbb1f2e-424b-4db1-b42f-38130a1e5991", "comment": "Malware payload", "value": "c4408420723f3dcd801a274b351f1ca8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089133, "uuid": "405b26c6-0550-483a-8ec7-ce1143543cb2", "comment": "Malware payload", "value": "cb0cd7a5d8d4cbeb6c31eba2431fdb1cb63b8f2b88f83fde274426d97550925f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089133, "uuid": "2cc4734c-7350-423b-b064-57abb633246c", "comment": "Malware payload", "value": "026c44c550f9b46b55d1a90ae95ecd97c18efe88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089133, "uuid": "ceb3f08a-d272-4fd1-9265-40916f4ae2c8", "comment": "Malware payload", "value": "f2dab9843210f467eb111429db0b6f8994790bc5a31cf675692b8f48fdb373aaa30a24384a5a561d35d3e8add8ffd64c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089133, "uuid": "7730aac9-3d5b-4a2e-ad3c-11d0c4443379", "value": "T1CC452303D6E55163EAB217702CF613D31F35FDA19E3983A70385A91A4C72A88B67532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089133, "uuid": "c138f4a5-369e-4da4-a734-ed1c7f967212", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089133, "uuid": "44f34db2-1180-4aec-9efa-a1cb82924f6b", "value": "24576:Xy5QDEbz5wRGcDfLyY7H3OZBa4ol2sL5TfAjLMs:i5QSVwRGcDfZTqIQsL2PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089133, "uuid": "ed637836-004d-4231-99d3-d3facd43216d", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089133, "uuid": "5b549206-bb5b-4fda-95c1-a7d7f65cf7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089133, "uuid": "73c29a7e-7680-4a5d-a164-b371b29fe2d3", "value": "cb0cd7a5d8d4cbeb6c31eba2431fdb1cb63b8f2b88f83fde274426d97550925f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a672ddea-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089135, "uuid": "f05e0970-122f-4663-b253-4a9383edabb7", "comment": "Malware payload", "value": "4de5168eea24a3fb12f4c226b477f113", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089135, "uuid": "1b24c62e-a9cf-4dba-b8b5-d6001c7633b6", "comment": "Malware payload", "value": "cb443e8a6ccb80a2163829599a4ec76cb702292475d0b5c41a4b49ed0b8a9c71", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089135, "uuid": "cdc23a38-bc7a-427a-a65a-879494c14ca0", "comment": "Malware payload", "value": "0dfb27b73f4fa279c23adfce9b55494c577949fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089135, "uuid": "7b4a62fe-4dc5-4ea5-a226-bb51897f934e", "comment": "Malware payload", "value": "54338d5dcb0b7d584817320f1344fbc4a1e4d0989a6e8c5146f6d3ea0118b361d1a0ed886d8a6a70ace4cb7b511a2f99", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089135, "uuid": "b1f82181-52ea-45b5-bf6e-0ddf327fa808", "value": "T173151202FAD4A0B2D8E607B57CFB07D30A3AFD52DC78621A27C56D4D09729909A7076F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089135, "uuid": "61d35a7c-7785-43ed-bfd0-c7f905b288e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089135, "uuid": "d59b842b-cb89-46be-92cb-ada5c31a8db1", "value": "12288:sMrWy90jBuzSWSPVcfhbwcI9RGu0RyECC0EE4ez+4+YBdEqOFDP9/XxXqXH6E9na:6ySzyoRURpEE8Z+yiLE6EMsOQ81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089135, "uuid": "703cc8a5-4afa-4a16-b823-e37b5a4ded85", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089135, "uuid": "0414cc9d-4e58-4be4-841c-842d842173b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089135, "uuid": "86ce1ef8-9907-4633-9c4d-b31d4509af58", "value": "cb443e8a6ccb80a2163829599a4ec76cb702292475d0b5c41a4b49ed0b8a9c71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72ec044-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089136, "uuid": "fe85134f-9951-4f83-b91d-d59e4c1484ac", "comment": "Malware payload", "value": "d0e3ea7fd830c482bef7ec42f883dc3e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089136, "uuid": "9819a505-2520-439d-9333-12303e2c2fe6", "comment": "Malware payload", "value": "cb44d697cd120c0f9098e0b9b7faf2f5f67d5f426dfb225db47ee62684e45443", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089136, "uuid": "2f74c6d3-5ea9-49f7-93a0-f29a39c33167", "comment": "Malware payload", "value": "dbe1ab966eb0cada1e2cb50b5286cd84f55ff8ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089136, "uuid": "121f953d-6ad4-4712-ab23-151903eb9cbb", "comment": "Malware payload", "value": "c4c1ded982b460da5fa199679c198e3f15aa7a846d3beb888acafef853283203713b35093b89b5cf59898642fe50a9d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089136, "uuid": "b4c2ad6a-ab3c-44e0-a760-29a2b8f519bf", "value": "T18145234677D40133D9F72FB074F903830E367DA2A9A857EB97955C4B0DB2980A4B4B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089136, "uuid": "82481aad-da37-4130-98db-6f738db15c7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089136, "uuid": "d88dc55a-2d19-47cc-9fd2-b82ddb946863", "value": "24576:CyLcdMxVbMrHH/vExWU1rKQuluWj4u6nK9XfQcTJMQi7mJJ/rYdLp8s:pgdHHfsxjuCNuNXbJMVmzs98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089136, "uuid": "9b445b8f-f374-4aa0-90a5-1b54b413cadb", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089136, "uuid": "758dc7c2-c9e9-4c2d-8982-d44ddbe93443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089136, "uuid": "f8f4ee3f-92f6-4c79-af74-8b4f94147d25", "value": "cb44d697cd120c0f9098e0b9b7faf2f5f67d5f426dfb225db47ee62684e45443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ee58f0-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089138, "uuid": "3a7d8fb6-b4fc-49d0-a6a0-61dd060c2e45", "comment": "Malware payload", "value": "9dce7c3f2411d158708f1bd36ab9136e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089138, "uuid": "79712a00-25d2-411a-9e16-09abbb178edb", "comment": "Malware payload", "value": "cb6b5a53531ab81d8c1c0834d007d76d1906ca1ee1ac4cc5b636b28b6952ec6b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089138, "uuid": "5d18ce5c-e1d4-45f2-aaf4-ab8eafdad641", "comment": "Malware payload", "value": "b0e081d2646254fd6183e78915c343ef2ed120d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089138, "uuid": "a45219f1-049c-42f5-b78d-7e233419658e", "comment": "Malware payload", "value": "a45417a5b236f6e3afb37cf6d708803cb7a595c844cc6b4b7d2bf0842f031cf72e4a4a858d0ed307336fccdb38e7a684", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089138, "uuid": "fb6d9593-27eb-4003-97d6-abbfc7147412", "value": "T17E452317A6F55432E4F66FB004FA03431B363FA52C78826F1B499D4A14676E0B1B27BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089138, "uuid": "b749338e-28af-4b9a-a7bf-0b36ca2cf35c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089138, "uuid": "83e1b668-49a4-448f-819c-d0e4af231ef0", "value": "24576:uylC0R/xyeYoTL3fZqXtBlAqly4AIcSBPZBzzTJYuTdeHFz:9AUyeYoTrRqXtBzy9m/TJ7T8HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089138, "uuid": "d0698289-eb84-466a-b2ef-da718efa8138", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089138, "uuid": "4eb1eab5-f0d2-48a4-9f63-dfd9f8a9227f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089138, "uuid": "64fd88be-1bd9-47a3-b026-c45d14f0fdda", "value": "cb6b5a53531ab81d8c1c0834d007d76d1906ca1ee1ac4cc5b636b28b6952ec6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95e8121-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089140, "uuid": "10f9f6d4-d01e-4c55-90a5-5825e8596542", "comment": "Malware payload", "value": "4d0ae72c8112a294c99e825ed3c89921", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089140, "uuid": "d0c26884-a7c3-479d-b56b-a43da2ab2584", "comment": "Malware payload", "value": "cbc4173415fa4b9237e7093eec90fff52c181abdc5f38d8f9f410a34d1e46d3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089140, "uuid": "40e333e9-72fa-4020-b5e9-95dcda7ac144", "comment": "Malware payload", "value": "604a672736c240dd2b647af443a1b6569c34de41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089140, "uuid": "66323bed-bd3f-4bb1-8ad9-df0bc3da9461", "comment": "Malware payload", "value": "d4dbb3f39a06468b9a4921278a28478afb8feb4c8ca99bd8436d6d5933924c831c3779301f312dd94ba89afe3b3bc74a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089140, "uuid": "7bb86ca9-6d63-4d43-a0cd-d447ddd44ce2", "value": "T16445231669D19573DDFE277058FA46830E2AFDB019BD01072F81E84A1CB3284AD767BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089140, "uuid": "41ff7a46-0964-49c0-a6cb-6db5d7424a07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089140, "uuid": "d3a61b11-7a8e-413c-a9a4-45dd62d6122b", "value": "24576:SyI/MQjWucuYghKLGqCllScWXTWa1oE7BqAMBRx4olW:5I/ODLNHj1oE7BqA6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089140, "uuid": "400a37ee-497e-4242-aa16-858e2e72d5d4", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089140, "uuid": "95bb4d1a-7201-4cb3-b1b7-067a251c865c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089140, "uuid": "f7d94272-13f1-476c-9015-66709dc7cd64", "value": "cbc4173415fa4b9237e7093eec90fff52c181abdc5f38d8f9f410a34d1e46d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa02ebab-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089141, "uuid": "aa104447-acb6-4eb4-bfb0-23f4e89bd01e", "comment": "Malware payload", "value": "bb29bcfe3b988dec977d8644a7bc4ebb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089141, "uuid": "52c1e1c3-8129-4e86-be1e-384be7ea5fbe", "comment": "Malware payload", "value": "cbdb0c58cc4dbb1806422242dd391246712357fd3f55cadde076372d1b144064", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089141, "uuid": "77e2e8e6-0e8c-4531-bb3e-adbf5eebcc0d", "comment": "Malware payload", "value": "470ff5e3f36cf5b4f1608e074f029ddc92a189c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089141, "uuid": "9920b177-b187-4103-992e-36f86d5326e5", "comment": "Malware payload", "value": "d4651dd0c66261c9af30dc0c8c47c3db5b4e42b17baabdeedd1166924bdabcc22b588c075ac03503d9d2199e5374b167", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089141, "uuid": "694a289e-131b-4f52-8547-5fb669aed255", "value": "T1E2452352BAE44131D4B627B1A4FA23430737FDA2A875839B2752B91B0DB26D4273137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089141, "uuid": "6ae76775-d5de-4447-ac28-8d8768157de6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089141, "uuid": "4d1d8e67-87ec-4e64-a7ac-f0aaffe580c5", "value": "24576:Ny0M6SG2YhvLzTp96h4l6uVILjUfp8d26BKoQfkFSRg2UO:oeSAhv3Tp9dGUh96BCfkQO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089141, "uuid": "993c95f9-7113-4776-a749-2f277b36dea9", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089141, "uuid": "d82aee51-0c22-4bd7-80ac-f808640b4af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089141, "uuid": "225614d2-9d24-43f8-81c1-4da0cdda9db3", "value": "cbdb0c58cc4dbb1806422242dd391246712357fd3f55cadde076372d1b144064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311c7ed8-f21b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684043412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684043412, "uuid": "df26ebef-bb45-4bb4-8df4-6e85a35691a8", "comment": "Malware payload (RedLineStealer)", "value": "3e03cc595f3d5215279f898d711d6ab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684043412, "uuid": "700b6334-3157-433a-81ff-a5cbf9461c06", "comment": "Malware payload (RedLineStealer)", "value": "cbe41193bc11dca56d056b7eb34b0691768e42f53d78750d6efeb9d28143ba5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684043412, "uuid": "4a84df11-b106-4f93-9c2d-ea7e75bebc6f", "comment": "Malware payload (RedLineStealer)", "value": "370ec79b6f48b1935170d02ad6b48a63a5bc639a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684043412, "uuid": "6de3471b-97fc-4487-986f-c9181a3a4c71", "comment": "Malware payload (RedLineStealer)", "value": "ad8bdf09722d04049ec02f7aa97ffa4f7df498ac17bd629f95dd169156baac0450dee918a3660fac222b4844380ff983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684043412, "uuid": "70bb6149-4c80-4c90-a3a2-4f323d0c9e28", "value": "T1BB452342ABD84073DEF567B0A8F612C30B3AFD64497C534B668998461CB2BD0C67277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684043412, "uuid": "8359b549-bfd8-472d-8477-bf55258317a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684043412, "uuid": "67d2f5ef-9cf6-4116-977c-3cdeabe6dd49", "value": "24576:jy8pFXEU98NihHrWHO/SrJbL/0jD1KLnGAOnaWNllXWivkm5:28pZEUYitr8ZrJgD1KDOLN7WKkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684043412, "uuid": "cdc88ad6-accf-408b-ac2b-bfea47cf464d", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684043412, "uuid": "761d80fb-e08f-47ab-8151-8ea70bf3ea04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684043412, "uuid": "976753e2-daa9-4c3d-8443-dcbfd32e8349", "value": "3e03cc595f3d5215279f898d711d6ab3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab26d8f4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089143, "uuid": "62b8c35f-684d-4e7d-8aa8-5af351748301", "comment": "Malware payload", "value": "5d787e465652cd0c1f4a7831d0df0238", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089143, "uuid": "72624cbb-bcff-433f-bd10-e53b25ce7c24", "comment": "Malware payload", "value": "cc3f10ffdec470a6196174247760da9996e04cf72e59fafe019be14a4f92c99f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089143, "uuid": "2f8c898c-2c21-410e-a0ed-6b18749e30b7", "comment": "Malware payload", "value": "77646c85d2e5f1e3382990d1fe9f648fb4750112", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089143, "uuid": "35fc35f5-ab6d-45b8-91aa-3ffa427dddae", "comment": "Malware payload", "value": "f14b7b5b8411911a7bd918ac7f4d28042e673a703aee2d9697683b2f5acd6d9692f6067f8abfc913a2a717144e092144", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089143, "uuid": "d8516d05-3432-4d14-8a9e-6a604e8ed744", "value": "T1DD452321D3FC5132D8F447B598FA86530F32BCE19D7853E96B899A991E23BC0A532317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089143, "uuid": "1f7d2208-dfc3-4e4f-ae40-94fa6cd5740c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089143, "uuid": "577ae141-fa50-437b-82a5-b79d8cfdc26a", "value": "24576:lyYVNtWp8kJKpxpzGnwPkqYOA/EVBZjq4OERJ7mVfmVoYNzR73LTI:AkNtWLKHpzzsUNxq4pL7mVapR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089143, "uuid": "6bc6aeea-72a1-4cd1-a79f-f10cfddabe62", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089143, "uuid": "4053f02c-3b87-43fa-a2f2-56f1e544e983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089143, "uuid": "de9b42c5-92d5-41b4-a62f-5d463bcf4d52", "value": "cc3f10ffdec470a6196174247760da9996e04cf72e59fafe019be14a4f92c99f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb4f7e1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089144, "uuid": "8c9fbce0-6486-44bd-bd5a-28651d703a33", "comment": "Malware payload", "value": "0d32eed02872655fb2809ee06e422f59", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089144, "uuid": "0b03ddc7-df1f-4554-a391-830144baa909", "comment": "Malware payload", "value": "cc50e5255115ac8357404098d8da8fa0c35ff816b0ccacff9779f8e1ccf2f77a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089144, "uuid": "51a19553-7489-432f-b403-3fd9c446e23a", "comment": "Malware payload", "value": "7435f2e9fd6544438b1bde70f342a9c9dc46294b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089144, "uuid": "cf5a258b-f082-4605-9149-02c217be9d56", "comment": "Malware payload", "value": "ae45d0497931b8ff0b3a4e880e0c1427a9a2c553513b1361bf8c494b2c836aea62addcccce5b0a4b622f5b2822f0cf70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089144, "uuid": "d3ec9ae3-eb05-4ac6-a775-59880dc5a6c2", "value": "T17DF4139AEAE89436D8B22B702CF607530E36BCA15E74836B3755DD5E0CB22D0B171727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089144, "uuid": "99ca1bba-9066-4159-aa21-135667d606b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089144, "uuid": "26cb670e-487c-4717-9b4c-7e7218440d06", "value": "24576:Vyxj5Axy1WjhPM9mpFnnat7q0/Frt9PsoGX6gua:wV5yKW9k9wnny7tt9uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089144, "uuid": "bed8d1d9-2557-4f92-bb58-cf9556ca2b76", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089144, "uuid": "facb1091-a0cf-425a-99cb-0fddc00c2709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089144, "uuid": "3a043ddd-f790-4f28-abcb-6a3f175d3cd9", "value": "cc50e5255115ac8357404098d8da8fa0c35ff816b0ccacff9779f8e1ccf2f77a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5f917e-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089145, "uuid": "82c0e61e-2c78-42eb-b600-65e1f4991e5b", "comment": "Malware payload", "value": "2fb3bcfed855715ed9a7571e732c11a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089145, "uuid": "9ddc7e29-66c0-44c2-9efd-16f263705eab", "comment": "Malware payload", "value": "cc518ef8ab82d3cba40b797a5f6eacf36e7adae85589bb19de6a7e4687c2c119", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089145, "uuid": "55cd32a8-205d-45cf-8c1e-4ac867879d88", "comment": "Malware payload", "value": "caa57caeb76ff542f81415b171efc0ec00cccc28", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089145, "uuid": "dcdd3da4-4a2c-43e1-be87-415b7eb0ff70", "comment": "Malware payload", "value": "e9ad931e0285e2a7d4c20efa4536de2ec879d3f9540b13a42f2675623693a1d59ec8674ceda24afefb2ddecaaea6bb17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089145, "uuid": "e223d5ec-145e-4beb-aeea-a32311bcf1a2", "value": "T16B452317A5D08062D8B80BB4BCF61B430E7AFD926A78C7A7170098961CB35C9F4B9777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089145, "uuid": "43b5d5df-6b7d-4d99-b62e-a6b1ada999b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089145, "uuid": "ffd355c7-4e57-477c-9ea6-062b06555732", "value": "24576:gyNfiyyVgeZlObc9uf4xWc8j+SSbCYKs5IbMzMTxJCUzFqK:ncrVROoF0ce+HCYKs5WEU/P0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089145, "uuid": "bb139dd4-1cb3-40d3-9925-fd2728b62e15", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089145, "uuid": "0e5e5887-c107-4d38-8d89-4a47ee83d1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089145, "uuid": "2af2541d-6861-4147-9b22-591616211f4e", "value": "cc518ef8ab82d3cba40b797a5f6eacf36e7adae85589bb19de6a7e4687c2c119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf11975-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089146, "uuid": "8aca0623-2b5b-450c-b91c-ce923d3c6ca7", "comment": "Malware payload", "value": "008f64e82a5c82552fec848ae4605145", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089146, "uuid": "e5c6176f-0dbc-4d5c-906e-00b76475bf72", "comment": "Malware payload", "value": "cc6dbd7904b27ef40693f299447856756987d11f1c227d93663746685c2bbcc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089146, "uuid": "d3e6947b-1792-4f56-b876-12a6eb24a122", "comment": "Malware payload", "value": "ae42da397e41ffffab6745309112f9ece29c3663", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089146, "uuid": "010d5107-4b29-4f35-911e-f6cce1bb7378", "comment": "Malware payload", "value": "1b123379bc3977826281be8ff8377ea89e617881d1e9a09d635e8ce3c35a25721f105ceaea190470b538c245961a959f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089146, "uuid": "6cbfb6f1-7a5b-4dcc-b41f-9d2a36395dcf", "value": "T1D6F41202F7EA5472D8AA0BB029F303E30B39BDA61B74535B27854D5B58736409936B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089146, "uuid": "b8fb5138-c076-406d-a14b-43f32a949173", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089146, "uuid": "40e92286-2d56-412d-b2b9-096efb287b3f", "value": "12288:zMrly90vGXJqc08ErW38LFwKvOWaash9HjMgv0k/J+019ThHNO8yH:uyNJqH8I+WaashdT/VV0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089146, "uuid": "f2b52e28-a29f-412d-892f-422243da5419", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089146, "uuid": "43188556-b782-4180-a63e-70ff97f667d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089146, "uuid": "bfe6e742-a58b-4225-9cae-3502d57df33f", "value": "cc6dbd7904b27ef40693f299447856756987d11f1c227d93663746685c2bbcc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad964977-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089147, "uuid": "e1a2f7cc-9684-423d-b842-f4202e151e72", "comment": "Malware payload (RedLineStealer)", "value": "f9ff1aae15f3123900885f5d52a96c22", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089147, "uuid": "ff15a3c1-c219-4254-9b52-64b8f083ee5a", "comment": "Malware payload (RedLineStealer)", "value": "cc86e886150afd232053fb85af5ef142a8422889e8d70d6d9c1f5b3985b1a47c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089147, "uuid": "ff50bea5-195f-46a9-96b5-bfab88ac9c58", "comment": "Malware payload (RedLineStealer)", "value": "c7243a98f7ada4aca1e4a656c9c637defa403c75", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089147, "uuid": "ead8af56-8d68-4a8a-9cc7-927b41433bb8", "comment": "Malware payload (RedLineStealer)", "value": "07e80f5d3506dc810bccf407208e96eaa4da36214ffc0f5605719dd53adcaa32872efa4a836df17a862b178ec786467a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089147, "uuid": "d6579ca4-d6d8-43e3-98b8-5b4107dd2577", "value": "T19545231367E58032C5F80B7034F202834D397EB29998831FB7D5A85F59B2695E6B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089147, "uuid": "81f8dc53-587c-4fc8-94e7-5b625f2119e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089147, "uuid": "62cb82e4-f203-4e06-b932-dc82fdf5c1b4", "value": "24576:fywcahuk0o2NmgRDcg53JWczwzdC0Oa9af29sbu:qwik0fNmgRcgqcUzFz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089147, "uuid": "5f70c1d2-282f-4b55-b33f-1e501e7859d8", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089147, "uuid": "3990052d-f818-4fa8-8bde-1371e5bcced8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089147, "uuid": "00d7bc80-4d4f-4167-b658-8488f3a5c1f0", "value": "cc86e886150afd232053fb85af5ef142a8422889e8d70d6d9c1f5b3985b1a47c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2c9a78-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089148, "uuid": "7b419464-9b99-4c42-b92f-ffe739bfb28e", "comment": "Malware payload", "value": "d52aa14f74d1e124a5517093f4d4bbd2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089148, "uuid": "07ead2ec-5964-44bd-9c71-8ae055ab2e92", "comment": "Malware payload", "value": "cc872766a374f59ab1426909dac2c5389aca234a7722647a80bf35cdddf10052", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089148, "uuid": "1666d03e-3224-4407-a36f-22c6dbac0108", "comment": "Malware payload", "value": "255dbc489b029f045fec5a484740f4800ac03270", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089148, "uuid": "79ffe3e0-50a6-419c-9965-896d96a851f6", "comment": "Malware payload", "value": "bc2dcdf77e980be34db350cddbbaee317585059ba6025e8c1391d3e8d0bd3af1c04c2ddd266e37ce64e97482528ed9ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089148, "uuid": "c84c13a2-98a0-4bd5-bc07-c8c03d93a34b", "value": "T182152302ABE58072DDB017B05AFA0AC30D3A7CA19DBCA71726966C1F4DB35D4E476327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089148, "uuid": "6319c213-0251-46c0-ae4e-0af83d4db15f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089148, "uuid": "a7b7410c-cfdb-4226-894e-a7c32e93aede", "value": "24576:ZylsQuSbTcX3Ux2TKTLwc839rmoltwwLID4JR:MSabsUxigLOwwcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089148, "uuid": "02bf60ba-c142-42ff-8366-c63c4dad9b63", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089148, "uuid": "f4afe02b-77cb-44a6-90f5-1e693911f2bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089148, "uuid": "0959d461-77b5-4265-a271-fc4f239aa52d", "value": "cc872766a374f59ab1426909dac2c5389aca234a7722647a80bf35cdddf10052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed1f24d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089149, "uuid": "ae8998f8-55a5-4763-a115-df4daeb77b07", "comment": "Malware payload", "value": "66892a4c05cefd123136829667276534", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089149, "uuid": "72680c40-88f5-4cf8-8953-780f280ee4e0", "comment": "Malware payload", "value": "ccb7d56726bf4f0ca6e15a21e49f35795cc56c101f4fb73e81f92e5d359c383f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089149, "uuid": "5ca155ab-624b-46cf-a5ea-dfbf3f4efd84", "comment": "Malware payload", "value": "a21a1d3b5b0a30debfdf9b2f4a242ad3718ebcda", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089149, "uuid": "10c7d9e5-d2af-47cd-b8fa-52ee87cc0dab", "comment": "Malware payload", "value": "9b3ed017a129092b25e8c43b44bac3bcca714b8fcb8012b563ca61f7b71a17c764fdb6ce199fe9b98473386e121e3aea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089149, "uuid": "4d0bd011-e821-481a-a8bf-c8079308aaf7", "value": "T19B452346E2E88433F9715BB1A1F70A130779FEB25DB8171B6B49652A08737D0A23532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089149, "uuid": "d711dcf9-0b04-4dfa-92b4-6ed6eed346c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089149, "uuid": "c72deeeb-dd47-4454-ab78-a49b947a2cf7", "value": "24576:jyOW92l2fUI8If3HKQemtAngMcTUH03fZ+hGln0Ne7s2rUXpr+PzeO:2OBl2Ukf3HBtAngWmllWVmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089149, "uuid": "72eb4c34-6de1-40d8-996c-7ad301f34870", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089149, "uuid": "9d10f88d-3e41-493f-b5c9-2758ce947a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089149, "uuid": "b3c32ea4-bba9-440b-93ce-0025967bb900", "value": "ccb7d56726bf4f0ca6e15a21e49f35795cc56c101f4fb73e81f92e5d359c383f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8045c8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089150, "uuid": "513311ec-ca90-4e10-9ff6-50850e2f27ed", "comment": "Malware payload", "value": "32fe44fc0a6d3c7577ff18c2fb40508e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089150, "uuid": "6c07dd9b-0375-42da-9738-7e9ac29da927", "comment": "Malware payload", "value": "ccc04c5a527ac230f83d6080d2b00cff035892bb1c50a9a495c8dd484365a8c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089150, "uuid": "6d0aed2a-dc91-4983-8071-813f6e589d15", "comment": "Malware payload", "value": "67aa82dc154ae99b0b5124f43fcd4e7aa1bd671e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089150, "uuid": "0d46cd35-97e1-45e7-9128-773c5e7ac37c", "comment": "Malware payload", "value": "414dad1de3908bf5e622c16f75b38185079f0b888b0f3d9887bd045adf519c3e16e8b7fb02efc8d137f0eb9fd234271f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089150, "uuid": "1ac81dfd-8e18-4e61-9ece-17aeda99dd22", "value": "T1CE45238266D09172D4FB27B1ADF242931836FDA17838871A27995EAD0C771C9F4B072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089150, "uuid": "4f303667-652a-4317-9d95-ca7280fe8608", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089150, "uuid": "31b1be43-6eac-45c9-96db-51253e0dc91f", "value": "24576:ay2uztqinq/Q99lIvducJs1ST3jnZWPVWtyGr5lqQdbvTCgVf:h24qinqI99ODs1ST3jnMPVWUMHqQdbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089150, "uuid": "95c52273-0b94-4b99-9e44-453facaae2a9", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089150, "uuid": "efd526cb-afee-46f6-9c4d-d893c5d62d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089150, "uuid": "edbfc038-d807-4407-bb69-216973418f47", "value": "ccc04c5a527ac230f83d6080d2b00cff035892bb1c50a9a495c8dd484365a8c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04c69f5-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089152, "uuid": "db646dc1-7e3b-46ab-ac03-08a20613dad6", "comment": "Malware payload", "value": "99f96d08afb9909acf14c2f24fec62d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089152, "uuid": "ed092ccb-bbcb-4396-b57d-b494a025ec2d", "comment": "Malware payload", "value": "ccd19acf6e5eb17ff02238733f514b8f5fdf70e6fd124b2fdd87f18ceea4a0b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089152, "uuid": "ba4c77e5-db35-4e34-8034-bbd2959038b9", "comment": "Malware payload", "value": "8c24182f55c52fbd20a104b57625e01916ee44d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089152, "uuid": "dca34286-0ac8-4fa1-a10a-652ca1a1f742", "comment": "Malware payload", "value": "b72a9ee278f6708c307dea6500e758c44baf8638859ebfc4e5d8e202e2ad6bed7f58e96962cb96a2168da466d335423d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089152, "uuid": "a523706d-a323-454c-b2ca-5c59f024ec93", "value": "T111452355FAE84896D8F427B02CF712531B317CB55EA4E64B1785B80A5D33A48FA3233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089152, "uuid": "fcc54fab-7962-4c59-af81-f003f51767cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089152, "uuid": "ff1ae6ed-4285-4fc1-aaff-618f95c1c15b", "value": "24576:ayrJCNvORcE/yacefXVsk/H816F7SB8If:hFMOCE/JXO28N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089152, "uuid": "b4a0d4cc-ae4f-47a6-be6b-ccf2ab343552", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089152, "uuid": "6ca8c47d-b249-43e0-908b-34a5dc23ab8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089152, "uuid": "27538fbf-7b5c-4245-85b0-de2f0d522b5e", "value": "ccd19acf6e5eb17ff02238733f514b8f5fdf70e6fd124b2fdd87f18ceea4a0b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9e053b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089686, "uuid": "9480e78b-89d2-42c2-ba54-b3bf56ec461d", "comment": "Malware payload", "value": "4bbb53f8ebcd0b363f354e13ffaa8c87", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089686, "uuid": "f91de49a-78ec-455f-99e1-8bd1b49e49a5", "comment": "Malware payload", "value": "cd116512fe123d26b2984e89fb538e023d8f52b35583f977e623a54a513fd183", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089686, "uuid": "37b6c60b-0d27-45ec-bf76-855d07315d79", "comment": "Malware payload", "value": "f60e8275684f5d3cdfe6bc1cedfc337da56e0c0c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089686, "uuid": "6eb94343-2d36-437b-9058-1cdf4486a051", "comment": "Malware payload", "value": "5fd64c55d34f8f90088a3af5ebf78dcb99f72cfeea0f52edfeb875bfbec7f98e2a7b699ceb46da8fd51b65b2b4caf50c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089686, "uuid": "5c4622bf-3093-4cf8-9ea5-aa3ff35da4a0", "value": "T1A553F11B27644623F93FDF3877B26161B9293800AF76EE3C8530914C8AE7544DF646E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089686, "uuid": "18f714b3-1590-42b6-9ab7-8d756ddc335e", "value": "1536:paY6K5GLx39YO6sno1+NiT95bIzo9tO5XpHIdlpZRb/u:paYkN9JnoeiTx9UXpoz39u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089686, "uuid": "c554ee29-d6a9-48fb-90b0-507cbd860c4c", "value": 66120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089686, "uuid": "4abbcb5d-4188-4c23-931f-1318ffc496a8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089686, "uuid": "6248ab5a-5a95-44c1-aedb-d1b8ab79b128", "value": "SnakeKaka.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10bcfab-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089153, "uuid": "a5e6f5ec-8edf-4053-9be4-27d6e35d3ca4", "comment": "Malware payload (RedLineStealer)", "value": "c4c0b61c214cfbb1a98bdb2cbd2cedd2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089153, "uuid": "8bf9fc21-4127-4c8b-9354-606f60d520a1", "comment": "Malware payload (RedLineStealer)", "value": "cd2bbeebac2ea662395357107ab5f4524a94bed0dba3b0569d62bf0e0839a84a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089153, "uuid": "a085bc05-ae87-41f6-89bd-8b9c77aa2dcb", "comment": "Malware payload (RedLineStealer)", "value": "e26b8d631bf5bf2dd157dfdb5f14dc24dc72e34f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089153, "uuid": "3cdb4cfd-4f87-491c-8993-4555b6bef860", "comment": "Malware payload (RedLineStealer)", "value": "5d27e076fb14e8ec7827821a284e01e6db1f2a278cc2c7d6d65bd4ed99d7485c08ccd8ba8b75c47f3fe7559460999958", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089153, "uuid": "8aa2d2c6-1f06-4c78-9f5b-bb9759ce674a", "value": "T1C1452317B2EC8172E5B113B41CF203832E343C665C38D7AB77906A969963B94E4717BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089153, "uuid": "440aa4b5-d358-4a14-abeb-f1671dcb8027", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089153, "uuid": "0f0a9bc0-9464-4747-b57f-f3eefeed5727", "value": "24576:jyP99vhMQi+g5Fkmcv6HLrQe7CWqeHF5Qo7Fq:2nhMP5FkmVHfQe7Cql6o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089153, "uuid": "9d339b53-bedd-47d1-a95b-83f18c5d5003", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089153, "uuid": "70d2e21e-61a3-4d77-8f30-1cbc63e40b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089153, "uuid": "84d5a7fb-c39c-4dba-bc91-d083113aed97", "value": "cd2bbeebac2ea662395357107ab5f4524a94bed0dba3b0569d62bf0e0839a84a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a60c45-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089154, "uuid": "f61cf32e-ada8-4bbc-a17f-590ed701a264", "comment": "Malware payload", "value": "077df388f71e4292f9fa9553c7560633", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089154, "uuid": "b021977b-61a6-4fdb-9825-f592158c59ef", "comment": "Malware payload", "value": "cd49dffaaeb0970d0b772276ca7bd006dc454ec76fae4573460b967ba548d1a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089154, "uuid": "00159dc9-cf8c-4707-ab62-08e9202b5c0b", "comment": "Malware payload", "value": "8b5ee51cc6f2c258c0a9a4088bd2a182d9a4a804", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089154, "uuid": "b0cc896b-8823-4ee1-8307-041021afa380", "comment": "Malware payload", "value": "8ea2657da6e7d482265d8f82bbde28c5778c67f930f2a98878512a4bef59b0c02773d2b3047656518e680d2637e30325", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089154, "uuid": "c6b4f8c2-824f-4280-85fd-d74e5dc2edcd", "value": "T1B2152212E3D84073ECF72BB01CFE02C71639BDD2697C925B2780AD1A0DB26949676767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089154, "uuid": "58f37b86-114d-4279-b0d3-36fc6ea27e17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089154, "uuid": "00930374-7b01-41e2-a6b6-228ff15662fe", "value": "12288:vMr0y90pljJCASVaPMxfsKfrcqpYzK+jAOVXLfiDhQ4jgwUX:XyQjJIlDcPzKiPLO7aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089154, "uuid": "474efade-5a1b-4c6b-9c54-3f4ce3c8b31d", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089154, "uuid": "35e7bc06-0168-48ae-8f15-fb8e65626e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089154, "uuid": "8a1ba87d-7c3b-4497-b9b5-0af452ca9deb", "value": "cd49dffaaeb0970d0b772276ca7bd006dc454ec76fae4573460b967ba548d1a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24db944-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089155, "uuid": "df8f806c-00e8-4717-bdc0-7b8b307ef93d", "comment": "Malware payload", "value": "30ef4e06f2a85c60d08743a615574e1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089155, "uuid": "04e941d7-c2c7-4536-ab87-5e47f74aee44", "comment": "Malware payload", "value": "cd4fe878b57adbfb30dbace1d88b68a86fe6cff400b401e0216f6b916ae3f0e6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089155, "uuid": "753ed51f-3b94-4529-8132-d718ffc124c8", "comment": "Malware payload", "value": "705daef4e2ac20794edf81372f839445d99f17f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089155, "uuid": "78f116d4-0841-44ef-90d6-c248a39e7c8c", "comment": "Malware payload", "value": "c062cf62c466ae3879c71a86267dc679644f4f714d6cead8b528579c11e5e0f82e23bbcccf3bfa67d29bb83db222d6be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089155, "uuid": "592cd012-27e1-4207-a7da-35f0c66701c3", "value": "T167452323B5DD5032F9E637B0A4F207430E39BCB368684BA61A45EC4E5DA27C4227577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089155, "uuid": "0fe106b0-9b04-48ce-b9dd-653a6e18263b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089155, "uuid": "1b45d3d4-5eaa-4d6f-87e9-714054bafca3", "value": "24576:NyvXTiE9JsSSUN8t6mpB0iiRkrJBrm/x8PkgjzFMCOEkOzbIlWIP:o+SSUM6ep8k1QvXyzbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089155, "uuid": "b1de9dc4-1201-45ef-87c5-56d3c47dfaba", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089155, "uuid": "0df154e0-42f8-4e44-b361-b26db151c3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089155, "uuid": "fbacbc2a-cf0b-443f-9c97-4c0245c1502a", "value": "cd4fe878b57adbfb30dbace1d88b68a86fe6cff400b401e0216f6b916ae3f0e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6efa545-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058293, "uuid": "02d7642b-651d-4e25-acc8-e431c1d203bb", "comment": "Malware payload (AgentTesla)", "value": "4baf116b0e56cbbbc9cbbf9c34087806", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058293, "uuid": "7bdefeb6-f0de-4091-8198-04ca403ceea5", "comment": "Malware payload (AgentTesla)", "value": "cdcb02d44c458dcc97301005e4d5945e2d367fda7d3ed8ad00dd06a73b525cb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058293, "uuid": "5120fed6-0488-4e13-9f34-f3c27214bffe", "comment": "Malware payload (AgentTesla)", "value": "5e8028caf0f1bf2d0db9f969c4a6d996543009ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058293, "uuid": "a94cd912-139a-454e-8b64-7518b6c086f0", "comment": "Malware payload (AgentTesla)", "value": "b712c5685dcd96c9c46a7b37d84d2f269f6ede59b788002f270c3d7d69420dca7f38c9cbcc0ff918d4e80258d0acfdb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058293, "uuid": "27ceccba-116c-407b-85ec-1d284fb1f245", "value": "T12FB59DB3D6D1BDCFD3BF0E70C85336060D98FAB72215E3B9A9842C59192D721B949872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058293, "uuid": "55d6b4e8-f9a2-4016-a9dd-8187d8174e50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058293, "uuid": "95962ce6-6169-41bd-833e-3b1473239e95", "value": "24576:Kx4lg7PuVlF/WWIyY3CZ3O3fVY7pUjkap+oUfp60G5nKK6sF5yoKUpFXIwIaL5FL:Kx4TZOwO3tKGMqk9oP9lQMsVeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058293, "uuid": "88d34401-6e2d-45f5-8eb7-8054134f7ba3", "value": 2422784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058293, "uuid": "0e6eed43-1539-4654-99c2-08aa2396bb76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058293, "uuid": "27cebbf5-92f3-4b50-82c1-06159d0f9e47", "value": "cdcb02d44c458dcc97301005e4d5945e2d367fda7d3ed8ad00dd06a73b525cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f69e63-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089156, "uuid": "06269ab6-88ab-4e87-ac60-e0b724cb4079", "comment": "Malware payload", "value": "a27686e57d471908c238935b60b6f5c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089156, "uuid": "663580da-b8e8-4900-beea-76b8a2136eec", "comment": "Malware payload", "value": "cde9c3a31bd2bcb56c5e27000ade683cf900b3e4a9610cea02a7a81b4cd3466a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089156, "uuid": "001ded6e-f07f-405f-a661-97607ce3bee7", "comment": "Malware payload", "value": "036d355bbd7f637b4aa09a735c4670676c878573", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089156, "uuid": "863337b4-c4b7-4c7b-ac14-775151eb41df", "comment": "Malware payload", "value": "18e7baed6cb13718563a031f7fde67f76b2903a2ad653da5267df83fff8e8a17a056dcd9d8b05d4f6c008a94a41b683d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089156, "uuid": "3148500b-ec5a-47d8-adeb-71fbdd4cba16", "value": "T187452307D7E988B7EDF527B018F505821D3E7CB06E28235E3A06AD664C33196AA3537D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089156, "uuid": "aa13cbd8-b829-4c32-abf8-bec03dd516bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089156, "uuid": "55dbdf55-324d-453d-8f94-2fde676cb52f", "value": "24576:RyHAiL9ywKdzexDyF2lnvF8PI++PT80oR4br:EH351KutN8PILo0tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089156, "uuid": "3e2087ba-4e6e-4112-8f59-d8b4df9b4ebd", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089156, "uuid": "877f232e-11dd-4035-be3a-dc8baa5b0197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089156, "uuid": "50a26ed5-53da-42bd-9a3b-5eab914a6f67", "value": "cde9c3a31bd2bcb56c5e27000ade683cf900b3e4a9610cea02a7a81b4cd3466a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b391716c-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089157, "uuid": "346ccc84-d3e4-4b5d-8b39-bf8008654514", "comment": "Malware payload", "value": "e7607c31bcb2fc3d1a0c2d4f54c373ea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089157, "uuid": "25985a3f-0288-4129-99e9-fcfcdb434b9a", "comment": "Malware payload", "value": "ce1a9fbe563e9c4e30454385cd5b9dbca2603e7075b6cb562a71100aa5165710", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089157, "uuid": "79e3ea04-94f3-4248-97cc-df53af36dff0", "comment": "Malware payload", "value": "018178110e285903a6bdea76497a829fe965e1ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089157, "uuid": "9d18194a-c6e8-47d9-8782-29a5d22dd34e", "comment": "Malware payload", "value": "a1966fd288d61f2e8fdcba95882704704cc67f64d909f277a7d79893125143c0596caf3f67f0422e6766e2cec6846d41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089157, "uuid": "2e4b977a-35d2-4119-8d3c-e96ed36c7191", "value": "T19AF42243A6F80531D9B40BB4A4F20383067D7DA09D74D66F23956C5A2C732DAB936B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089157, "uuid": "ea74ec21-21e0-472d-83c8-46ac4990f794", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089157, "uuid": "366ecded-69e3-463e-bd4f-e3e9dc02a7aa", "value": "24576:2yKnLP15wb9SiFmag0IoikogSoGKFFQR:FKLEb9SiUlZo9oh0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089157, "uuid": "62466c98-0675-4107-b1c1-120a3af4be37", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089157, "uuid": "331153cc-2e07-42f4-8046-21da031b2dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089157, "uuid": "5e3d6fba-60e1-449c-b3f8-40bf0b3229e8", "value": "ce1a9fbe563e9c4e30454385cd5b9dbca2603e7075b6cb562a71100aa5165710.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43bbc21-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089158, "uuid": "47b4f845-9ebc-4cb3-9344-57621c5a134b", "comment": "Malware payload", "value": "6e0e633740a931c1225d509240b49381", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089158, "uuid": "cbd6050b-7ef6-4744-a2b4-85fdb80b17ef", "comment": "Malware payload", "value": "ce1c599439da17c576daa98a6d764e3249d17faf8bba12f738dcfb4919336417", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089158, "uuid": "c00a491b-49cb-4b2e-81c4-96fe8b075b7d", "comment": "Malware payload", "value": "332f4a3dae4e94b59ea4337507a4bca39cb07148", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089158, "uuid": "fbb76ee6-0281-47c4-95ff-249ff1d0a07f", "comment": "Malware payload", "value": "1f48519c54e134de472cbd6da547f3307e485b06518618c40969d568f24c06ded2424042140075a136f69a8638fd44f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089158, "uuid": "cdbd5d89-3930-4d75-9124-31cb7f3a389d", "value": "T115452312BBE8056AE8FC2BB45CF656870E357CF26E39628E138C944C0C71A95E5753B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089158, "uuid": "3ea2021e-344a-492f-b1d6-05562805295b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089158, "uuid": "3274495b-adda-4b12-a2f6-73e48113f49c", "value": "24576:fy8aL9p0mWX19yjO9n4HoM0HVl5C+rk3wxz1p9PqgW:q8aLT0lX1sOmfUdLgwfHPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089158, "uuid": "575c6261-fe73-4a0f-bcd1-af63da36a083", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089158, "uuid": "abbff847-b08c-468f-bed8-7ff0f26f848a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089158, "uuid": "da6b9ddb-114b-4626-afe1-62bd55801585", "value": "ce1c599439da17c576daa98a6d764e3249d17faf8bba12f738dcfb4919336417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d0cd1d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089159, "uuid": "1ba62a45-1bd4-4b6d-af25-065a9950867b", "comment": "Malware payload", "value": "054f411056a5f427462b15a0beaf2702", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089159, "uuid": "030d163c-c628-4fe8-9046-9ac19b4a6899", "comment": "Malware payload", "value": "ce5638eb5fdce0a9882127a6e53553caf3066e1c342115793b42c61389328410", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089159, "uuid": "6aa08ad6-1719-4bc5-8a01-2fd1d1198759", "comment": "Malware payload", "value": "82d34b57ba54fd46f6b99ceb3c98baadb2d27967", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089159, "uuid": "70bc9769-e1da-4f24-95e6-e8e9afdfb52c", "comment": "Malware payload", "value": "8c2cbfa23be682b12c2adf61ee00d421a9691bd94155ca8705008dc489008766e04fbafa34c63aef3c606b99f951b703", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089159, "uuid": "8d0b7278-b9d0-42e3-a7cc-31ca42dd4ec5", "value": "T1E4F42217F5C884A3E9F15B3058F317D3063D7D925C38876B2A82A59E4CB22D8A976337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089159, "uuid": "6ada1888-e959-462c-b72d-11dcded8dc59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089159, "uuid": "490f586a-a72c-4001-9560-5d0924de772c", "value": "12288:GMrny90U8FPcVcBj+S/jBEjNZ5/OTyqxAhsiZjzQ68gVgu17Z4Rz:xyH6FBJEjNDcOHpYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089159, "uuid": "4b715ea9-263e-4fd8-b5c7-14400f3b2951", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089159, "uuid": "62ee1e3f-f57e-4f1b-937e-ceae9f4197cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089159, "uuid": "b65769e5-d26c-4bb1-a55f-340c99c64366", "value": "ce5638eb5fdce0a9882127a6e53553caf3066e1c342115793b42c61389328410.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572b963-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089160, "uuid": "409ad670-fa0b-4366-8ed3-396e3f5e6eee", "comment": "Malware payload", "value": "e856eeafcfe3713f2c696f2d25764b61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089160, "uuid": "6fc0b931-2694-48c8-a0e7-836eadebfa49", "comment": "Malware payload", "value": "ce7ac9be03b8c51c17f02dcb593f28784afcac1e733b2a3bcea6f089ce434c5c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089160, "uuid": "3f54193e-cc89-4384-9c4a-1d021423e7ea", "comment": "Malware payload", "value": "fb5f1ca4ffecc6308771099dea771fd1f76c0005", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089160, "uuid": "2d62ef58-fd54-471c-adcf-4bda410e8e0f", "comment": "Malware payload", "value": "de8e6ee0bf89f7cf1dd5d963f713cc5535abae0b354f92d9eac2e23c3f392ce72bb34d0c3c8390c51e7dc8da397b5a83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089160, "uuid": "1b50bc1a-3dfa-43c9-a660-509ddf1cb888", "value": "T133452343AAE8C472FDB60FB069F353971A3539E20A74C33757D1946A0CA2585B8B533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089160, "uuid": "cddcc40c-f623-4a35-a857-e1e337adb117", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089160, "uuid": "44b8cc1f-0069-4833-a94b-44d27aa27991", "value": "24576:Myzo6C0+4cfL7vhR0uYVtiejseSVyaH9PY7i5G:7zDCTdktiejs7Yad+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089160, "uuid": "a14133d1-65c8-432e-939d-2e93c1c51492", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089160, "uuid": "c798dcf3-7eff-4484-a680-041711e26582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089160, "uuid": "b1da2357-7e87-403b-9836-139cddeaba59", "value": "ce7ac9be03b8c51c17f02dcb593f28784afcac1e733b2a3bcea6f089ce434c5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2b2350-f222-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684046541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046541, "uuid": "83d8e30a-aa4f-48b9-86ee-8cbfc9108f1e", "comment": "Malware payload (Mirai)", "value": "4449cb1b4111875bc29be90a8b0f1866", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046541, "uuid": "123cdd73-5ea6-4505-8919-8d11826b2e0e", "comment": "Malware payload (Mirai)", "value": "ce901878ee477818577e7a5f38115f299d645e308a1bb0145d1e434cf9eb14cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046541, "uuid": "0f6a9094-afbd-422e-b34f-490328e70515", "comment": "Malware payload (Mirai)", "value": "565fcaf250e56eea31d64d2d44c99450317a142e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684046541, "uuid": "8bfcc1a5-cbd5-42dc-898e-66e1b52553e8", "comment": "Malware payload (Mirai)", "value": "1c0477b771c228dbd4e4cfd3e3368cd0cd8a8b7695c08f45c3a7b9e3bf160faaf41d4407b0fd9fba34bb2a3a4ba778cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046541, "uuid": "27ca4568-3c98-4c79-9fda-c6c470d75cc0", "value": "T1D182D02021AF74F5CBE10434FAAECEC6975A0BF8D1FC36E717486B78894610651F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046541, "uuid": "dad06cf4-0679-49e2-8607-93f1892c7b18", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa8hymdGUop5h5l3:2dV0P6+kom0tVAoNvm+to18s3Uoznl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684046541, "uuid": "1be8b62e-08e5-4bb6-a5f9-80fddf736659", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684046541, "uuid": "a84df513-76f6-4f9a-84e9-7e7528c39693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684046541, "uuid": "d57a9b3d-7489-431d-a7df-435f70aa9d4d", "value": "4449cb1b4111875bc29be90a8b0f1866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79beb44-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684058294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058294, "uuid": "3b6ed5e8-7ddb-43cb-ad80-bc8febb92a67", "comment": "Malware payload (Loki)", "value": "b6db0b353d5148b5ec10cc58d699c106", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058294, "uuid": "b883ad07-e0df-4dcf-9abd-623d065c3007", "comment": "Malware payload (Loki)", "value": "ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058294, "uuid": "762e83b6-1404-474c-a787-28d26336cc31", "comment": "Malware payload (Loki)", "value": "5ea030a1e0f7ee1aef15a514ddf915793efc6afa", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058294, "uuid": "f285c3db-fc3c-4835-95aa-5eec0e205ea7", "comment": "Malware payload (Loki)", "value": "c1253a6be71967466d609c7b0d299ebf9e434f6b9fec28e4713812adcb4cda0ed2b9da1d0ab6640b3902c5761e522113", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058294, "uuid": "24f00989-0f07-4be3-98d1-732c4cf318b4", "value": "T1C8F3023426D5D0EBD86743312E7E075BAFBBEC2514F1571F23A4AA6C7D2122AE44D3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058294, "uuid": "d0558585-38e1-405c-99b6-8ce4b30672fc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058294, "uuid": "a45ad540-3c81-4b2a-8ca1-aa21070058fc", "value": "3072:HfY/TU9fE9PEtu8bQ+eRmezpZISLFfr6lLuQltZTkiHSKfC9bz8J+iuk0ap9fswW:/Ya6IQ+ezpeSRfelRlPcKfY381HJswY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058294, "uuid": "2012b695-3e7f-449d-a166-f3a01d808b99", "value": 167212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058294, "uuid": "a605c56c-383b-413a-9ae9-075937a7ca9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058294, "uuid": "e7204368-c11b-461d-97f4-3b137f522bf9", "value": "ceb8f84e52d2bda9f7916cbcaaf7437d65abd80ff0d3e218fcf863ca2895ecee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6630b60-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "adc86052-f196-461d-8c1f-7c5a3a5d769f", "comment": "Malware payload (RedLineStealer)", "value": "f168bdfa9b57b1af96906ad6892fb28e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "2d589c8b-6138-43c7-b1e2-02d78b86048d", "comment": "Malware payload (RedLineStealer)", "value": "cee50ac68d9057ca911218a0748c80c2a73948f10c89452ef3272b9c4d6a95a6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "ecf5bbc1-14ec-45c1-87e2-8ad18b2caaf3", "comment": "Malware payload (RedLineStealer)", "value": "c78ad412e5979e4912385d245d8bd574d165aa87", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "385fe214-25bb-4fc5-85eb-7d5d25c90524", "comment": "Malware payload (RedLineStealer)", "value": "0e31dc4d54ce734f2e3b51399b74ef3830068e0a636c095615c2ae7be52707087746751188838653b69bca590c47c2c7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089162, "uuid": "3f0130d4-c3b3-4a9c-a1ca-8bc786b93061", "value": "T1CD452322E6ED0672E8B5137180F623C31E3A7CE6AD7C836F0746D9540C726A0A575BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089162, "uuid": "9920c5ed-4c47-419d-b6d7-a6c65f4ffa0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089162, "uuid": "9b0e3425-ddfb-497e-b892-82d628acf194", "value": "24576:lywncBVk/gTFfs9PwdTrveMV7Us8RjEEk3LRlhWf4yjVEmYo:AIRgTFfscrve8RcEE2RlhEjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089162, "uuid": "20b41378-7662-466f-8c56-fcde0d904085", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089162, "uuid": "88f073bd-88e4-4203-a9f2-2872f9c4cd23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089162, "uuid": "60bc3029-650a-4c4e-ab9f-faa7d028a8ab", "value": "cee50ac68d9057ca911218a0748c80c2a73948f10c89452ef3272b9c4d6a95a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cdbf3e-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "e7063bd1-890d-4711-a505-0acf390ea659", "comment": "Malware payload", "value": "15fbef81a464e1442ea53ab80cba657d", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "610cab8d-5e42-4d7b-83ef-30ff927457ca", "comment": "Malware payload", "value": "cee6584cd2e01fab5f075f94af2a0ce024ed5e4f2d52e3dc39f7655c736a7232", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "949a00a8-9638-40a5-a600-8555031f7d66", "comment": "Malware payload", "value": "051888210f8ddaedbbbfcb52bb091d4a3614eb1d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089162, "uuid": "c16c1508-c97d-4740-ba37-be39af439c59", "comment": "Malware payload", "value": "ab531ffa489cee85969752911beaf95136de63cd963cb29dae16d4ab7857edc060d9c9de216bc85ce2982c70aa07c907", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089162, "uuid": "2950f7d6-3998-4c0c-83ba-f6a2cd59c864", "value": "T16982E1D60FE9345FF206A3F06A9DBB0B2185568170A8C147BFD3B42DD3960A43CD6D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089162, "uuid": "c8e6eed7-7d30-4535-b5e6-f0c4bb52d149", "value": "384:Tbck1yw0Q2BDUosoYkf7Q6gGFnIwneJJFsN:TD1yc2BofoYkzQ6BnOJUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089162, "uuid": "6c237f4e-2546-444e-8b79-3c57cf1ece2b", "value": 18653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089162, "uuid": "1ce03e4a-047a-4431-9982-93e1047b0ac1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089162, "uuid": "b82a18c2-2789-469e-bebc-873b5e015fd1", "value": "CEE6584CD2E01FAB5F075F94AF2A0CE024ED5E4F2D52E3DC39F7655C736A7232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76a1587-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "1b8cc378-629e-4c2b-9de4-13fcfd3b9f9a", "comment": "Malware payload", "value": "75440b1dfbd7c3311ff22e373f1aeeb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "9a8d7b70-7644-4d87-81a8-e2cb0f3747c3", "comment": "Malware payload", "value": "cef495bcb117277f1976c64734878ffcc0deb0a64ea3a696838f6b51ae3ba8b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "44b7074a-5392-452c-a464-2e1d94f64c1c", "comment": "Malware payload", "value": "a73dd4cf35c323b285bbb4967eb7576da42ed290", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "e5ff642c-5d1b-4dd6-a87b-7392d3547d1f", "comment": "Malware payload", "value": "28ec304b23d02a6b75f021df940f6b12c3ab6861d58bacc7eede8e6790b78b7e40f7a7ac43b897d0f1e334522a1858c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "c3d3eb68-da46-4ed7-9c0c-d131ecea64e7", "value": "T1E74523027AF441B6ECE12B7189F202D30B79FD254DB4D7272306AA170CB2AE0666577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "b42bea60-1509-4c6c-b067-494c561afecb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "7c401f26-30f9-42f5-b89f-5c570d93a78e", "value": "24576:2yoPHB95UB8/w05PfpqFjnfBSeUcZhiJfOWPiXOx44:FoPB95U2wQ3pq1nfB5UqGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089164, "uuid": "be1f220b-89a1-4020-802f-e44b960c6458", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089164, "uuid": "c05bb0ce-7cae-4103-bf31-af387e573fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "f4b49eb1-e049-4b03-bb0e-1236f40c2dd7", "value": "cef495bcb117277f1976c64734878ffcc0deb0a64ea3a696838f6b51ae3ba8b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fc151a-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "5d8cf4e1-3591-41e5-b802-a9725983cdc7", "comment": "Malware payload", "value": "d33bc255506f8e6e9fa3bdb0ad17b6c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "84c99b91-fb33-4b5f-a326-b9fad74772a0", "comment": "Malware payload", "value": "cef54ebfa08b43e20108ce4d348180f2aef2419347939b1b74a1e9e17f9de5b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "07669d2a-8398-40c9-9270-e754ec2a7467", "comment": "Malware payload", "value": "f82f98421b1b247462c58173d00686c169993457", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089164, "uuid": "c7ddc230-6b22-443e-a773-4b4bf0ea9eb4", "comment": "Malware payload", "value": "d8fa02454b7d6f356d90c9ad3d85826625d2ea0b32ea1055f539598d927a43b1cc82fa66604764c846fd70baff9c9bb6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "95f6b4f6-fda8-4972-a66d-b8158571abca", "value": "T102152247E7E94033E9BB1B7168F907832B79BC818574832F33990C694EB31A4A5713A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "1d2bc867-81c9-4646-a81a-4713096efc05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "cf94fcc3-76aa-425e-af24-abdb66e220ff", "value": "24576:8yZW9KSq+K7BsfxcFVgDUitGfWQvDHfxNR1/hABj:rZEfq77BsfigAitGfWQNR15A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089164, "uuid": "643291bc-86a9-42b8-a7a3-17d673126b4e", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089164, "uuid": "cf4917a1-9f34-48e2-974d-5fa0b071b313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089164, "uuid": "cbcc3299-9bb2-46dc-8398-0883ef2e044f", "value": "cef54ebfa08b43e20108ce4d348180f2aef2419347939b1b74a1e9e17f9de5b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9054f03-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089166, "uuid": "06166d42-f179-48e6-81a2-1d1dc6fafd3f", "comment": "Malware payload", "value": "9d7de7fc671e125dcc8b696609e6ded9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089166, "uuid": "b5e5e974-41da-4890-85ce-17dc08fea168", "comment": "Malware payload", "value": "cf0aa3576d186a1806d682fa0e201e101b565fedc3854f9e9dc9acd2fbf4c2e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089166, "uuid": "d10f64f7-3ac9-4eb6-a866-a4b28a84134b", "comment": "Malware payload", "value": "98ee40b902340da085e56eafd21e879d46d65b40", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089166, "uuid": "d60dbda8-6a69-48ec-b7c7-4ca09db4c7fb", "comment": "Malware payload", "value": "f5af9cd8261d9e03ef2c45f7b934a8287d6fe7c13e037fc232302042db5663b640916ce8fbe48f0a0025d08761a8c5ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089166, "uuid": "070b77c1-dbe3-45a2-9510-511b871c2c5e", "value": "T174452303D7E89232C9344B7008F523D30B36FD9E9578826BA786581E5CB37E5A571B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089166, "uuid": "8ecc4c38-bc30-4bea-892b-12983b09ddc8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089166, "uuid": "625399de-9314-4f58-979c-bb7110e7c430", "value": "24576:+ydlA2O4OW2O70UeTm3vuQmrJiWse++TBahQ799nmlu3:N7Ab4OVmEe9WsqsWZ9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089166, "uuid": "5c27e91a-e79b-42a0-a7f8-34e000f57bc2", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089166, "uuid": "94a34039-24ca-4ffa-a13c-1ea27e34fb4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089166, "uuid": "a343d9dd-6d67-4f63-b1e9-3b34309ed5ef", "value": "cf0aa3576d186a1806d682fa0e201e101b565fedc3854f9e9dc9acd2fbf4c2e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9af2697-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089167, "uuid": "cdc31b49-7cdd-4319-8150-1a7d56cd5b39", "comment": "Malware payload", "value": "0c58dcf31f21da4409f56f55a15ca879", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089167, "uuid": "f163dd8b-87c3-4ab4-ad81-64b0f9ce1aba", "comment": "Malware payload", "value": "cf0f099a00f5b82199ae6aa8f7b848408029fd57329ae5f4b08eea1e565fa3b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089167, "uuid": "997fc6a9-9eda-4847-9516-19f2684672c8", "comment": "Malware payload", "value": "503f6fcaaf07df9a3aa6662c62eecbea8da08645", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089167, "uuid": "9da8b6b2-bcd8-4372-89d8-97fe29a53224", "comment": "Malware payload", "value": "31205264b21c405caee1a987478ab13161cf4b861c7898ceae4d8db37c7e295e67398951def0c6149e13f1360f9ea0dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089167, "uuid": "1d8a2599-8fa8-4b00-9659-8c24911fd5d2", "value": "T1F5452302AAE85C77F9FB5FB164F606E31379BC605DA8970B23545E020D33789A4793A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089167, "uuid": "777cf6ab-2c46-4813-9cc1-56ea78427681", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089167, "uuid": "428e3ffd-8fe7-4d4c-a4da-5e0244212a11", "value": "24576:uyOz8JMXd90F3/n1yCJxyw8pyp4P7EVN7t2V:9OIJMtydyQyw8py2YVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089167, "uuid": "259adaed-b351-4855-a506-e8f4e7a51559", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089167, "uuid": "f3bf1063-af1b-4e46-9b0b-1496f501d8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089167, "uuid": "1a70d0a5-4341-4a3a-92bd-7066de524de3", "value": "cf0f099a00f5b82199ae6aa8f7b848408029fd57329ae5f4b08eea1e565fa3b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3e72a3-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089168, "uuid": "6447c1cb-f538-4b68-94db-98905f47b504", "comment": "Malware payload", "value": "e40414e745a0a9c3b1361e5092a9b9e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089168, "uuid": "2494ceaa-e30c-4692-a19d-bcd520444845", "comment": "Malware payload", "value": "cf27f83a4262559d923a90c2736a92facc137c0843831111e5aab5c7f462f778", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089168, "uuid": "e54a8620-dce5-4d99-abba-4889d628d7b7", "comment": "Malware payload", "value": "f1715f9a5b45576a8f59f404474477d2ec1e8c9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089168, "uuid": "9bad622e-2df5-461a-8d39-045a7d83ef89", "comment": "Malware payload", "value": "5ada71be543ad41961562551b728fda94ab6c94f391d13f70bd10099bcad2522541198e69a30061104a68530f35d8cfa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089168, "uuid": "b7dde66d-cea6-47c0-bc44-d733e47b8179", "value": "T1F7F42356F7DA8471E6B123B02CF207530A363CA2A83492A73355953E9CB36E06479F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089168, "uuid": "42887567-714c-4149-86c5-d34fa12decc8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089168, "uuid": "e9a683f9-9c08-49e4-9fae-19f1d5f34338", "value": "12288:+Mrfy90SEaawZM+lR0B6oaYLq3IjA7LO/ZwWX+0U6Nmq+BJrfZ7kPi8XqdJlQm:JyTaIj0MJYLqlLYbX+0VAlBJJx82Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089168, "uuid": "55d2ddba-23e3-4ee4-9919-a338facfd25e", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089168, "uuid": "b43ec8bc-d124-42d5-bb60-9cadbae1a4a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089168, "uuid": "63608e3d-c6b5-43de-8722-63562cb0c3d7", "value": "cf27f83a4262559d923a90c2736a92facc137c0843831111e5aab5c7f462f778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb45a75d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089170, "uuid": "5e068f27-d411-4119-8f5c-edb6e77537d9", "comment": "Malware payload", "value": "52853af52c9445a9bc014f426d5d429f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089170, "uuid": "7ebd77b6-1eaf-4af9-a510-f94805254fac", "comment": "Malware payload", "value": "cf49063804eaf8bc401013a9f6d7cd9702bc0c7af0534a029d76cd179d026805", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089170, "uuid": "89bf0156-e182-4ab8-bc9b-c5840377b3ce", "comment": "Malware payload", "value": "f23095da8a4067c03475694a9512effc8b1824ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089170, "uuid": "8fc3c31f-b7b1-4857-a56d-26e48de66e2d", "comment": "Malware payload", "value": "93b55ff99132255941216fcdff42385ddb2e16323834340e8527fca8d3ba64f559890e30604a97701d7f8dce29dffd5b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089170, "uuid": "2c53b46b-db99-4548-95ff-4d3cc718212e", "value": "T13745238BB1DDD073D472A7B445FB02971A34BCA2AA68515F12517C9A0DB32D0BCB632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089170, "uuid": "f659a52e-afba-4959-aca8-7ef8ddc09e11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089170, "uuid": "acc920e2-c9e7-41a6-acce-435001bc13be", "value": "24576:by5juN9AEbwf32rvWOc+73OXy5nbu91pz7Vjoy/avFv0:O5juNOEbwfGrYp2nbwpthK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089170, "uuid": "6dd67723-80a4-4c1b-aa4a-6ee54569da5c", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089170, "uuid": "73ae9f03-ac61-42fd-9877-fba173734fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089170, "uuid": "569d431d-6caa-4bba-83e5-0161abcc20d2", "value": "cf49063804eaf8bc401013a9f6d7cd9702bc0c7af0534a029d76cd179d026805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdd08e4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089171, "uuid": "de0e6d92-ad12-4f81-92d3-9294e728995c", "comment": "Malware payload", "value": "ee018a562eda4c894dc15092a1d8ccf8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089171, "uuid": "da18f645-2d93-4b62-a3fd-598f4fd0aaaa", "comment": "Malware payload", "value": "cf5049aaa76c4b36bf8698afc7835ce9feb208eae6437f86c84e3421911ccbec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089171, "uuid": "b58bd731-ae06-4af3-a6f5-a16d3cc8561b", "comment": "Malware payload", "value": "81050c6cf613728231425fea30d38c1c9423342f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089171, "uuid": "3979b995-c6e0-4226-9425-4a76dd33e441", "comment": "Malware payload", "value": "f215ab94cfdc512073cbbb1ffd50454150e4a87caf9d546d48f8d25b5c52981c6bf758cd1185c1cd1b28c7ff65b4a6c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089171, "uuid": "54ebc5b5-14b5-4bc2-a61b-c6759f9a69a4", "value": "T127152397A7F99532CDE1737009F946930F367CA66E24A67A3B84545A0CF3284DA7033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089171, "uuid": "3767a66b-906d-4574-bb8b-3d8d71813f36", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089171, "uuid": "f1024af5-fa7d-4e77-8981-db31f1babfdc", "value": "24576:gyJkinYJKAHCiJDSUekXjZWZ2Ln+8JC8:nOiyjBL2Sn+8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089171, "uuid": "71e8caf0-cf06-4535-80de-271f711870c0", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089171, "uuid": "44dce783-50c8-465e-8545-33d9b4d38d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089171, "uuid": "353bdf8e-51c0-4e14-b772-f24a587824bf", "value": "cf5049aaa76c4b36bf8698afc7835ce9feb208eae6437f86c84e3421911ccbec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7825ce-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089172, "uuid": "8ed24c58-85d1-41e4-9584-5a8a23bce7df", "comment": "Malware payload", "value": "f07b3895944562d93acc6d71c1052270", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089172, "uuid": "3b3ac42c-4deb-494a-95d3-4dc73bfcde1e", "comment": "Malware payload", "value": "cfb0ee5403ae8101f5dcf5aa27d399d58a743733c08d3526302075792efe2b01", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089172, "uuid": "863ffaae-b689-49d5-85fb-43058a4d1d31", "comment": "Malware payload", "value": "36f4e40e24eead0fb6d88f0c45c187300f4e3a30", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089172, "uuid": "c786a712-87ed-4541-a134-a9263b720189", "comment": "Malware payload", "value": "6e4d038e22a6588bbc75b4a692ec27b2f95de4f33b5d3c982ed998cca403a1310e5862325d8b5c163c97f3afdc1585de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089172, "uuid": "b606a0c0-bf5a-4162-848a-fd8561c13c33", "value": "T1CE152213ABE4553ADC751B7148F602E70A3ABC526938811A3352AD4B1CF37D6B87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089172, "uuid": "1cdfa0a4-1db7-402b-8a67-cd4e26dbee43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089172, "uuid": "a06cd342-9889-4dd0-b6c8-c182821600bc", "value": "24576:gypC5GNJCRaegFR4jyZTdqT1rcHhyiN4KC:nU5GzCrgFR4ETdqhAByi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089172, "uuid": "5b0c705d-e76e-499c-8bbf-8022279146a4", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089172, "uuid": "569fba2e-840e-4a9c-a51f-3d3e84c2533f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089172, "uuid": "e258059a-cb93-48e1-8475-5dd285cc69ed", "value": "cfb0ee5403ae8101f5dcf5aa27d399d58a743733c08d3526302075792efe2b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368fec1d-f24c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684064466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064466, "uuid": "b5e7c965-d848-4bc1-8938-d05b36b3464f", "comment": "Malware payload (Mirai)", "value": "64b3adae26892d3aa2a2e529da518961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064466, "uuid": "ce57a640-6c7c-4ef7-8865-207da181d2a5", "comment": "Malware payload (Mirai)", "value": "d04ede7693404fea91524a078e0cf066716da9140b96ce9d6db1e783e75a666d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064466, "uuid": "fb24d324-fa46-4e6a-8b8c-db5d74e60131", "comment": "Malware payload (Mirai)", "value": "ff8d1f21de1b5a52ef0a1e7266670703516e719e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684064466, "uuid": "a30d8da4-8ed1-4d97-91e9-07264bff4874", "comment": "Malware payload (Mirai)", "value": "1eac7bc159506c0d258e5d81eed8a09b334be2ac0998c355cd78b662fd6fcf3a980a53e0912b59196007650640d3f0c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684064466, "uuid": "a3889faa-8f35-4ea1-9641-d5da75b749ad", "value": "T1A0A2E119BF1C85CBC832697955D9EAD21252FC71F29CDC182A40C15FF4A33A96874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684064466, "uuid": "b7056ec7-5b08-4194-9605-8691de01e798", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKi:O98o08kxofBE+ZkXaqGbp2F2TWul0c5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684064466, "uuid": "c057d9b0-7ace-4ca8-be27-eb51246d0129", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684064466, "uuid": "0414f3a2-ac03-4387-831f-8dc2fad0c395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684064466, "uuid": "b4c0a323-fc11-43f0-b39e-3978a8d2802e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48d41b9-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103413, "uuid": "1f3199f7-6b7e-4efe-bc6b-76bbeb67a1f1", "comment": "Malware payload", "value": "446983b80cf1fba5317c82c069463dd7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103413, "uuid": "0181cca8-e76a-4b7a-b050-735ee4143056", "comment": "Malware payload", "value": "d05d5696f9869236dff64b48fbd7f68a2947ca1d1ea4f3fb8068e1f086870905", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103413, "uuid": "4876d66e-366a-43cc-8414-3f9cbf358d2a", "comment": "Malware payload", "value": "e8752f2513007d915d0c725cf421e33f54b87b1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103413, "uuid": "265dea60-9221-4b9c-8279-2f011b246847", "comment": "Malware payload", "value": "533c1110680f0b925d1e9f78b1f31352a49da68da8de11aaba54dee3d604b4c54d3ac802692792c6b02f24421afe0cf7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103413, "uuid": "cf81d7ea-994b-41f3-a929-7a29635b1d58", "value": "T1C494BF59AA32979CED3A9D7F5C97C60DD593647CC703C9B38C19E191CC7B6023A0A0BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103413, "uuid": "101968c2-82fc-40a3-bc84-4defb090c445", "value": "66a201125fb55b79ced6d0ecd1985e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103413, "uuid": "b919be00-ce9f-43a2-967b-9437ecc29049", "value": "12288:YNiaHt1oj7pYs/TTdYH6TpRpyXl0BxPeBZcAKlBl3S:CiaeX/TiH6Tp/yo2MlBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103413, "uuid": "3153cab5-63b5-494c-904d-5c23f0d3ee9f", "value": 430142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103413, "uuid": "3a547d72-2600-48de-983c-388c23883538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103413, "uuid": "9a1ba162-27e5-488f-8f9f-d1ef1bd696e1", "value": "SecuriteInfo.com.Heur.20230514215051897953525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3358ccc-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089183, "uuid": "89b3fee8-ea46-4e4e-be52-a83b009cd0f4", "comment": "Malware payload", "value": "cd21eef335378861187659e597e32a63", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089183, "uuid": "e8c0edfb-2758-49d3-b17f-fc5d398ec1a8", "comment": "Malware payload", "value": "d07b438529f69cf336c7d1c4b4f796266d7c6b6fbce520e6f8db8749c9c5afce", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089183, "uuid": "dc962502-943f-41a9-9112-716041a0a19e", "comment": "Malware payload", "value": "5caf62cafda6b6881ebe285f1841fb72249a686e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089183, "uuid": "fe45d11a-044d-4bbd-9aaa-09ad09895041", "comment": "Malware payload", "value": "8ad3517d287572c0acd86c18227625ca0ab8dec06474bf845ed1295f633b1aefa3066ab6a91fd45b46a1878f36289b3e", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089183, "uuid": "4617c146-6e2c-4947-bf1a-70ef8ffe2e6a", "value": "T1F63578203515877EF8C0BEE4ADC67C9146EEACE26D00142435B6BF8AF5F71A6BDE1109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089183, "uuid": "c333fb98-abf6-467a-8483-c4f8a6db3762", "value": "dc77f9d6cc4dadb44aced8aa8256c58e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089183, "uuid": "ae60b4af-fea7-4dd2-a7a4-04261613d84b", "value": "24576:e3vo4hM/aJzUswLRxvOxV8Tqf1HuhQ2agNFmIOHLCme1rr22SZ7:MvvM/aJz8vOxV8TU1nUOuV1rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089183, "uuid": "d82d94d2-ed70-4003-812a-9ebf63bcdf46", "value": 1114056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089183, "uuid": "93b7d0a1-d6db-411c-84d1-65707ff1e3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089183, "uuid": "9ab9fa87-3cca-4cc9-9bae-0ac78438e1c2", "value": "ConsoleActx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7f4ab6-f2a1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1684101200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101200, "uuid": "617fbdcd-1bd8-4fe5-9d9e-b28a9fb91a35", "comment": "Malware payload (Cobalt Strike)", "value": "fc32957fc17e47bb83c8668793618f34", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101200, "uuid": "f1a443d7-33bc-4963-ad68-6f2f58a0cc2a", "comment": "Malware payload (Cobalt Strike)", "value": "d14bf7486bf687ec2d098deded98db082415b6e27af739295f005683a2596e3b", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101200, "uuid": "51440e53-9202-464b-a6fa-9e8fca4ec10e", "comment": "Malware payload (Cobalt Strike)", "value": "ebb02ad25a825bb704c09fa720f6b1df71587dd7", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101200, "uuid": "e82acd02-2de8-470e-8e8b-272c89efff1a", "comment": "Malware payload (Cobalt Strike)", "value": "badcbc864645f12ad8f793dbc7f755aadfdf134ab7faf56ca7f0f64365fd0a7a1af7bdb1ee36cb2aa1786e87ab22bac6", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101200, "uuid": "7ad11ccb-6e8f-4ef7-b479-2b9b944c6c40", "value": "T106559D42F2F486E8D477D17ACAC28B5AE972B86057305FCB458187593F3B2E1593E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101200, "uuid": "97e0dd91-491a-460b-b676-624365ec1832", "value": "a7b110534d0030c249713dc0c450133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101200, "uuid": "56a21ee6-7083-497b-8eac-a5d5b38da7a2", "value": "24576:A9kS72sGo5TiDkKQ6/WfeNyTQY2gynNrCO4OzUuZmrXZPDx6tSGiZPTr:A9jUoYueX34Og1rH6YG4Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684101200, "uuid": "9b935af4-d1b4-4ac5-bf29-20501717d12e", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684101200, "uuid": "e3a8ac2a-b43b-478a-b173-897bd5962263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101200, "uuid": "3a1621b9-afec-44ae-a518-da16281bd271", "value": "30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53ab722-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089187, "uuid": "af718bd9-b728-4ed2-9978-35f621ccacbb", "comment": "Malware payload (RedLineStealer)", "value": "88d875e207a2667b9e344fd3d4fb3e98", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089187, "uuid": "c769be14-eb0f-4db9-bc13-56b159bb08c2", "comment": "Malware payload (RedLineStealer)", "value": "d14ef1de1be18c0fc8c9d3c9f99214d1fdd6d529da03b27310660e00a2f26c33", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089187, "uuid": "2b9b530c-58ce-4db6-8f1e-d1f8a3f0d36c", "comment": "Malware payload (RedLineStealer)", "value": "653c890ef5f52c5f4c3622cf850b49d7a3b2c76c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089187, "uuid": "d43df4b0-cc23-49d5-a048-6c8c97374db1", "comment": "Malware payload (RedLineStealer)", "value": "40a3caa4a92eb8323296273dce33acf150de27158307029ecc8dd4727850b737cf32ca748fdb3d5a8942d60c683d7fc7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089187, "uuid": "d641df6c-f122-4f7c-b8cb-e2891dec4742", "value": "T154452343B1DC7067FAB21FB015FA13834A357DE5AD7093AA239164AF18B26D1A234737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089187, "uuid": "64b11c6b-77ee-4e8d-8cf3-264a170b18bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089187, "uuid": "fe4b3c77-4ac3-419e-9330-d446b32aa273", "value": "24576:/y3+XMfIjB3VEL7FYmExm2qasamRig1hjxHl1pKfMfK/E:KuXfFlELIq1sgDjz1wfMfK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089187, "uuid": "ef3af081-e26c-4d25-9a7e-18eda62606ec", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089187, "uuid": "0429ff9c-d9ef-4a2c-bef2-a3d61c0ceaa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089187, "uuid": "2d8f0afa-fbcb-4c4b-9696-8859e112a435", "value": "d14ef1de1be18c0fc8c9d3c9f99214d1fdd6d529da03b27310660e00a2f26c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018c1f64-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089717, "uuid": "bbc58a08-233a-4ab2-870d-fe7ff824745b", "comment": "Malware payload", "value": "51e2849762ef9e1e0221b383c71d6b25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089717, "uuid": "df3b881a-7601-45d3-991f-f53b50c8a292", "comment": "Malware payload", "value": "d15472f976934444038ad2d5dbd31b5627c8738bf10cea91c5f2f89827c644ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089717, "uuid": "61f7279e-79fa-424e-b62d-fdba3c982b43", "comment": "Malware payload", "value": "e4ba00405ab506459a1e50a601241ae3c1d2bddc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089717, "uuid": "bb6393f7-5263-4a91-9abf-063880aab962", "comment": "Malware payload", "value": "bb9820e2e53cdbc7692334c2855a2ef4938b51904c7c37ac52a85e5de82b126cc866b05230580937c67fb79ee4d6495a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089717, "uuid": "8cb09d95-e8d1-4b70-8607-3fc8db0440c3", "value": "T1B726AAA56A15CD4CCE4A9EBCC830CDF454A47D29D8848067B0EE7D1AB339F68E936CD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089717, "uuid": "08bf3f5b-e080-492a-a252-a7e199a8064a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089717, "uuid": "0a4782a8-d07b-4b9a-9a5f-1f7e2266280e", "value": "98304:tlIn0amOqcZNPmfYjPFyiwYPg+jku3E4Ztkj5Dad:tI0WfqYjNyiW+vxZ6jcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089717, "uuid": "15282265-8769-407a-aeac-e7849cdb717c", "value": 4668808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089717, "uuid": "3ecf9f1d-bd38-4a0d-be84-634efcd3bf5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089717, "uuid": "6834b11c-45e3-4536-86e0-d4a024e7b64c", "value": "telegram74567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e26495-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089188, "uuid": "949b3557-d6e0-453d-a107-b3abeeb07334", "comment": "Malware payload", "value": "822998970219f1374df4e34f609e1620", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089188, "uuid": "6acb79b6-e181-4a10-bd1a-2bc12dfdbf3b", "comment": "Malware payload", "value": "d163b94088173bed10583e7faaa1213414dc07bc191560258eec01752edb87f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089188, "uuid": "88eeb00d-008e-4be4-83b4-1319b4759317", "comment": "Malware payload", "value": "7fba79281c95a88488eabe56289fc02fccf0032f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089188, "uuid": "abee234f-b494-418c-b995-8ed4425a551c", "comment": "Malware payload", "value": "5a45f9bf658925e62fcd6370ec1a109a02594f9957307c5bbce24237fef0f1859d033f33ffafc8c32b5b6ac6c9e1906d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089188, "uuid": "b11ac45f-4e0e-4ea7-82b9-3052e4b3f7bf", "value": "T1F4452303E3F88471ECB827B064FB83D3163A3D916E68436B668A5D855CB27C0563776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089188, "uuid": "f705b3b3-89c3-43bf-b623-bb87fdf7219c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089188, "uuid": "a5d55251-4b4a-4807-a1a6-6e53d2d7a1ad", "value": "24576:FyCTx5YPNE1Bjh84k7b/bJ9bIuUwVtcCe4HT3te8yfMQ8Ye5B+p90fvQr:g2xSFCB67bTfIULcCdzteTfFhe5B+p9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089188, "uuid": "af5bceb6-2f98-4c7e-b4df-3a1de95ebd56", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089188, "uuid": "5ea6122c-fc28-4e67-abf3-28943710c8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089188, "uuid": "dbb2c317-dd7f-4c79-8e91-a269f820b06b", "value": "d163b94088173bed10583e7faaa1213414dc07bc191560258eec01752edb87f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70c3057-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089190, "uuid": "ad069ede-1886-4cdc-b1bd-e5a1dd2d2256", "comment": "Malware payload", "value": "7b4334d2e1200c95b604aabb59bf0753", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089190, "uuid": "dcf84083-0e5d-4f54-9340-24e4bbc551f3", "comment": "Malware payload", "value": "d189e78e425b8e174dae2982f2d7c6ca7cc1009823e0250c52bd3d2e6011943a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089190, "uuid": "f4e94e2f-437c-4b34-a7f9-c6e10fa1280b", "comment": "Malware payload", "value": "4a431a81567a1cc47079bf338823855cdee8016b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089190, "uuid": "7a9805ae-3a92-4994-9ada-c5e8e5a800a3", "comment": "Malware payload", "value": "41803b289565026f51c3c9ed94eb8b17edf0cbff72b690fb5bf0365831d788a2646340cf7d546be737acca3f2937307c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089190, "uuid": "14c83f20-986b-419b-807f-47a2c2eeec7d", "value": "T194452307AFD89576C8B55BF0B8FB178345323CF649B88227631579A31CB25C092727AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089190, "uuid": "5c386384-4489-455b-bd46-fb8a47ab6a01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089190, "uuid": "8935907c-c4ce-48e3-aa0a-4f76029d4960", "value": "24576:PyIwCLqbDpxj6KtZ88K98o02DdTxQUpwOaH6pBy:ahC+XpxjvO93bJxtKH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089190, "uuid": "cf1c12bd-11f9-49e8-8775-4f2c3971b8ea", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089190, "uuid": "8b039018-b9cb-401e-81a3-cf5d5c331085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089190, "uuid": "f1c3308a-7e71-444d-895d-5372a2c0bf24", "value": "d189e78e425b8e174dae2982f2d7c6ca7cc1009823e0250c52bd3d2e6011943a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4431d06d-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089829, "uuid": "ac701d5a-d0d3-4619-8a79-895840da83e8", "comment": "Malware payload", "value": "d03d49829d77d843e998bda3bccc1955", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089829, "uuid": "2b3f53f6-7415-450d-a467-1f4711678ffe", "comment": "Malware payload", "value": "d1c11448b082b7888e169ff9c60649811da4d6cf27c369cf957924143164d3e6", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089829, "uuid": "a4ae229e-82af-43e7-81b7-0f13cdd3a264", "comment": "Malware payload", "value": "715912262cdf71a41ef81897131de60b034db07c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089829, "uuid": "6a2018e7-341e-4ac9-811e-6e374e19edca", "comment": "Malware payload", "value": "a2a000a120415c0a59fe75e17891198e457d5b452af0094e5425141025f56d70aa7986eb79b87d000aa0ddc85c41a386", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089829, "uuid": "1e53e1fb-b72f-44b9-9303-7c9624a7a932", "value": "T1F3049D13F2664309D1F6D7748AE30291A171BE70BB24C20F6E5B7F6D56763B09A183CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089829, "uuid": "cf08c04e-19f1-4f3f-aee7-e5f9940ddbd6", "value": "3072:TvRaI2xpj77vRaI2xpj7qvRaI2xpj7xvRaI2xpj7gvRaI2xpj7Dslu1562DK+UhN:TvR9+BnvR9+B2vR9+BtvR9+B0vR9+BcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089829, "uuid": "5c9ec34d-0306-4089-b62a-5d0b38dedc19", "value": 183358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089829, "uuid": "ead30c83-bc7a-4858-b909-c2b1202b6a93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089829, "uuid": "72b98050-fd09-456e-8a0e-5d453596680c", "value": "yumm.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86664e9-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089192, "uuid": "6e45775b-a027-43ed-a8d4-7ce9dc29c4f6", "comment": "Malware payload", "value": "df34b877bb3e0bfa5014374e2d946339", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089192, "uuid": "bffd725c-a6bc-4b5f-9035-3fafa85ed901", "comment": "Malware payload", "value": "d1d0f16a62ef41e98a1dc2c65953c623a01e5e12ee7a6bdbed8a1ad25e188c64", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089192, "uuid": "cbd6e31b-79da-40bd-8d81-cbbf1634f9a5", "comment": "Malware payload", "value": "b674c881026830fe4f0f591708679867d479b217", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089192, "uuid": "3ab858b5-9af4-4122-a44c-b92c90a5ab24", "comment": "Malware payload", "value": "7e951a834a9ef47062a912c86f1e733b91146f58a7369011d1d97a41bf9d4d1a42b91b337bd50ab3ef1862f431e9c90a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089192, "uuid": "1bd62dba-5df8-4098-917a-9e33f9e10bb0", "value": "T1284523029BD881B2DAB867705CF207C30A3A7C609E79675D73A5A9590C73381B93737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089192, "uuid": "e95f94e8-85ae-43ef-95f8-960e13d3780b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089192, "uuid": "4ee0aafa-cc04-46f4-88e5-9a1eb79b3a47", "value": "24576:byFVNTuPSY+o5wD9wbwmDGAlPycA5d/QaE5H3CCvryE8+uUZ5j:OFPuso5UAwZAlPDM52zz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089192, "uuid": "a3276caa-a7c8-4847-bd37-ac79ac55ceca", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089192, "uuid": "a92a81f8-0fbe-4f8e-8e7d-89821da76c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089192, "uuid": "1a20da99-b024-4de6-aa30-bb23b2d43b37", "value": "d1d0f16a62ef41e98a1dc2c65953c623a01e5e12ee7a6bdbed8a1ad25e188c64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9183c56-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089193, "uuid": "fe6dfdf5-992c-40a6-80da-261960fcd056", "comment": "Malware payload", "value": "adc6e9dcf5b4360fc9856f7c05112d85", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089193, "uuid": "5e43d420-e909-4fbd-9361-a6c98df5ccd0", "comment": "Malware payload", "value": "d1db5ab7441024abb40edb9a8bfc70eefadd8a7c8cc8dc31b7af5080e5e3c770", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089193, "uuid": "3cd17dea-8b5c-440f-becb-8b0a09215ae1", "comment": "Malware payload", "value": "ac66893a9b1f77b1aeea1fd70b255713b1da1b3e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089193, "uuid": "fa14c132-d476-4043-8a01-ba2fa6941399", "comment": "Malware payload", "value": "69735c700ba04f6bc36b7632d6498998e00f525f96063467338bedb67d2534245cdb4fd632f1b8198fc8936bdae12bd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089193, "uuid": "1e1514bb-f33f-45d3-9421-3e8de77720fb", "value": "T10A452307A3D0D031D0B73BB098F607C32B397DA2AD74C65B3705EA661DB26806676779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089193, "uuid": "bb5a9c56-5f78-4c4e-9d07-4cd4f71487a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089193, "uuid": "1346c563-59cf-4524-993a-e26d8a45ef3a", "value": "24576:NyTl2Ore3g7efb5pUyMRV4VETyj8DXT5Ir3BZ2dAZ:olrSg7ez5mVc+yj8TT5ocA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089193, "uuid": "1470869d-3f89-478b-9a57-a043861b2583", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089193, "uuid": "a7b9724e-2e64-427c-a3db-00c278bdddac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089193, "uuid": "da951e36-6039-4d39-9230-7f0d076c954e", "value": "d1db5ab7441024abb40edb9a8bfc70eefadd8a7c8cc8dc31b7af5080e5e3c770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2403fd-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089195, "uuid": "fc47f43d-5bee-48e8-b355-9f39e1894be4", "comment": "Malware payload", "value": "4ba33ae76ea957d8ba1f5305f19d699e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089195, "uuid": "4fc5076b-ea6a-4e6a-889c-355aefbfeb43", "comment": "Malware payload", "value": "d1e0b6ef31d08705ebc0beca7afdda064a188817f7baedebf1073bca6cfa1dc9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089195, "uuid": "3c55c405-e6d9-4ead-9aa0-75aefdc60505", "comment": "Malware payload", "value": "2b1f32d058e7c4fb3daa02d2cf5324ccdac353f3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089195, "uuid": "4cd4c101-3b85-4f48-8286-6d40a2e025ac", "comment": "Malware payload", "value": "2fe4f47be8b4eaf84876ab352b9515e97e2163a1712b105c331054804b58af09390c521e6851ee9838e033eac8c53cbe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089195, "uuid": "a8ca597b-ef78-4afb-b123-85cbb3690a3a", "value": "T1DA452343A7D481B2E8F51BB05CFA078317397DE19D3DA27E23A66C1D0DB19D8A47072A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089195, "uuid": "359aa9b2-f904-467e-89e4-19e04a947cee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089195, "uuid": "1a3453fd-59e7-484a-96df-aef38d05d3f9", "value": "24576:By7GgBRLRRMEkPPP22a5o6uGo0Ve7O2/mopAzlnpn4vbY3:0JBlROEkPn2z5WGo0VYeBnmvbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089195, "uuid": "a5adc666-f897-48d1-8cec-c875b8b7a757", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089195, "uuid": "1e8d17cc-4af3-4769-8477-a54c3088facf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089195, "uuid": "2643a6fa-c42e-4eb6-8905-50f7cea368a3", "value": "d1e0b6ef31d08705ebc0beca7afdda064a188817f7baedebf1073bca6cfa1dc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caccdd65-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089196, "uuid": "97ae3f26-bfcf-4325-bc4d-a6a160394d99", "comment": "Malware payload", "value": "600763c3149f7050f72c2755df9391e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089196, "uuid": "e35d2e2a-6cdb-402e-86b9-70b3ecb5b29f", "comment": "Malware payload", "value": "d1e909941c1c78b3fb82bf5cecff32319454205cc8c56e13600ab0cf9ad95998", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089196, "uuid": "7cae212e-9985-49ab-83aa-91a06630f2e1", "comment": "Malware payload", "value": "94d39d28a2d1853ca315231638572c923f5c0aef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089196, "uuid": "30cfe21c-ecd5-419f-a9f3-49e5087cb1bb", "comment": "Malware payload", "value": "4d198d1edf7cdb10f2fedacbd7515eb394f002cdfe03292fb7e994db68bee81d04912a9709e01bc1c24c0516134d397d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089196, "uuid": "d0760ddb-c74a-4daa-9c26-4fdb3f71083f", "value": "T1B945238755E84121EEF55770CCF603970A31BDA6EAB447273345AC8A2C727D2E4B2B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089196, "uuid": "ab9ff88e-0749-4149-a167-3570f8f94f44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089196, "uuid": "dee31f9d-8370-45f6-a624-a9a8a371a0d4", "value": "24576:Wyrnhm5V+etwC+MKKbziGvPltJaZj+wPp:lrhq+etJpbziGvP7syG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089196, "uuid": "2113c4c3-f22a-454c-9676-d0116c297736", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089196, "uuid": "b048340b-a57c-4521-aa84-1a815269fce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089196, "uuid": "f207d1c6-d66e-4eeb-b357-ddaf664168d1", "value": "d1e909941c1c78b3fb82bf5cecff32319454205cc8c56e13600ab0cf9ad95998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8fa0bb-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089197, "uuid": "5ff68873-9633-4c06-8a27-f2704e5bc7c3", "comment": "Malware payload", "value": "8fbdcf28191b92db1af2f3640eb55ca6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089197, "uuid": "4f198b62-6fe4-4625-9a9d-d199496a31aa", "comment": "Malware payload", "value": "d1ec7ba9fe81cdcd497fd6ee39c65b58f8108c146068a87d27e5acc9b763ff63", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089197, "uuid": "fda259f4-e4c0-48f7-9c92-48b662e21c17", "comment": "Malware payload", "value": "4548fac7b960f08c9b54f7eb6ea11518277afe9a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089197, "uuid": "1f83bec0-1bd2-4a61-92e3-6ee8d3d6d034", "comment": "Malware payload", "value": "aae05e1cbde7fa73577c36bfc66ffca67dc46707e750fda78b9d966aa85cab39115cb150f6d1b7af3a6d0c02e4388072", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089197, "uuid": "8211906d-89a7-4d3c-9e98-3d403074ea72", "value": "T16A452326EAE96072E8396B718CF703A30535FCA15C7883835796D8C72873959E53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089197, "uuid": "66437bbb-5e57-43eb-8756-c65592fb655e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089197, "uuid": "4d72614a-eb22-4594-9aa9-71ba9763a790", "value": "24576:xy9wb3oeMibXiThHzQOv2Xc8WKClXtWxn1UUojr6XBx2iP07PGUiChIi:k9YY7ibS1HzQLcBJxE1UUoXjRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089197, "uuid": "34e435d0-56d6-400a-988e-562b0786acd9", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089197, "uuid": "2c5c3744-6a30-4d94-b714-ca618935d1f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089197, "uuid": "e45fdadd-cbe9-491d-9b4b-8fa23c482cb7", "value": "d1ec7ba9fe81cdcd497fd6ee39c65b58f8108c146068a87d27e5acc9b763ff63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd70fc8f-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089200, "uuid": "78b35b62-bfea-4569-b6cd-d02a41968604", "comment": "Malware payload", "value": "07d2ce370817a8f585099719090565d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089200, "uuid": "26a203a6-74d9-4e0d-a980-a3decf921234", "comment": "Malware payload", "value": "d2522986699fb8bb8d323e3ae4dbb66ad4dec49d95c4995cf925df34bd577135", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089200, "uuid": "8cb517a5-431c-475d-a59c-524974b10453", "comment": "Malware payload", "value": "97f98102c204e940cda838d73062502aed61a7c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089200, "uuid": "5d859d05-bedd-4c12-a332-941a9360b7d7", "comment": "Malware payload", "value": "79b063148a9f944c2bed9e4d64143e545c712423dc39e94fc6464e90dd261c7a0ed24e611c6af5b0e5d2d5700c5b3a48", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089200, "uuid": "86183314-0258-422a-a1d3-1a5359da2028", "value": "T1BC452306DAD09463C9B52738D8FB13B30B38FD669D7886BA32866D6F1C31A80557137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089200, "uuid": "5687ae7c-9ad3-4e8c-b1c1-b5057eca5815", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089200, "uuid": "454e7867-3777-4db5-a3af-eff6e75c293b", "value": "24576:6yH5RPY1RdDdk6jm3YClSXV3PYzV26nBB:BZG1RRdk6u+V3X6nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089200, "uuid": "0aea064c-9fc5-4578-a460-a703d52e2ad5", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089200, "uuid": "f3d82fd3-2d19-46cf-9274-a589b68ad239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089200, "uuid": "9002a54a-f53e-48ae-b446-e58fa277af31", "value": "d2522986699fb8bb8d323e3ae4dbb66ad4dec49d95c4995cf925df34bd577135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83d62ac-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684058295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058295, "uuid": "4c3d8657-6dc7-4502-9bd8-36634e471b53", "comment": "Malware payload (SnakeKeylogger)", "value": "915aa3d78cab8eb6920c2cf8ab39e6a1", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058295, "uuid": "6135f8ef-d5e2-46b2-93fe-478733e92961", "comment": "Malware payload (SnakeKeylogger)", "value": "d253e991b0afb6b3e9cfaf8dce2e56c93e6ac838ce8f4a6c1c0b4752527009c6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058295, "uuid": "0ecb8ad2-bb10-4dab-8e1b-ea5856040dd0", "comment": "Malware payload (SnakeKeylogger)", "value": "f4dc2ac541b600883e4648aafbc92f5e0b1811f0", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058295, "uuid": "ee203a6d-72e1-4080-8bc9-68024fe78ce2", "comment": "Malware payload (SnakeKeylogger)", "value": "a2f5d4b17b0cce08324089ba6f7204edad71909c2ad5993fe56f88a8b02846afa7bbd1d2407660323238d13553eda99e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058295, "uuid": "738b6a31-67ab-4bab-8d0c-36926a214e67", "value": "T120D3191D2BF89800F5FF997305B16112C776BC42192ACE0D4AD2F5592A7DA90CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058295, "uuid": "4860cf5f-b9ea-4742-8da2-6e6fb6451501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058295, "uuid": "fb84e80b-e1e6-451a-bf68-eff71eea56ed", "value": "1536:KAgzEJRCRjTZ1ouJjuBYHj0I+vBUFrlYYLDkrwsDQau8IzR+MFF3lu5nab/UNxJn:KAgAEkoHj/LDdpSab8TJDtwBj26FbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058295, "uuid": "2e50e802-3ebb-4471-96a4-242b7986dfda", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058295, "uuid": "7625f962-aed1-4e14-9bfc-01ba12b1bea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058295, "uuid": "0830122a-96ab-4c6d-824d-1b0f78d2e439", "value": "d253e991b0afb6b3e9cfaf8dce2e56c93e6ac838ce8f4a6c1c0b4752527009c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce90af24-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089202, "uuid": "b568a546-f3fa-4e37-9e2d-420174c876dc", "comment": "Malware payload", "value": "5c51a19c54196bb266d70735afe651c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089202, "uuid": "cb75dc43-0208-4641-97b7-3d210a7d97fe", "comment": "Malware payload", "value": "d2588dacdad3a98e0860815d179a3b1a3db3f0eb2f6d8c96a1bbb72ad6746c52", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089202, "uuid": "88304f5a-9ba4-452a-8752-48ce9e67e1c7", "comment": "Malware payload", "value": "a2a4a327d1380aeba4cfe7926eec06d05d448881", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089202, "uuid": "06e3838e-1b03-4ebe-979a-6d60e2ef747c", "comment": "Malware payload", "value": "f418a33cdc5c9f58f8d013e81b86691a8700610d8edbcc1f294711fe2c6894d505c31775ae6af1298883c114b53f1155", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089202, "uuid": "5ea3f9c0-6c70-4a54-9657-571839d663d6", "value": "T1EA452393F3E56631EDF61B3008B511D30EB8BCA29D7D466B2746689F18B16962C3132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089202, "uuid": "243d57c5-6f10-4913-97cf-a4b1c7fcfcf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089202, "uuid": "75d0943a-a2fd-4e02-abab-bdd9da89445a", "value": "24576:oyjZs64DIXxjM9/2zlSRYmkErDTcRmjZMcX1j05:vj2RGYlsIRY08PcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089202, "uuid": "6cc01fc7-a8c2-4ae8-b0e4-86542ea3f18d", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089202, "uuid": "de4c0ed7-c5c7-49ba-803e-e5d5c83896b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089202, "uuid": "9ab11f03-f9c3-4e68-b899-85a44f75779a", "value": "d2588dacdad3a98e0860815d179a3b1a3db3f0eb2f6d8c96a1bbb72ad6746c52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8ceb82-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089204, "uuid": "2edc995e-1cd9-4459-9f0a-6beffc0cc3dc", "comment": "Malware payload", "value": "42093ba72773d813fc532591f056bcd9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089204, "uuid": "c0976fd1-6701-44f5-8483-e30b6380173c", "comment": "Malware payload", "value": "d25abd041dfcd0257874703b23fcb2a14970c8713420140c9837c863ee1a2f52", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089204, "uuid": "11c52d65-d27d-473b-bba1-a4d6915c2290", "comment": "Malware payload", "value": "8ea3f742a945967d23bb1cfb1b29058b73fa305b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089204, "uuid": "fa6b3316-7efc-4174-888d-60c986ff6bed", "comment": "Malware payload", "value": "8fef916de92623543bd2f3883aaca2addbd4a2195aca76615078a2b9eeaca247819c1612822a4b194668db499bce7bf2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089204, "uuid": "c9a26d15-1441-4b7e-b461-b2cbb85aafb0", "value": "T1F0452302E7E44123D9B02BB06CF757970B347CE194AC97DB6392A8965CB3AC4A27171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089204, "uuid": "468d0f44-851f-458c-9a31-cf596c45c45a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089204, "uuid": "51bec1d9-78fe-41bf-9bf1-4fe0c0eff353", "value": "24576:RysKk373kGhAS491b+atZsmmbU/vA2xi0j31hFT1j2ZAOLlPImu:EsKWUGhAS4DhtazU/J46T12Lld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089204, "uuid": "7ea292d2-6509-49b5-8a33-2236de1573e1", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089204, "uuid": "d39628c2-8228-4333-b301-7dea30eea98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089204, "uuid": "abd25610-33dc-47f9-8136-ef470cce4fcd", "value": "d25abd041dfcd0257874703b23fcb2a14970c8713420140c9837c863ee1a2f52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0948ad7-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089206, "uuid": "6fa6dd8e-1ab4-4467-aaba-c6abefc8bb4c", "comment": "Malware payload", "value": "ce24b3613fe644440104aea2c01df609", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089206, "uuid": "ec8bc329-f337-418a-b9f9-aa2c4c0ecfc3", "comment": "Malware payload", "value": "d2ab4d02cd30a0c4311ffda8d3df94ff77fe9881c9b6e5f5cb9a6731055f2fb7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089206, "uuid": "173ef286-7cc3-4069-9347-78691b218ebf", "comment": "Malware payload", "value": "3f21ab36809c076e9636eeec589f6c042dffb950", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089206, "uuid": "67016ee6-38ac-446c-a1ea-d871cd2195f0", "comment": "Malware payload", "value": "930ac672fa31b47e65fae4cef30925e1ec05c416c75f95c2d3d8413864c6d9663759c69699da3ca60dcb421586752650", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089206, "uuid": "7f30fd19-bfa9-4434-afcc-fc2fa9d50ff8", "value": "T169452317AAC4007BD8B617701CFB46D31A397C91CCE982AB6784B45F2CB2690D672777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089206, "uuid": "2f6ad0df-c039-4add-a3c5-27a975922bcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089206, "uuid": "0a89cda1-0f5b-49a7-b901-263ae973b302", "value": "24576:GyAROTAT/bfG7atUiML0fp5qL+8qVYN8SpkmBnaK5:VhATeaK70hAqVY5naK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089206, "uuid": "c13f739f-b9d4-488e-8c61-979fbbf1f23f", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089206, "uuid": "0722e1fe-93fc-43e2-8038-ee7902c567c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089206, "uuid": "be876e1a-4d24-40fd-8fc2-1e2566dfbfa0", "value": "d2ab4d02cd30a0c4311ffda8d3df94ff77fe9881c9b6e5f5cb9a6731055f2fb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12993e7-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089207, "uuid": "6b0f46ca-40b8-4dae-966c-93f08bcf9abb", "comment": "Malware payload", "value": "c2966ecbe2535989e772771d28eb2c81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089207, "uuid": "89d19b78-2c84-45ff-9722-11aa6f380bfd", "comment": "Malware payload", "value": "d2af2fdec16fdbcf55fb83320964a4fd56ab695742e40a9863b9a8edcf78a064", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089207, "uuid": "db9cf8dd-0b99-42b3-bd52-c79fd18cf390", "comment": "Malware payload", "value": "d1c7a85f34f0b42e22dd4150f69648df96c6a392", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089207, "uuid": "d40a63fe-47ad-46a3-93b6-4daed3165bed", "comment": "Malware payload", "value": "4ac9c55253ff8a53a129594a2aadfdbab6803f076ad8a9c51d5b2f3dd872509df1e80db381e4dd0e9257b1f1062b3911", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089207, "uuid": "c0f7fffe-610c-48f4-b26e-5803c8751aff", "value": "T1C01512177BED8022DAB51770C8F727430E757CA18DB957977B55AA2908B29C0A0323BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089207, "uuid": "914fd5f8-06cb-4701-980a-195728c5663d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089207, "uuid": "1c25041c-b63b-4235-8560-c983c7bb0ead", "value": "24576:kyEC9grADblTJU4MdF6vOqVuul1cytG8mbk:z/9grADbQ4MaOmRTck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089207, "uuid": "87e7a903-9c8d-4802-8d3e-d91e3ddd970b", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089207, "uuid": "70293180-f6d2-49ca-8c01-69d4c3e54f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089207, "uuid": "68190f04-00a0-4b5a-b7d6-e803ba5f72b0", "value": "d2af2fdec16fdbcf55fb83320964a4fd56ab695742e40a9863b9a8edcf78a064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fb9dcf-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058296, "uuid": "d75f3f8c-4c4f-4c3f-8c1e-dfe60fe5a39a", "comment": "Malware payload (IcedID)", "value": "092f1cfeda2080f206ef8112a5d53b46", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058296, "uuid": "da57e484-b1ae-4343-9edb-505c2deda9f2", "comment": "Malware payload (IcedID)", "value": "d2ebde255e9011d9abca126b7a5c2c694c5d1b869d299d3a7e284a19f517b361", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058296, "uuid": "32db654d-fe71-4148-ad6b-96fb0a3e88be", "comment": "Malware payload (IcedID)", "value": "55cc2735fd3f49321b95f1304b67bc4da15282a9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058296, "uuid": "f016809f-d9b7-4e84-8b52-269f7ed76a7b", "comment": "Malware payload (IcedID)", "value": "20ef7a686dbee5bb2ceb303b4f146b9b654628897182f6bd8a8ca48d1fa9352824abc127f9d12932f2e238f721504f73", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058296, "uuid": "06657084-cc7d-4aa6-816e-3ac1593adaf1", "value": "T1EFD4B006F3227C53D50BDB3789E45CA64FBFBD2D2725D70C0A4193323A5A6989C6236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058296, "uuid": "de7cd320-3deb-4333-9fc4-bcfaf25fe753", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058296, "uuid": "9c0b2776-94ac-4b19-98c1-35d6bcdf74f7", "value": "12288:nix8rbzWnPUT62WjbdCBRlSL6ppCCR5bf578XQnFya+F:nix8rvWnK62WVmF1ZeSsaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058296, "uuid": "7fbaf884-6130-49dc-8397-9915095c26f6", "value": 620640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058296, "uuid": "82084802-f436-4894-ba9c-9b6b52570e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058296, "uuid": "9eaa7458-df7f-4817-8eb6-c2ee69991676", "value": "d2ebde255e9011d9abca126b7a5c2c694c5d1b869d299d3a7e284a19f517b361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cdd4d7-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089209, "uuid": "be0b6e72-e221-4efb-bada-df9721e01218", "comment": "Malware payload", "value": "9c3fba7f059dd072113e28ac5da96761", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089209, "uuid": "f4a9c084-c1fc-4abd-aa8d-74018d0e2f0e", "comment": "Malware payload", "value": "d311eb9d9c1a5cae0fb541e297ff1ee130726502a7b970af6ffacea5a562ccf3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089209, "uuid": "725baa56-4c8a-4127-8ed4-1f4f4978f535", "comment": "Malware payload", "value": "c6e8004cc7d719c79a4db2cf5372cdf56f3764e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089209, "uuid": "ad876c41-1d8d-4749-ac20-095cc13d72d3", "comment": "Malware payload", "value": "9cd9c012a7332d886f7ee4471612fa67819d35885c207668f50a80b4fbb03bcb45251c916a06d9f2ac1fb80f9bcf313b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089209, "uuid": "9aa50cb8-0791-400f-b10e-a1a5ca3d625e", "value": "T15216231292F17D94E39D0E39DF2F92A4636DF2604E666BBB3208552F07744B2DA33316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089209, "uuid": "a47a6435-628b-4aab-809a-fddd4dc121fd", "value": "af3c9adce30911c91af932e082f4ec74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089209, "uuid": "398b9fbe-3f41-483a-9ab4-d0d50a7b56a7", "value": "98304:jsww23FFxrNDHY84ghEKDHe7MC2hgwwrNKXtr/i9waMnD:r1Fxr9HjhXDe7MC2h0rNctr6GaUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089209, "uuid": "b897b46c-b818-468b-bc9f-ce2d81146fb1", "value": 4383120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089209, "uuid": "6eddc312-e966-4d27-b0b9-c9bf1ad2331b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089209, "uuid": "f52b1ad9-c30c-43c4-87b2-0de98f2a3647", "value": "d311eb9d9c1a5cae0fb541e297ff1ee130726502a7b970af6ffacea5a562ccf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37c20e8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089211, "uuid": "211f55a0-c107-4866-a79b-31bd7379d248", "comment": "Malware payload", "value": "ec74cb0196b72bb4f0e9b4f0ca90c6d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089211, "uuid": "8c921cc5-8892-4527-a9f6-538e2979ccd9", "comment": "Malware payload", "value": "d3422cf0557acac8927418a37e64881da4adf21a948f372135d728305f25fcf5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089211, "uuid": "522487c8-b33d-43e8-bb8b-4adf796c17ca", "comment": "Malware payload", "value": "54928ab2a5eaf181ba3042cf635688a5ac22060f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089211, "uuid": "1c3a70ad-19b9-4961-88d2-a537981c0fdb", "comment": "Malware payload", "value": "ac36f8e2c667fa8dfc7f4fb85f5175126fddef4809cafa08bab22ac134263ad228a2e9aa43826b461e6c3583b6e84c3b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089211, "uuid": "06931894-581d-49d7-85f4-e7eec9193f41", "value": "T187452317F7E85476D8B1577068F793832B32BCA96D38821637446A4B1CB2B9025F0B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089211, "uuid": "872b5a74-10dc-4027-8486-367079521156", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089211, "uuid": "83084cf6-3bd0-4303-97ac-b2eee7241c9f", "value": "24576:bygcPwqOlBUV8gthe6Yz/skIRKMA5Nbv0NQ6Qm5E+DMe:OnwqOlBU1tQdz//IBA/0Of+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089211, "uuid": "843f8814-6147-42fb-ba72-16f4bd6a160a", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089211, "uuid": "2e0d9006-b001-4a14-a307-118321d3f0e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089211, "uuid": "93a4edf2-157c-453b-a8a5-0bfa8346b137", "value": "d3422cf0557acac8927418a37e64881da4adf21a948f372135d728305f25fcf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d438c993-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089212, "uuid": "c2020a23-5de2-46ae-9175-84e23b3001bb", "comment": "Malware payload", "value": "0aa210e353aba33d9e59eaf8fe5e9871", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089212, "uuid": "0b1cee30-8dbc-44b9-8460-13e706364323", "comment": "Malware payload", "value": "d36b8b4fe6fd11507afc46c9c098e350520ff636cd94afd20f968846344b8021", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089212, "uuid": "e465e213-2e44-49cc-87ef-962ed22fa467", "comment": "Malware payload", "value": "aaf535981cec160d8cc4a02086278beaf69e26d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089212, "uuid": "b8376ffc-fb5d-4e84-8a3f-a7de110422dc", "comment": "Malware payload", "value": "defb92c2fd2c099720f6b77ace8c45c7d675ca3cc75122c5ce7628da43a202307ba6b2a32d8c4d08f0a1436814dbc9f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089212, "uuid": "6d087a3a-d80c-429c-8953-da37bde7b29c", "value": "T19B452306EAF88433DDB81BF0ADF616C30B75BCA26C35414B2A45954A0E32BA5797037F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089212, "uuid": "44dc81d1-80dd-40cb-8d19-991403763acf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089212, "uuid": "8452e264-8dcc-448c-a9cb-468c85a92fe3", "value": "24576:iyiCDAOzJ/EYD2Rs79efVmdmgnHWhWAsLUTESxLUyBwNN8GwvHti6GWo+H3FWYu:J5DUYD2C7iVpYAsLUTrU1QGwvHRi+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089212, "uuid": "2e17470f-5154-44a8-b2fd-b8d7c852e93c", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089212, "uuid": "d7259dce-cc5d-4ab4-9357-c965611bc949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089212, "uuid": "69f5d9a1-8c2c-4c2d-ad64-a8437e341c59", "value": "d36b8b4fe6fd11507afc46c9c098e350520ff636cd94afd20f968846344b8021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b55773-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684058297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058297, "uuid": "8869b894-7520-4e7b-bb73-000e90a2cb7d", "comment": "Malware payload (RemcosRAT)", "value": "d8db030fa049a580074be5eaf8376dda", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058297, "uuid": "5487cfb9-9a47-4586-841e-6bce3c88cf68", "comment": "Malware payload (RemcosRAT)", "value": "d3b65364294db215de9055446d7b2b7e5189ac195b5e66eaf88e1bf91ce8a4e0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058297, "uuid": "7a264152-dd53-4b12-ba58-847b49d0942b", "comment": "Malware payload (RemcosRAT)", "value": "5357d529af0c5811a530a8b55fc25bee7485976f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058297, "uuid": "ac4188a3-d1e6-46d0-979d-1e4c22be9181", "comment": "Malware payload (RemcosRAT)", "value": "f08bf2001fdcbe4b6d173ab7aac33e367bd2eee9432f13add1a505c8d96925a83b69e61c5c355b97f709067ea3e284fc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058297, "uuid": "e73440eb-abaa-401f-9dd8-f8ce710814ba", "value": "T13B25CF621A624BD6D9B90D60077879841678AF83D710633E7C83BD3F4CFAB8B54993D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058297, "uuid": "b421f8a1-e73b-4c36-a787-dacc87b43434", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058297, "uuid": "c4e9c468-2828-458f-9222-682bec6a8a08", "value": "24576:2KEGQ5OOat9cU8N+UbiubYbyZr4KT/9n9+FbC9Lro8mCFe6Obxb804aemnase4FH:mat58MUbrzZr4MiFmR7mCFe6jynLeevf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058297, "uuid": "ba6ecf21-dc11-4c3f-a410-335d91af2ef0", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058297, "uuid": "05757130-1373-4399-b747-4607251df5c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058297, "uuid": "e0f29278-4866-4f1a-9538-7406a0d13c6a", "value": "d3b65364294db215de9055446d7b2b7e5189ac195b5e66eaf88e1bf91ce8a4e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f95068-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089213, "uuid": "798336c1-b555-4f88-83b9-1521216b846a", "comment": "Malware payload", "value": "550dd55ab8844be8e6f85afdbb39e1a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089213, "uuid": "66e2c166-acd2-4e50-b80f-12e8e6695081", "comment": "Malware payload", "value": "d3c7805bb7ea281f396339fe84e989b2d53171ef009f9b1752e19feef9c1d47e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089213, "uuid": "0647a7bf-a556-4fbd-86b4-b91aed3c1819", "comment": "Malware payload", "value": "8ecc3da0c038b8a5e2125448d81f1e517f847a33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089213, "uuid": "cb94ab38-f9f7-4c5f-9060-87c863918ef1", "comment": "Malware payload", "value": "5d72b69ba0c05860ad174102233e91b7a62e70e304ca3d11a934a73652d28b9f3d8602e8b6a3aa7ca55e2db5caf594e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089213, "uuid": "39884c1c-6932-4125-a993-026df0041d1d", "value": "T1D1152302A6ECE475FDB607B068F327830F7D7C726C385A4B3351799A48B2251A53936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089213, "uuid": "82cca5b0-7f2f-4d69-a977-eea8ec3fff96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089213, "uuid": "870aa573-4c94-40e1-98b3-8b209d405aac", "value": "24576:DyRE+TGnTR5MU9E+oQFro3Mxr4HS5IQhe:WREXTXMIE+Fro8Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089213, "uuid": "9ab42c14-1f29-4c18-9b21-0d2057ed4f07", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089213, "uuid": "8b28e34c-29ec-4590-a16c-fb39074977a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089213, "uuid": "4b60eeb9-e90f-4f7a-8f25-fa5b78b214b8", "value": "d3c7805bb7ea281f396339fe84e989b2d53171ef009f9b1752e19feef9c1d47e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66e92b2-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089216, "uuid": "ae867e3d-0900-4502-8a7f-6bddd0eb9754", "comment": "Malware payload", "value": "a72e548630cd6ea9cb17e41b546f0c3f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089216, "uuid": "fa7e7c17-a571-4011-b23f-e57e8c35ee29", "comment": "Malware payload", "value": "d3dbbfb1c3b3f7c253db6162e085b2bfd104ef175c582ec0a5b787d02351e676", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089216, "uuid": "2de08d6f-3d29-4019-b968-ab4392bd278f", "comment": "Malware payload", "value": "175cf16082a8cc59940cf65b70f98b1240dd2f81", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089216, "uuid": "372c9c6f-51f3-4d45-8b40-2105b60febd6", "comment": "Malware payload", "value": "8667089644b675256474a162ed20012654fb461109db5ad02a57e81bdb18e997c47bb779f0c185045b0071d7d31caedf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089216, "uuid": "bcbc2bbf-2eae-40b5-82ba-99761725d614", "value": "T12C45235276EC50B2E57A9F7068F602231E3ABD931D38737F2B229C4608B11A4AD35777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089216, "uuid": "0086651f-5a3f-4540-91f9-27248d8d61ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089216, "uuid": "8bb02931-6428-4c01-bc79-592048c5a921", "value": "24576:Ey7YeGjd7dLED8lzduRTkmkosA5Wl0cbCnCnmLwbq:TvGjd79EDmPmkosmeHbCnCmLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089216, "uuid": "850e84ad-44b3-4bdb-bb7d-9f14853ab598", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089216, "uuid": "5f332fac-2a3b-4e08-b6af-213e3e5042eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089216, "uuid": "120b1f96-5a02-4818-b04e-f294bedf7c1a", "value": "d3dbbfb1c3b3f7c253db6162e085b2bfd104ef175c582ec0a5b787d02351e676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d798a9d4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089218, "uuid": "d243cbec-df41-41e7-80fa-4d7ca91eaa21", "comment": "Malware payload", "value": "08e8c0474ff312ca3a4ae1e7b8579b2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089218, "uuid": "a0a52353-1efa-40c0-b080-0b2aab88fc59", "comment": "Malware payload", "value": "d3dc31aca1428024f198b36456d39c7161479dab6d8d0c94316561110635d0e8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089218, "uuid": "f8e60248-3f5c-4cf4-ae5b-d5832b8257c3", "comment": "Malware payload", "value": "98905ed3360de3f1e6597ecfa6a8ba0ea38354cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089218, "uuid": "71452c47-a07b-4277-b381-5eaea3d24fc6", "comment": "Malware payload", "value": "d183f5763a8c01b77f7d2b77c59a6fa8b6d74d4a1478725daf418b2725ecfb7f24a82b584a107e73130e7582c78e166e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089218, "uuid": "78550815-82fd-4200-9dd1-04c48961590e", "value": "T1F145231237E45272F5B41BB188FA01E71F357D820D6CA71E3B559E0A28769C86B70B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089218, "uuid": "ea0c4bfa-ad60-450d-bb1c-d9286a1d46f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089218, "uuid": "a8280b75-98c8-4351-9999-7a3eeb12e3fe", "value": "24576:syBQzjGQosUTMMd2PQoPfj9iLD6eSJPv4WvlTXewmiwHUzINa:bBeWEYonj9QD6eSJPgWwHUzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089218, "uuid": "53e8460d-4b15-41e5-9131-bc9215162313", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089218, "uuid": "023dfea7-50a3-4974-917d-25ebc74e13cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089218, "uuid": "adb1ec87-6f77-4479-9e74-56daa70dac46", "value": "d3dc31aca1428024f198b36456d39c7161479dab6d8d0c94316561110635d0e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b6a023-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089139, "uuid": "629d40b6-517a-445f-9dfd-5fc9aa15aacc", "comment": "Malware payload", "value": "cb7a5643b99e3df2bbb25b6abc13042c", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089139, "uuid": "ab93970d-96a2-4ddc-b3b9-26b47f444abf", "comment": "Malware payload", "value": "d43cc418d11be4589ef3cee075611e779d8719621fe52bae2b300555ab4c1ff4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089139, "uuid": "d6cffccc-eb16-47a6-a6b1-82901f6690aa", "comment": "Malware payload", "value": "f3736147f7d46c5d96f8ae9f89bfd1f694bb871a", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089139, "uuid": "3880ac20-9e02-474d-a336-b49fc366d4ed", "comment": "Malware payload", "value": "b5de2645860369f41ec8bb17ee930ae911eef04a6d885fdae21e5c99f3187869f9aa5934a897ec0124c3157cbfe0feb2", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089139, "uuid": "84f061d3-58f8-438b-8c13-beee46f37527", "value": "T1C65512617E014962E8B3CA788216C4C0824F3F96451AFE1B390D65857F6BC9A3753EBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089139, "uuid": "b82d1908-9779-4c4d-94d7-6d7ee8a354dc", "value": "24576:oU0Udfzkh0K4jHcV65jc2/1gXdZRDgMT4IKK8urIALpe6lo3p0eS6:oOsg17eXNDgMTYCIAYco3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089139, "uuid": "f3697cf7-8548-459b-9503-a4cdbad3ab55", "value": 1281695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089139, "uuid": "7d7fd090-77c5-4bce-9f0e-ba7bc883f1eb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089139, "uuid": "8006a3ba-ef3c-49b2-9af7-c780bd45a762", "value": "CB7A5643B99E3DF2BBB25B6ABC13042C.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d942e010-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089220, "uuid": "e2db4e06-0eb7-4fea-bf49-ce2952272e07", "comment": "Malware payload", "value": "0598c0ec7ab6b50b9690793ff9f68bc0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089220, "uuid": "13152187-6a59-42b4-9cc4-fed126ccf4fe", "comment": "Malware payload", "value": "d4436133c3d04f4854a2742479b5032f8f0eec75eb42fa6d0397efbc4ff52981", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089220, "uuid": "7be1f941-a834-44bd-b3a4-a946e8cff8bf", "comment": "Malware payload", "value": "780383c1bd1437dc9b42e05ad5bfcd92883a47d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089220, "uuid": "b3dc800f-f151-4bb5-abf9-b49e9b562670", "comment": "Malware payload", "value": "fddaf7a19361a4af6300939e9879f49579bd2ba5d330d3def61dbb7aaa8e02bd51e8862dccee72c32265d0cfe27c13d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089220, "uuid": "f1912317-eb32-4b8d-aed8-2f1f7e1c55a9", "value": "T1AD452303A3D19432DDF96FB028F121C31A3AFC959570977EA611AD962C71BD0A23276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089220, "uuid": "20930381-d8fe-4265-8e0f-b18bbc7ee464", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089220, "uuid": "0794c0b3-caba-479e-bd2a-cc3fc31612d4", "value": "24576:myJergjLWiudh9HbULkkZC3BNjjaX4ptVU8C/0MRwQPZKtn34TpYL:1Lj89HoLbM3BNjjsK1RMRwiZG3+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089220, "uuid": "e37b837f-1bd3-4cda-ba91-19a180679953", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089220, "uuid": "22868194-6a08-4e4e-8cbc-cfa7667a20eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089220, "uuid": "c58fe88c-d295-4317-96fb-a5477e3382a3", "value": "d4436133c3d04f4854a2742479b5032f8f0eec75eb42fa6d0397efbc4ff52981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae2109f-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089223, "uuid": "6c5f312d-71a9-4e50-b1d9-faa61eb3a182", "comment": "Malware payload", "value": "27a353e333108aeb5732987946d11fe9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089223, "uuid": "5d0683d4-ba42-48f3-81b4-f90a19b9a573", "comment": "Malware payload", "value": "d45005d4fbcab052e0008090a0b53e9623cac2c8777a678a14bd5593cef2c1d4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089223, "uuid": "8254b7a9-1d76-4858-8b8f-0142268fd27a", "comment": "Malware payload", "value": "4e36e39fbb78b426e9ee9fb754c77cc7cc33ba73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089223, "uuid": "cee2ce23-e78c-46ec-b3dd-9adb609b29d3", "comment": "Malware payload", "value": "887a62f9f2323f11c35ccc31bee2f9337dc02f05904bb93d28dc38bb5a608cab2359b12bdb38019403366c6c134ff082", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089223, "uuid": "6a4b626d-30ae-4ec1-a315-185523bcf0a6", "value": "T1D2452303A7D58432D5F66B7048F342D70F31BC52AD388E5B2A65AC9A09F3AD49E31B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089223, "uuid": "8c324f07-1178-44b1-ac07-88092d3fccd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089223, "uuid": "30ffd567-60d6-465e-bae5-7401fc982bb2", "value": "24576:9ykWfibfC62Z3X/8wiyiCu6PM7VAMBjGV2gcH2DYOqd:Y9fcCN/8Mpu6wVAMkPpst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089223, "uuid": "fd346ff4-3f4c-4e33-b91d-e2d903b90ab6", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089223, "uuid": "5c2a510a-2ad6-456d-b8f2-fec083037997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089223, "uuid": "f9a4f1c4-fee3-4b0b-ab6d-5f4c95a951bc", "value": "d45005d4fbcab052e0008090a0b53e9623cac2c8777a678a14bd5593cef2c1d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe335f5-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089225, "uuid": "8921e799-fdd3-493d-b9b9-ccdb0d39378f", "comment": "Malware payload", "value": "7dcabb683e8dcca5676502558eb1edc4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089225, "uuid": "40fc6592-ad54-4c0d-a41e-efc29f37e56d", "comment": "Malware payload", "value": "d47a4dca956891c5e83821831b2cba309e627588098263f68ce7a2375cc86510", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089225, "uuid": "ad8a837b-9379-4f30-8ae8-7b549b58622b", "comment": "Malware payload", "value": "d4fabfbefecc671ff93d397d8a435737c6bb6bda", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089225, "uuid": "1be21a12-bf3e-455e-95ae-2137c8755753", "comment": "Malware payload", "value": "ab21340e684b74b18a96afefc599ddc23ccffd078fe0ab3e4c3dfda1a117ec70b1a3d27d9f19c34be1016a3ad9415a7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089225, "uuid": "34a47724-a02d-4f00-93aa-d825497da616", "value": "T14B55230797F95076D9A52B304CBA03D30A387CF29DB8D3A3279169C609F7784A6707A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089225, "uuid": "f1cf5e60-670a-4f73-9fd9-8e1f34ec2036", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089225, "uuid": "1bf0204c-8c5c-4a1e-8fc2-9d4f406d1954", "value": "24576:YyuBLw/maZ3umfhKJn0aPMYwbK6qcT0KLnghDo79QtHGZZJzSNskME07b:fuZQ1NumfCHkbOcxgZU9QtHGZZdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089225, "uuid": "a3720f7e-f8a0-4537-b0c6-11bf06c81cb1", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089225, "uuid": "e4a48828-26b5-49ea-b589-8694a585b197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089225, "uuid": "197b4340-9737-438a-97f5-c3ba2e7b91cd", "value": "d47a4dca956891c5e83821831b2cba309e627588098263f68ce7a2375cc86510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e749ed7c-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "43b908a7-67ea-45e0-aa6a-62492f867c7a", "comment": "Malware payload", "value": "539d2e1855763bc831a9b43e4c74389e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "d9dfce61-d19d-4a09-aecb-adb7a7ab4fc2", "comment": "Malware payload", "value": "d49575656bcb1525031dbd3886db26bda83e10ca7ebdc06e684a98c4804790c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "ff138723-354b-4405-97ab-0de155d3415c", "comment": "Malware payload", "value": "de450c8e71c297c3d118f34d8267ba245c4c7e0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089673, "uuid": "9cfa147a-6895-45e1-89d5-1015695b655f", "comment": "Malware payload", "value": "e5514d07345e8487752c50f6373b030ffcb57b5199ca76e56cc78950177a893ad0dcebd069e77347c20c5086c5992ae3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089673, "uuid": "538c1b99-d6ce-4ffb-ac2d-5cc92e93c4de", "value": "T1FAF32D2F25B06C46F5ED0738B0F5AB1647107123B9A61CCE2D10EA2CC7739E776AE664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089673, "uuid": "6612ddda-0e6e-4b8e-91e5-62eff2d3814c", "value": "4514c46259fb71fea289f87cc46a4112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089673, "uuid": "146ae770-b041-4c5b-8e4a-04119bdaac2a", "value": "1536:J1GMk3ZNB0ahCYsuut5bj4tt2AKy+7Kq7hkGXefJ2srsXvNKDqdOpdtKbUXf7ufX:Jwp3ZNuottY7exHr+dAtKb+TBOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089673, "uuid": "81c1124a-0d23-4283-b403-fe11f384101a", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089673, "uuid": "6835de5d-86cb-4273-ae2e-be85ea241c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089673, "uuid": "35e1f09a-300e-475b-8faa-8cb74d313370", "value": "Sharpv4x64xor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d570b0-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057355, "uuid": "1541eff6-561e-4f66-b1a4-81deaabe232c", "comment": "Malware payload (AgentTesla)", "value": "257b1e9b94f744f83a4df2a3f5e847b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057355, "uuid": "92c6c401-ff84-4f6e-ac8c-57e6b4d41cc8", "comment": "Malware payload (AgentTesla)", "value": "d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057355, "uuid": "9cf36106-4878-4e82-a346-ca23525a0206", "comment": "Malware payload (AgentTesla)", "value": "115cf76fb203ba72e1f9944eb15ced3484d92d06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057355, "uuid": "94ac2973-fb12-4978-8d7a-fa1ab0e24e2d", "comment": "Malware payload (AgentTesla)", "value": "e89203610b29da164dc3d591f1f27c1901ee9c36f5bc59fe25447969db62fd5e3d5106ab5cabddb1617d3899f4cc85fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057355, "uuid": "d5d44f9e-f6fe-4fb8-9a78-b3e4aa9a32a8", "value": "T1BCF4F16710AAC341E03F87B079A8FD64176731DBE9E7AE39132928C54E5AB113C9C19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057355, "uuid": "a6eb3d89-52c2-4e1d-bcc9-19f5d24c2f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057355, "uuid": "f6a5b99a-8ec7-45c2-ba99-02e1977deb84", "value": "12288:ebkcdXHwni4IyS+7VDtjQwlmg2Jsm8HLIADHS7PaPKmd5CWDNGNjoNr:ebJNwLHNuKmYUyzFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057355, "uuid": "5bd11456-fab8-49a7-bf01-0a98e45f7fe8", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057355, "uuid": "e397afca-8e8c-4825-b18e-ff8a72b970f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057355, "uuid": "028c7176-fe12-4a74-8021-bf3076ba1805", "value": "d4aacef823ff0e408cc83eabb90157bae1171f133b387e1e2ec389842676cb3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0e77e9-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089227, "uuid": "044e08aa-3777-4320-b7fb-98bf417cec40", "comment": "Malware payload", "value": "6132ddba3ca508546fce6a99fc976f09", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089227, "uuid": "186cbdd7-8cc4-44f3-a7f7-9b61d3fcc148", "comment": "Malware payload", "value": "d4d196df48d2d914dd297c964c0854fed7162eb5981fb99b3b23704e525a017e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089227, "uuid": "c9bebb99-4fc8-4281-992e-e51e76980d23", "comment": "Malware payload", "value": "674c531dfbbcc4bd52e56c7a7bdfaccb85bf2bd5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089227, "uuid": "ae68585b-7357-4d70-a20b-6e4bdae0d290", "comment": "Malware payload", "value": "6f8accd17c81493eaa113f7c7a8476db38d4b780f391ca06cdae2a6c31032190792eaffc3a755c14792f2050d8cf0297", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089227, "uuid": "bc5ad8fe-53ed-402e-892c-7c4ed24543ac", "value": "T1FE151203B7D92472CDF50B7050F50BD70A39BCA24E385B6F27956D8E1CB294899B872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089227, "uuid": "7a6b4ede-149f-4ee4-9ef4-e68136d20a70", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089227, "uuid": "b42782f9-7272-4ac3-8415-c94ae3f791ad", "value": "24576:cyLXjLS2++guJvHeSR88uKBYF2PRRGYlJ2iZF27N:LjjLSFVq/eSR8lqYF2rjr2l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089227, "uuid": "8fd016a3-324b-4619-a980-b43558459536", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089227, "uuid": "972afd72-3093-4608-9e21-dfa0ca081984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089227, "uuid": "5721693e-0365-40c8-855d-6dfa833c9cd7", "value": "d4d196df48d2d914dd297c964c0854fed7162eb5981fb99b3b23704e525a017e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de110a12-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089228, "uuid": "a5a0c4de-e376-419b-8181-914bd254b7f2", "comment": "Malware payload", "value": "a172f75b279bb6a6205efcc1989d3583", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089228, "uuid": "9b543987-01c1-410d-8600-ddcd473cb242", "comment": "Malware payload", "value": "d4d453fee7e609ba0f76f3a2ac1efc778dbc3fb1843f3c6934104793ead3ec66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089228, "uuid": "960a3784-5cfc-4003-ad86-7c19b3a9ddcb", "comment": "Malware payload", "value": "b8f9b058145f6c20d3e4c31e978347f4a2966823", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089228, "uuid": "da60e59b-0d10-4a06-8bdd-f46ef6173542", "comment": "Malware payload", "value": "1857eddfb30689fe7fa99c08f237c968870743e6d4a8713ba417f7680c3033dd5ccb79f645e32323a94cfa4369dc70d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089228, "uuid": "027f168a-1579-4481-b9ac-ce4de6c05a2a", "value": "T1ED452312B6E91877E9F52BB008EA06C30D35BCE159A4C70FA74D69DB5DF3180A93432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089228, "uuid": "ff9948fc-2795-4446-9386-735e8c55c463", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089228, "uuid": "9730a8d7-f31e-4207-b447-91dc5674f4c9", "value": "24576:zy4RQdHPoZQfVo1eSWn2e9uQAWFiFH/d+FozgGe61azhl:G4idHk/MSS2JFWFc2oEGetz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089228, "uuid": "2b8a6f04-ca13-44a7-9e12-096a63f044dd", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089228, "uuid": "b1676d05-613f-45be-85cb-14dcca6e9b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089228, "uuid": "9a5df21d-6bed-4ee0-9df5-41fc9f33e432", "value": "d4d453fee7e609ba0f76f3a2ac1efc778dbc3fb1843f3c6934104793ead3ec66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4018a3-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089230, "uuid": "ad92a8a2-c223-4db8-bf4c-18e565a19047", "comment": "Malware payload", "value": "09a7acba9e74b90cef8fb48077fd5396", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089230, "uuid": "42533f74-fdec-49b8-9890-0e6ebfac4a12", "comment": "Malware payload", "value": "d4dc7c680d5f51c46cf9e481bb985983751568bff4e7ce9dec1ad4367456862d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089230, "uuid": "1052702d-6865-479a-9847-0fb7df97989c", "comment": "Malware payload", "value": "e85b6eb2daad2f61139011f09099b9a021fee850", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089230, "uuid": "dea73396-8fd6-42b6-a404-746ccbca76f3", "comment": "Malware payload", "value": "04b3135a7b4c602e5f0362afdc38ad2570dc1f71cee42f4d88d6cc2aa4e3e07aadcfdfb068e3a1a828289597bfff271a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089230, "uuid": "f3a30b3a-fed2-4636-b2aa-94ac995c74e4", "value": "T1C7452346A3F59131D86637B1A4F603D30A36BCF15D788316A2056A4F6C73AC0F6BA71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089230, "uuid": "d0a26dbf-d6aa-4448-a91e-37faea42f996", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089230, "uuid": "0080dc81-33c6-4fa3-8717-3531ce8863fc", "value": "24576:Oyldwi07edqq+oiOOm+ajNa7c4jWBRQdVhCMDIU7eH:d67eUqBi8NjUvj6jRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089230, "uuid": "6a0dfc77-986c-42f4-8a00-61e57a35c7f6", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089230, "uuid": "92209588-e68c-4f32-acfb-04641888aaed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089230, "uuid": "23e31fad-3557-460b-bb18-377552e26ccf", "value": "d4dc7c680d5f51c46cf9e481bb985983751568bff4e7ce9dec1ad4367456862d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07d8cc1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089232, "uuid": "e9dd6d5e-5ef4-4a40-94e6-4a0a3b02e639", "comment": "Malware payload", "value": "adef140c5741efef917f957fe66a92f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089232, "uuid": "0f6dea48-2c26-43fe-8d49-eee6d230a325", "comment": "Malware payload", "value": "d4e8984139d173b84ee48092b0798b52101aab31fa9047bdfd1e511c4a6082bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089232, "uuid": "129a98a1-ef06-41e1-bda2-b5e5a767afba", "comment": "Malware payload", "value": "70fbe747924d69a4619fb3fe90c59b21dbe28c83", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089232, "uuid": "ddbe1af5-671f-4a8d-98b9-e4645e1eab29", "comment": "Malware payload", "value": "6b529f7f640ea1d3734b0d312a77be202ab3fd9d43b3316f0920ebd6f8646a507c96cf71ce1f02faa514846d1fd20919", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089232, "uuid": "e9389475-5e08-483e-8d04-dbbf6e8e3cd0", "value": "T1EF452342F9C41133D8B42BB01CF702930A397C159EA8D6AE3797EC195DB2984B97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089232, "uuid": "9e3c2953-af24-4969-be34-30c0cda2a345", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089232, "uuid": "8af512e6-0021-4f5b-9708-08647fe3f592", "value": "24576:Dy+SVVD7RRV9FtEpqQjK83t9uuYIO6Jr2Rn:W/Zz9fEpU2O6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089232, "uuid": "a9319a4b-ffcb-4b40-984d-bf09446788bf", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089232, "uuid": "d0cb8bf5-1e4d-47ed-829b-efc7044177a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089232, "uuid": "00ab9f33-4095-4ea3-be64-e0ba6547d7d6", "value": "d4e8984139d173b84ee48092b0798b52101aab31fa9047bdfd1e511c4a6082bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15a96cf-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089234, "uuid": "87644743-5133-455a-8eb2-c645de6c3413", "comment": "Malware payload", "value": "473acc6b951460775596ba3f03e13c04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089234, "uuid": "0e3dd50c-25d6-48df-afc2-d34f658536e2", "comment": "Malware payload", "value": "d4f7cf3a18686482f4f291c5a6fea4167e94a8bdaddd123a7998eff4c684c90b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089234, "uuid": "f11f9b92-20d2-4bd1-bb42-f835f9ce3295", "comment": "Malware payload", "value": "cd7615c5666660c1981e55a2f8be398671327b5f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089234, "uuid": "f97f2470-5bcb-4084-88a7-4ce4c25a5486", "comment": "Malware payload", "value": "e7f3453f08c1d82129f1a667ba906a6a19652ddadce4616480af287f1e8a3f2dc238dd91dff870ca137ca164d5bfd771", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089234, "uuid": "12f02f93-f249-4976-81c3-4a793f7b27d0", "value": "T152452346F6E4A132ECA82FF0A8F987C3093ABD631C34426667526D2A1D737C5B57431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089234, "uuid": "f9e25fad-c1ea-4606-b719-71bce9f61d5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089234, "uuid": "d589649f-fbc6-4d7a-8937-c62c6af12be7", "value": "24576:IySw/PGP7PsV9O3SU4lYxtBnZpjKJqz/jGX29ZOs8QaVzY9dOG3m:PSwGPLsVgiFlYxbEqTjskaVM2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089234, "uuid": "16e2a452-a607-4c3e-bfc3-55c705e29972", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089234, "uuid": "b76b2da7-c013-4c04-8c06-31b88118e459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089234, "uuid": "8909bee7-9228-4514-8f79-c3fe57709a68", "value": "d4f7cf3a18686482f4f291c5a6fea4167e94a8bdaddd123a7998eff4c684c90b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25db9e4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089236, "uuid": "1222d2ee-6f12-43d4-9bf0-598d767ed2a3", "comment": "Malware payload", "value": "4430cee4ddefb99e68d6607d484ae6b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089236, "uuid": "f3fa02d4-6a35-4701-bc60-20d2b6b4f2ba", "comment": "Malware payload", "value": "d51ec5be8f5ee0e851931186da1e9585280feb3b419de3149b6890fcff313b79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089236, "uuid": "28b1db2c-b3d9-46e8-88c9-31fbdd5c1ef5", "comment": "Malware payload", "value": "3776bc1e7002b2462795e26309ceab14cb60dcf9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089236, "uuid": "f600c88e-9ef4-4c3e-9405-81de022de0d3", "comment": "Malware payload", "value": "e1b86d078d9db0294adbde7aade53c89e0ab4b75e03983f150486fef1440165c1e89216a6e0ec6108d8534c0b793ee19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089236, "uuid": "a810806d-c6bc-4eb6-ad2c-841c38bdc5bc", "value": "T14EF41286B5E85436ECB5677028F703D30A3E7DE1AEB4836B534A58561CF2294A53233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089236, "uuid": "96cd86e8-798d-494d-9726-24ed5a4c082a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089236, "uuid": "1026a774-08cf-42e0-a658-e9ea850af88a", "value": "12288:fMrJy90ev/Mgln7ZjuGMmRsmQMnopMCaEv6fCfFKmduFOo8MBe:ayrsghoJMCciSKNduBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089236, "uuid": "27ccb574-3e2f-4b03-a22f-c2d0ff5bd9de", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089236, "uuid": "4e2bf03f-278d-4984-8b13-b9d74f522a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089236, "uuid": "e27f2d27-3333-4ecf-b55b-ca52453cfb0b", "value": "d51ec5be8f5ee0e851931186da1e9585280feb3b419de3149b6890fcff313b79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48e1d53-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089239, "uuid": "a1ab3f8f-d9c0-4eda-ac83-d051b26f192c", "comment": "Malware payload", "value": "bd66b7e1fc4f0ccf907e8bbc2d75d004", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089239, "uuid": "c6f6b1e0-589b-43af-914a-152b1e743559", "comment": "Malware payload", "value": "d540a49f23b26ff17f83d01a568812b7d4087e905f528fd4e7084ed9db028a56", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089239, "uuid": "89f2fec9-dde7-486c-9075-709d08499a2f", "comment": "Malware payload", "value": "0d2e991ae41123b7a7e92523874ca6ed10e71348", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089239, "uuid": "6f150378-48a0-4316-9dc3-b86cc6567bfe", "comment": "Malware payload", "value": "db58a8789917e77eaa136733b99629a048d4245c79e9fdf650a0ef14fb531231827f976b955f894243988208a31654af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089239, "uuid": "83cbfd56-49ea-4606-b21e-b248c680a086", "value": "T16F45235272F811B2EEE163B0A5F743C30B36FE716D78836F1B5A64461D3359498B2B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089239, "uuid": "07525a2b-1d31-436d-b202-a95536407b9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089239, "uuid": "db686902-23f0-4b8a-b5a9-21e8635b7c0e", "value": "24576:gypDYGWDU6abW0SzeGsCu2WlwjW7qnD9pHiBir3NyqoJR7+2W:n6GcjBNWlCCGDzHzNg7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089239, "uuid": "e6388c6e-965d-493a-a90c-33c68e2b4801", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089239, "uuid": "e0e6c1ea-f0e3-478e-8ad9-549516cb5c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089239, "uuid": "fd348488-d3ee-4b40-a8be-72cd1cc4f15d", "value": "d540a49f23b26ff17f83d01a568812b7d4087e905f528fd4e7084ed9db028a56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58d6679-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089241, "uuid": "aba6d086-7eae-4c51-8a2f-365fa796aa2d", "comment": "Malware payload", "value": "e4e9674dbf2b666480ac01dd951a45cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089241, "uuid": "2542b31a-05bb-4092-b9f0-ffab83166e5c", "comment": "Malware payload", "value": "d55d6643dd6fdbf55abd15bae8a53be81db767c2e4f45b99d5eee1469e0c74b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089241, "uuid": "57f7d848-3d6c-43e1-923c-4b8a587a2372", "comment": "Malware payload", "value": "9e24ad523992a78b3ec033433958916d6ee99f5a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089241, "uuid": "7060865d-8c28-4635-a420-f51dd98e2214", "comment": "Malware payload", "value": "2256edc3dd54a3dbd5c616814af56933e070438275879958df843bdfb98868732e1352dc3fff1651835f7468446aa588", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089241, "uuid": "75b58bc6-f030-46d6-b945-1da008bf7e14", "value": "T1CA252316FBF08033DAA41B7054FB02530B7ABDE2AD34465BBB85B91A1C726C45A7173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089241, "uuid": "0647cd15-d658-467a-a2a1-764869163154", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089241, "uuid": "63ed65bf-125e-4bcd-b206-01c28d92fc93", "value": "24576:5ytw0dtilf9XXyoJauW7gWB6+yYZmNNND95xKP3iJt:stEXXyoJauW0WB6nYoND9LKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089241, "uuid": "8d44a178-fbd1-4eae-bdc6-34977f35f6c4", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089241, "uuid": "60a2c135-0d3d-492f-bd9d-f38c744cfa8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089241, "uuid": "6ca3ebe0-76f7-4fd9-89f2-73276f0ebb4a", "value": "d55d6643dd6fdbf55abd15bae8a53be81db767c2e4f45b99d5eee1469e0c74b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe19824-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684090003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090003, "uuid": "661a2b3e-34e3-4f6d-af0b-6df59ed4e350", "comment": "Malware payload", "value": "666a0e50e6c7720cf4158ad8203f030b", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090003, "uuid": "d42a0707-2e90-423a-a796-22d6bce4c4fc", "comment": "Malware payload", "value": "d564685ccda14f0e0ea14d09737f25ff104c00dfba1fa269e4e51cab0e447123", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090003, "uuid": "fc5352fc-081f-4413-9e65-d7a99ea97a82", "comment": "Malware payload", "value": "50ef6f30bf6a46247070517f5f06cdeb83e5af93", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684090003, "uuid": "2cda9490-ff97-47e5-b04f-a7bdea9239e9", "comment": "Malware payload", "value": "0f9dd37d8bb2f03c95a20c39c0a2860cb8e1f4653c069b021260425983893b94e4b94c5d1d99f353c6418ef4f93e7346", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090003, "uuid": "538997e0-27de-4472-b010-31c9f6532ef8", "value": "T1C9F41F1CF709FD3F866E6D0E610D97077424DEB996FBDF82814D973A70EA806076A10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090003, "uuid": "9bee45d5-7c81-47c2-8a7c-3fbe754de7f5", "value": "12288:6SeDFUJHFZumhsZvYpgTg2WDjE0m9OC0CEuJW1ZLSmi/a2VJNCYZDDIbBUJHFZAE:w1iB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684090003, "uuid": "82f2c769-2c74-4e8d-8381-c341fffd80ed", "value": 753930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684090003, "uuid": "84ab467e-9175-43a4-964b-2406657fc228", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684090003, "uuid": "872d2879-f450-48ea-b2e0-35f33e12f698", "value": "sss.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fb8df1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089243, "uuid": "424065a6-63b3-47fa-9069-c5c1639e79c6", "comment": "Malware payload", "value": "a413e3b3a1427f1d9cef5810320021ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089243, "uuid": "5046ef55-724f-4617-87fe-23f16a0dc288", "comment": "Malware payload", "value": "d56d3b25ed45e47d0722cea74a40948f4ee4c5df42d0895ecad33627a7f65160", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089243, "uuid": "807e3a7c-0aca-45d0-a9d1-a3ba88c36fab", "comment": "Malware payload", "value": "73669254125f319c4ce5b2fb5a510ae51e1922c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089243, "uuid": "ae0ba09a-5e62-4c99-b1f0-07d8fc31bb2d", "comment": "Malware payload", "value": "b11e831bc2556a9ebf45e2625642213363b8a833b44ae607a895072efc7e1927e31f2e006086a0460111cc83283fed71", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089243, "uuid": "3bb43eb0-1e66-4456-9fa7-a96abd9b369b", "value": "T10445231196F84423DEF82BB41DF302C71E36B9B24EB5827B235568360C726E1D97936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089243, "uuid": "15d524cc-1e42-4f41-b4c5-750acc06da88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089243, "uuid": "32a997f9-4516-499e-a62c-f104e5436ade", "value": "24576:iyeVadnq9gYn+AYfG7Rtf6iPawO7x2ygB5Ru32OVmYno6C:Jdnq9gYn+nw3nPaJ7x2HgGxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089243, "uuid": "22b73122-1071-49e6-abfa-27b6dcb10fe4", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089243, "uuid": "1c4dbbbf-2597-470d-8278-8962655a0151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089243, "uuid": "57b4285b-8f2d-4f03-9162-a2073162f424", "value": "d56d3b25ed45e47d0722cea74a40948f4ee4c5df42d0895ecad33627a7f65160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6dc0be-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058298, "uuid": "c51c6c46-1111-4900-bb42-7a2ab1942614", "comment": "Malware payload (AgentTesla)", "value": "ab3f9f712e2f0556645f08f794b1c85a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058298, "uuid": "42d1a80b-e6b1-4f42-97cf-b9e816bb0a37", "comment": "Malware payload (AgentTesla)", "value": "d61f2f965222f6a9589551bed96dcadee9193570adc5f8e952cea482e549db29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058298, "uuid": "b312779a-c6c9-433b-9181-9481bfc67722", "comment": "Malware payload (AgentTesla)", "value": "d809ea6c2d7b69fe10e161f2d6e48efd30155e51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058298, "uuid": "90cc9195-bb95-4cc9-b7d8-854f718fa52f", "comment": "Malware payload (AgentTesla)", "value": "5770486757b0e942cf58e4869a6df59226ad92f1740c40b743c2f726ecbf4049377d9bcb42aacf45eac7b2b39cc175d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058298, "uuid": "8136ae1b-825d-4a03-9344-c5f662edff39", "value": "T1B4D48D63F129CADFEE713BA1C14DE7467E60E512E051F0A17E0A24C8DAA57E11FCC16A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058298, "uuid": "ce211cc5-4e85-4197-a38c-f38f47a70341", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058298, "uuid": "705842e4-07a0-497e-bede-c49b90d8ae8d", "value": "12288:zlawDewWXG6pjNIqLdXjISAm6y8A8xYV+3T:ptW2gGqHDB8HxV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058298, "uuid": "a9f2eae7-e16b-462d-b16c-37e0f412cfa8", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058298, "uuid": "bf226f24-7bc2-4498-873a-bc1a6e953627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058298, "uuid": "53d8712b-8be2-4e14-b4f9-c656c4f3e4f8", "value": "d61f2f965222f6a9589551bed96dcadee9193570adc5f8e952cea482e549db29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fb53ff-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089245, "uuid": "a0aec534-3cf6-4dc3-819f-e4e2b0dbfc9e", "comment": "Malware payload", "value": "1bdb626a426bdf1bfac456b805967dab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089245, "uuid": "ed5dc93f-2d53-48b9-9db2-09e099b5ccad", "comment": "Malware payload", "value": "d63deec0483bdb5c7f5b0328113426d4f7cb058f4d8441d6472d9da4211734a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089245, "uuid": "4d600567-797b-4158-a797-1986924c2c6d", "comment": "Malware payload", "value": "b1555c10dd47e7204edfca94b4dfcec959e11b0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089245, "uuid": "4d98cd56-291e-40e1-84cc-7d16b9518a9b", "comment": "Malware payload", "value": "72c96c67eb820ad0334a94c52a6cdf8cbd983397a7b921b81f53e152a1889e50ed009a871a9d5b0c34929f0b560d6349", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089245, "uuid": "f88ea889-ded2-41e3-bc52-867530370b50", "value": "T1AA152312AAD4D1B3E9F823B048F207D71738BC728D74576B6246585E1D333A89872B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089245, "uuid": "3757195a-0711-46af-8c83-b9774e8334d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089245, "uuid": "b5512191-ee6e-4998-aded-e1bb79ca13a2", "value": "12288:EMrTy90E6iMiUb/n5zm1ycHtKGOqBaeuWQJb0p2WGPnWJr24dpK8eCldF6IC1bP:nyHUlqpsqBaexHkber2eXeqgbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089245, "uuid": "a45a286b-fef6-4c46-9c82-b5d5110db64a", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089245, "uuid": "11f0befe-e30f-4540-a002-e0d7159707ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089245, "uuid": "17e9e939-6268-4fcb-b3bb-a7b75797acc0", "value": "d63deec0483bdb5c7f5b0328113426d4f7cb058f4d8441d6472d9da4211734a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a14314-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057356, "uuid": "0d4d355d-61b5-42f9-8a63-353905e66ba9", "comment": "Malware payload (AgentTesla)", "value": "b317ad86329c87de7fae6696e489edb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057356, "uuid": "b559ff3a-fe93-469a-821b-2f7244d08039", "comment": "Malware payload (AgentTesla)", "value": "d649478667e016eb85bb4ef8cb5c96531547744fb444b1ee85bf6c0e4b3dcae2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057356, "uuid": "4e7558fc-9041-4217-b11a-28ac1b13a1d8", "comment": "Malware payload (AgentTesla)", "value": "df7cef5015b438338f0d2f031a8b0761cd57b759", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057356, "uuid": "1b94c641-271e-4c7b-986d-913e862c00bb", "comment": "Malware payload (AgentTesla)", "value": "ae143578573a02456c6c6723a992d1da6e02f33cf26879b2c9c37e1a8a1c95f27054a2f0205a1d51bc4508ea51339782", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057356, "uuid": "0b9d27d6-ba20-4808-850e-fad9df6220fe", "value": "T193D48D63F125CADFEE7137A4D19DE7557E60E413E051F0A07E0A20C8DAA57E21F8C26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057356, "uuid": "1de33045-00c8-4a9a-8ab9-f83eee1abb82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057356, "uuid": "8de52174-0c9c-47f6-9fb0-2c3e8e886e20", "value": "12288:IDal5535wXHXJYQhtqLTEKfF+QV5Cxxpzl/RfO:1535w3X1tYPni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057356, "uuid": "fa998caf-5960-48a1-aefd-b9bfb980051e", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057356, "uuid": "e702524f-3172-4ddf-af57-076a8e6055d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057356, "uuid": "2bd7485e-e370-4103-9f52-62f7f7ba7ddd", "value": "d649478667e016eb85bb4ef8cb5c96531547744fb444b1ee85bf6c0e4b3dcae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea33f415-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089249, "uuid": "14d9dc40-8838-41bc-90fd-ad46d6c9d286", "comment": "Malware payload", "value": "c3dfb0de46d34ab750e5422d7e0594fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089249, "uuid": "e08335d6-7419-4e3c-9695-9947cbb34ebb", "comment": "Malware payload", "value": "d685952efbbd0aaf4155529b459c57cd3dd1d175419fa85fe4c2a4d7163fde45", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089249, "uuid": "f9fd6a4a-1ea5-4ca6-a81c-e8659a577e17", "comment": "Malware payload", "value": "89fa0b9cbf0505b77524f53c429821c6f14d7668", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089249, "uuid": "8e2d5bb8-f954-46e8-805d-0385feb92c95", "comment": "Malware payload", "value": "37ee7ff7ce175f95a835d5e1c0de64be6b17629dcb45e86841c2bd2db777fefe850eb681a5816020c44f9de2b98bf9e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089249, "uuid": "7e34cd85-88f3-4d89-a215-8179ad11583c", "value": "T1BC452313B9E45032DCF0177419BB42830A3AFDF158B4935BAB95BD4AAC732E4A53136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089249, "uuid": "59abb712-6881-4d6e-8ef8-ab8ce0c150e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089249, "uuid": "1b0e09e6-f81c-43e4-b7af-2626399e326d", "value": "24576:Dypv+lgalQ7Nk8dBihpzC0174JhnZLThBk34peir6+6A36/+:WZ+ldiK8/Wv74JPg3yWk6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089249, "uuid": "97501911-d7ff-471f-ba10-03cefb526300", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089249, "uuid": "994714bf-d911-4f6b-a556-1d901c89fab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089249, "uuid": "2c64dd05-0483-4bc9-970d-c9d24e138624", "value": "d685952efbbd0aaf4155529b459c57cd3dd1d175419fa85fe4c2a4d7163fde45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb658aaf-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089251, "uuid": "90f40e84-1b90-4fa4-b2b1-b29f6e17f358", "comment": "Malware payload", "value": "a3b773e912fa9d9a3a7195fbbaa3a612", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089251, "uuid": "4d40b0ec-5b6a-4bde-9136-cb4a3253a919", "comment": "Malware payload", "value": "d6860a6523e88ee8f973f45731e45b66902188f9ebea7debbcbbf9e1081e5b91", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089251, "uuid": "841ac679-f4da-46f6-b42e-f2a1184df0a1", "comment": "Malware payload", "value": "d2fa51d180fbe45eef793b4a0cfadc6d667ec5fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089251, "uuid": "663a1005-3556-494a-9606-a990ba99cc77", "comment": "Malware payload", "value": "63d34d770f98fb4e15dafd582c511d9affc91ffae228b192d664c6600eae9e3728b6313afc7e73cb37b79cca2ffa2cb2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089251, "uuid": "12fa76a9-197e-41c3-88a9-fcf46df45c3a", "value": "T1C8452343BAE99431D9FA1B704DF6418B0B37BC620EB883A73B59E85A4C736D05631727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089251, "uuid": "6815b669-4bf6-4cc2-99ed-13906a7daa0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089251, "uuid": "80e53580-e487-40f0-98aa-39af3e7fa072", "value": "24576:cysza/KsUp8ZUpvScalvQX42YXg2ZZbL4iege3hSFeLH134Zg:LrU0UZSJgwXbkiegexS872", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089251, "uuid": "b9eaad3a-6356-4842-b253-61d781a1659e", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089251, "uuid": "fd788713-922b-428a-940b-9832344bcb5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089251, "uuid": "56e07709-6f23-434c-a372-d561d89be678", "value": "d6860a6523e88ee8f973f45731e45b66902188f9ebea7debbcbbf9e1081e5b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9aa39d-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089253, "uuid": "fc5601a4-fdfd-401c-acf2-df6471b91fd6", "comment": "Malware payload", "value": "2432ade161ea210e8042d1e6e674cc79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089253, "uuid": "ec3a264a-b177-4678-b7ff-64e478931385", "comment": "Malware payload", "value": "d691029fb53e55a11dfe07987be32aaf729ccf7949de2c051590cdb30f9708bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089253, "uuid": "d981daf3-6acb-41f7-8add-97401e5e5d58", "comment": "Malware payload", "value": "42937fb32636854a36c00ea0ce93839f246f20e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089253, "uuid": "c8a0462f-4c03-49a3-9999-b7778c4855f7", "comment": "Malware payload", "value": "c89e0f07d9f10a49f7ebf3ff77edca6a306742eacf254c3c0c0d5054b35abd841089924ffbbea2d3525f052290c3ef33", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089253, "uuid": "6fe88853-8aaf-44f0-8f55-e5a422525fc0", "value": "T154452321E6E84073D9B90B7118F346A31B37BD926EB8469D1786D84C0D31BD269B1B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089253, "uuid": "d8a61b1d-423a-4111-b9d4-1bf8a8520826", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089253, "uuid": "2b845412-71e8-4da5-9bcc-36dff265cbcd", "value": "24576:iyBBGWvQxp19XfVodpO6+XIr0qUZSOFvJi8eLpUzSX7:JbGcQxp1BV8+XIr8ZScRi8spUzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089253, "uuid": "b05e440c-2d05-4ad0-a7e0-b978b31dffe4", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089253, "uuid": "e93f820a-86ba-4fb7-8b38-b5f2638bf913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089253, "uuid": "07364cee-07af-47f6-b1ea-72bf4cf8f348", "value": "d691029fb53e55a11dfe07987be32aaf729ccf7949de2c051590cdb30f9708bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db151bcb-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058300, "uuid": "bc9ef955-7bd2-4d91-9a4e-7826d773b837", "comment": "Malware payload (IcedID)", "value": "2747e432f3f8d496cf03c1dae5b99030", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058300, "uuid": "55d8e6c8-6476-45d3-8b87-e8f26dd64b02", "comment": "Malware payload (IcedID)", "value": "d69adfb4d6fdbe5d75bdccf152df5d5fe39eb620b1a6b9c7772283910ded9937", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058300, "uuid": "66119a1e-5efb-4e76-92d0-363fafcfccaa", "comment": "Malware payload (IcedID)", "value": "b4456250960d3afadb04dfdc8ce420599e85055b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058300, "uuid": "bb433f87-a0c6-4cd6-af50-c7863ab302db", "comment": "Malware payload (IcedID)", "value": "3b78cb80d11e2a1892806c0e2d597911369e830b8ca66ed5d09635af43612ceaa1a42304019d442982fbff33e82e8f10", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058300, "uuid": "d237852e-01bc-4664-a517-22ea6b86f7c2", "value": "T194D4AF06F3317C52E54BD73785E458A94FBEBD1D2722DB480641D3323A4A2E8AD6237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058300, "uuid": "25c47099-71e8-4663-9b33-6fe20989407d", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058300, "uuid": "2599df42-6a7d-40b8-a856-9d1bf8c9d76c", "value": "12288:QVcaFEqAl7/KWWvFjnlkXgjXcvjlIDSJkXLyVDCUNsWJEgozr:QVcaFEqq7XAFiXgPDSMYND2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058300, "uuid": "a7355369-3368-4c26-ad19-ad4312dfd5c8", "value": 618072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058300, "uuid": "005c8475-c7c6-4f00-9ee0-2872da253967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058300, "uuid": "d723e359-decd-482f-9d72-8c5445caa8ac", "value": "d69adfb4d6fdbe5d75bdccf152df5d5fe39eb620b1a6b9c7772283910ded9937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee101e11-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089255, "uuid": "fe8b6694-29d2-42f5-b5e6-0ccaf844fa21", "comment": "Malware payload", "value": "96866f8eebee6ac4ca62cda6515a4209", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089255, "uuid": "9e269724-af8f-4eab-8c13-f6c8459048b4", "comment": "Malware payload", "value": "d6bcdd0f12529a6b68cd38dbce054bc1103f84ab2285076f4834e03d4d10f312", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089255, "uuid": "8a2b8595-3511-4c98-ac60-e70e5b08c60f", "comment": "Malware payload", "value": "c921aaa246ba7f72f18518e2202326ba90a17686", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089255, "uuid": "6a11bec3-aa1c-4262-b738-dc762a49a733", "comment": "Malware payload", "value": "a1b519a2dfe9db87d3090bd6d03fb458b489f8b8ef25d7e175a60a1476660629d117657b62f695582b7857fe6198d5a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089255, "uuid": "613342e7-c3d2-4be0-b0e6-12e6d1ce19bf", "value": "T1C1452343DBCA8932D876277458FA05C30736BC659A7C93B67B81999E1C73688F232335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089255, "uuid": "2fb176d8-3d9d-48fc-af0f-3e9d8c207e05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089255, "uuid": "99c30e6e-76b0-42c8-a0fd-3d3d0c76cf0c", "value": "24576:IyCSKA9tWYfrEll2J9FkMluvq0aZk4ZQMuza/7KOuKuUD3I15TY7A:PCZM1Q/2J9FkMluvaydMuzm7KOuUbG5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089255, "uuid": "2e74f1e1-7f68-4936-b3da-1b2c1da8be28", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089255, "uuid": "e09daf25-01ad-4ff9-aae1-03ee8ce2a22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089255, "uuid": "7d027d32-6abf-4167-af83-f1648e5765a7", "value": "d6bcdd0f12529a6b68cd38dbce054bc1103f84ab2285076f4834e03d4d10f312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4bf09e-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089740, "uuid": "86a6260d-a7d7-471d-a17f-a2c61f58cb95", "comment": "Malware payload", "value": "76e589cd500d372bbae39b2f973c065c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089740, "uuid": "898acc08-250f-4bfa-b5ff-e47cd8886545", "comment": "Malware payload", "value": "d6d76fa5c46ce88e8def28ab03889c00078284de39865f0b00b6b5dce603ce16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089740, "uuid": "13b5eb82-6a5d-4b58-8960-d13df67e389a", "comment": "Malware payload", "value": "07773fa79247db19121ad90d43698defe60b5a6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089740, "uuid": "33bdd0e0-53f5-4ae5-a6c3-a0c87b9eace4", "comment": "Malware payload", "value": "b05deba6539357da594447706971964387344bb490645fcdd2879fefbae7394808fcc5fea483ecd61cadf3d3f2aea036", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089740, "uuid": "69867679-79e7-4405-9196-707703fc20f2", "value": "T1FB96DF17F65344EDC16BC1B4B61FAB32F661F8150374B92B2764EB752E22F90422EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089740, "uuid": "c7dd03ff-75d3-47f5-bd13-8c3d615612b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089740, "uuid": "593166f3-c4df-408c-b7a6-0c0d8b828ab1", "value": "196608:MZl3X6/HRESKsjoscH1E+AsDm1y8ne6NZOn:ul3ERnVq++9myi1NZOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089740, "uuid": "6a633137-6163-4e03-8be2-f1a7d9b540a9", "value": 9402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089740, "uuid": "820fa9bc-ba3c-4512-8071-59876a0ce4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089740, "uuid": "00373ac1-ab1c-4625-8663-4687fe92fca5", "value": "tmp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef574610-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089257, "uuid": "ef3f2a22-2c10-4566-b69e-0ca070cd1af7", "comment": "Malware payload", "value": "4d43c65dc8b5dad1391275c5d3f714a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089257, "uuid": "7f22fa90-3537-4e17-8c30-ab9d52a71f05", "comment": "Malware payload", "value": "d7263846f35cc1656f7f23a986bc228f3a76a7f076c8e62a68e77b14727c95f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089257, "uuid": "5ab51c58-5617-469a-a63f-bfd03d272712", "comment": "Malware payload", "value": "17edd106c05caa5b31fa37f37fcb79c8db9b4717", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089257, "uuid": "e5233f31-6603-4e4f-af7f-18b88e648264", "comment": "Malware payload", "value": "91097bed5426cb92d74987458b1f5861af095f50b9270957e5621a685827b96a2099e3c016ecafae1dcc407f6538e361", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089257, "uuid": "ed5cb67a-a9a0-45eb-af77-efba29d3bd49", "value": "T12B4523A7B6D88627EDB617342CFB56570A3A3EA2157583032368291F1C73AD0E631377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089257, "uuid": "0057ffcf-b458-476a-87fa-46d68c6c34fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089257, "uuid": "7404338c-c5c7-4a43-8123-327b2181377e", "value": "24576:0yf8QbsRAdSEm9fewZxEIuSGc8UhRIeMoR/pEGmPxF9pp9YhN:Df8QzEfVZx4SA2IvoRBEGCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089257, "uuid": "5e0cc246-be6a-43dc-8626-77caec674aaf", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089257, "uuid": "6342d8e3-86be-4df1-9eec-d2ea93ed2658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089257, "uuid": "6475feb4-9766-4a05-8b0d-6d22d17530d1", "value": "d7263846f35cc1656f7f23a986bc228f3a76a7f076c8e62a68e77b14727c95f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e73645-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089260, "uuid": "1c0bf2c2-dc0c-4c87-9108-599436f76b6b", "comment": "Malware payload", "value": "d7e467f7c16c3bbc652bf74b4e24def2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089260, "uuid": "85675866-f500-480d-8e8c-dc0014da6b15", "comment": "Malware payload", "value": "d733cfb27f62976fc1766c224d7d54d82d4ba0cadc84efb33970cd6c0715a258", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089260, "uuid": "f51c965b-f2a6-4ac8-a40b-5007482ea221", "comment": "Malware payload", "value": "dbd531d93bb3e243e13de5fb0ca26b45a42597a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089260, "uuid": "a52d2b6c-f0bd-40d3-8a40-3dd0389f71ea", "comment": "Malware payload", "value": "565ad66ca3d25a718bf6fdcd46b178f0a64ee24d4cce8c5bc5cf750de6903c11f8ca90e944ff5b230900464530cf3eb0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089260, "uuid": "7848f835-3481-4093-9c3c-336633e2ea92", "value": "T130452301A7D88062E4F41BB268F302A35B34BFA189745B1B36859D9F2CF35E1653573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089260, "uuid": "0ab6c601-2059-4c61-8091-d4ae7ca06d3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089260, "uuid": "2d591668-bf10-48c9-918d-c4cbf259b01f", "value": "24576:lyNyW4PEV26Du6KE8CpHXx7nZWHfCD0QguXHNrIIlCM:ANyWv26Du6mOVnybuXNrFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089260, "uuid": "3200bc5b-94f5-4e2d-bdf0-cb3959661d4f", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089260, "uuid": "8054c7ea-83dc-4bbb-90a7-2a55015eade4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089260, "uuid": "cfb0e2e8-9801-4098-9511-b13f6a04a6ec", "value": "d733cfb27f62976fc1766c224d7d54d82d4ba0cadc84efb33970cd6c0715a258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22044f9-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089262, "uuid": "fcab3623-e9fa-4107-84a8-448703738c20", "comment": "Malware payload", "value": "63f9775afd221d9b162a8bf2a2df665c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089262, "uuid": "d3c08e03-a0a7-4f58-94a7-c463e7e665e8", "comment": "Malware payload", "value": "d74c5658f36f2ed2a08b963ab83d5a95031bd9e1baec48ee398a84af0f0eda7d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089262, "uuid": "80bb1639-99ff-4000-a277-6cf700fa0ff6", "comment": "Malware payload", "value": "59acb0064d24eed2fdf34eb8c629b112dad30f67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089262, "uuid": "ae0a77f8-97e8-4497-b326-7c07ac5c7fe5", "comment": "Malware payload", "value": "2491af91f07c23f5a8df28c4fc6a216c3d1ef27fca34e7503817084ceec8000bd6126e2a526f512edb174a5f839058ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089262, "uuid": "1ace16b4-a9ab-40cc-89b6-37c6468110e3", "value": "T11F452362A7C851F3D6B1633458F702EB17357E632F39B72A2A5A4C955C33285A032B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089262, "uuid": "18ea0e61-8115-4204-9df6-d89bdaa0ff0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089262, "uuid": "0bcd42d2-5fba-4ac2-92e9-7276bf22edea", "value": "24576:wyaOeVa6Pf7cA1xT0SLV4WZrhKvN/k8fXZ4Ve4qe/0pw8O8YHxc:3kLf7cA1FvLVTJhKvN86p4Ve4qespwjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089262, "uuid": "b058319f-6ab5-4784-aa53-e0930697d170", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089262, "uuid": "981c6b24-e929-46a9-87d3-4119e157bedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089262, "uuid": "877646a7-1084-4537-9f4a-6c243482900b", "value": "d74c5658f36f2ed2a08b963ab83d5a95031bd9e1baec48ee398a84af0f0eda7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31990a49-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032675, "uuid": "78e5c33c-8f9f-4d4f-bc38-683c8269db75", "comment": "Malware payload (Mirai)", "value": "7a77e0026b61938f7db04192b96b4f64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032675, "uuid": "008a3519-66a5-4a64-9ece-d7625195f377", "comment": "Malware payload (Mirai)", "value": "d778ba977944822e83661ed86f325a5d902fecaa4931880a6594de0860462295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032675, "uuid": "95c89755-eec9-447a-a36b-83e3c510b2b6", "comment": "Malware payload (Mirai)", "value": "9ccb7c06603ec644f15c61673b94f5c2a7b99085", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032675, "uuid": "364fdb78-6eaf-42d0-bda5-a109d3678c36", "comment": "Malware payload (Mirai)", "value": "f6a9d7f08c1c9987ab09e40397da42c0f9555888a7a01dacc5cf300a314e3fec3de63b14f65897c0619eeadb51b6c7a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032675, "uuid": "819d0837-c523-4134-b177-a736b1362a71", "value": "T1CBC34B46FB418F13C4D61776BA9F4249332297D5D3DB330689286FB43F866AE0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032675, "uuid": "442b7996-c299-401f-8260-1870140f762b", "value": "3072:/sLfVXAJOWYsrvoxE4LNNsG7xwa9+b/EM/9a1NMM3:/sjVQJbBExE4LNNsUxb+bMM/9PM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032675, "uuid": "aed44dba-85df-4213-aa29-62c44ec713ac", "value": 129308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032675, "uuid": "a33a4467-8a70-4343-bc06-8fce902f378e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032675, "uuid": "2d4c7968-ed9d-4785-9a0d-fb6877a559f9", "value": "7a77e0026b61938f7db04192b96b4f64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f390f4c8-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089264, "uuid": "90696cfe-136a-40ba-a954-ff997a5cb080", "comment": "Malware payload", "value": "877e3887cb6d273ce45a9e0e31f4ffcd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089264, "uuid": "57e76a1c-a27b-406a-a838-4eadd24338a7", "comment": "Malware payload", "value": "d780b815579656b3a7258462675b29d504ac8e9330384b15b03fa100631eb91e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089264, "uuid": "d1f652b2-de1f-4f85-a43f-53310779f2df", "comment": "Malware payload", "value": "e6c8a9a42d37415cfa7416b03b22ac331d70a46c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089264, "uuid": "6746de50-0e83-4e48-b511-48869c968112", "comment": "Malware payload", "value": "d71bc0f7b877eaa2b18f641083d7a0f5fb3792b8743495c8cd5d770022c49d71f68f549adbb1277996e60d85b60aa28c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089264, "uuid": "20483b4c-7f98-4338-9afc-fecc5106f39d", "value": "T1A945234BA7C49432E8A057B0D8FF07630E727CB50A79035B278ADD5A9BF27C56072726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089264, "uuid": "6714dfc9-4c0e-4a42-909b-045557f3bc05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089264, "uuid": "d2e5293f-a56b-4c68-b66b-94a8f6e2158c", "value": "24576:6yUY2uZG4U68CbQKktBPcxfnWwrowhtIgeQUIJO/Mo2YO3x/eVR7N:BUY2KGObQ7tFFlGleQTO/MRH/eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089264, "uuid": "d0b0676e-f73c-4d65-8a96-0a66c1c04293", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089264, "uuid": "8cc1de3e-2d03-4b92-a18f-16631148f0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089264, "uuid": "05df21f9-23df-49ac-bff8-0c15975bd479", "value": "d780b815579656b3a7258462675b29d504ac8e9330384b15b03fa100631eb91e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d54528-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089807, "uuid": "92b530aa-f3be-4ada-ab7a-b9f956d2d7ac", "comment": "Malware payload", "value": "498d68806190e56ef9689af373e2f0eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089807, "uuid": "1bc0253a-bb02-4705-afda-558acf34742b", "comment": "Malware payload", "value": "d7881fb638b538309cfc224e48063cc9e5ce00b8c58a31d21e4bebe094ed1b69", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089807, "uuid": "52f512c7-396e-4884-80ed-6666477b12d5", "comment": "Malware payload", "value": "342bafa443bc8ee56c682af62680f214b2eb726e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089807, "uuid": "2561ee7b-7e0b-4361-b3e8-d683fd8d4036", "comment": "Malware payload", "value": "b67672c70ae47ebcbdd9360df0006d1884aad495a1b2022a082ba5e9eeb37bb196283fcf1a460f74de137be04527d8eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089807, "uuid": "bce27443-8af7-4c2d-8a7e-ff39e9457eee", "value": "T1670486844665A4725B1BBD666B30A4A997BD0E7082CC469FF06F7281F6CFACDDDD0320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089807, "uuid": "0699bc1f-da26-4e24-aa33-7d258c9b4a70", "value": "3072:A3nPn8vo3P64Isi13CtFAhzVSoI3TSutk:A3nP8vai13CtFAh74U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089807, "uuid": "26bced4e-dcca-465a-b46e-93c45e28ce9f", "value": 181385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089807, "uuid": "08f153e8-522d-4ca3-8094-9a0ecf24ce23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089807, "uuid": "609d16a1-3d81-475d-9ad6-e42e6c63d83e", "value": "wief.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f75668-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089267, "uuid": "c17e8f29-3bfb-4166-a2dc-705a0a925a4c", "comment": "Malware payload", "value": "dd281116ff23a9f1247171a77fa4ba11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089267, "uuid": "1787ccf8-2ce6-4366-9f5e-15da09f62e97", "comment": "Malware payload", "value": "d7927d74a630300859f8b0547366ba4175da43a2a0ca8fda0e76fd1f84e07487", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089267, "uuid": "09ab6128-f1fa-444a-a5a1-81ed21a76587", "comment": "Malware payload", "value": "a5420434fab3f49f1a6216a1e310c4656358428c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089267, "uuid": "3dfc787f-d0aa-479f-8267-d598b52a419d", "comment": "Malware payload", "value": "7ecace1f7fd4ea267a078c908fb459afd8b08f0ebb492b504cc75ffd2ce7f05daa09ab2f3357d96dfad2841f42ba1371", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089267, "uuid": "2ed2bd72-aad0-457e-ae19-8cdbd93c7ce4", "value": "T1E14523422FECA236EC741B7124F625834B39BCD50C34426B6A62BD654DF3394B2B275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089267, "uuid": "0103814f-146c-4e13-aa05-8ff169f67811", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089267, "uuid": "db0f8158-a783-488b-b876-b60d7de992d4", "value": "24576:2yrbMsmRdlGxPUFk9Ib3wShih0HNmAyfjt+wL5OcHL:FMPRutUFk9IjHzmff5+k5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089267, "uuid": "4eac11b9-010d-43ff-b514-e323d4e5bf4f", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089267, "uuid": "26a39ced-60ca-4870-ac80-6013f1744382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089267, "uuid": "5612c445-6e90-4cb8-96ff-1cfef95dbdf3", "value": "d7927d74a630300859f8b0547366ba4175da43a2a0ca8fda0e76fd1f84e07487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62b9639-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089269, "uuid": "f7371455-9270-44e1-b92a-3b9cdb7e0168", "comment": "Malware payload", "value": "805c5ca5f87a7825842d0d0703c9cbd4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089269, "uuid": "a65dfd3d-2208-402f-b438-0fb22cf06378", "comment": "Malware payload", "value": "d7c3d5e8ae14b370ea237a3af36c68c84f3a291d2f610c47825b80226cfb8ef0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089269, "uuid": "5332d928-28ae-48c6-8323-c45508d9732c", "comment": "Malware payload", "value": "22df410b35f85ecf97b6c23e8b0f190457bec4ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089269, "uuid": "06ba6a4f-cd68-4804-86d8-bc1e4f6f638e", "comment": "Malware payload", "value": "3400396da216d18c061bfc8dcd71df70e4aaea32748594bbbd5bc3bb682d66f518d93b1f83c6109204543604e1766144", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089269, "uuid": "b391bc55-9375-497b-9072-a66668dd6ab1", "value": "T1EDF41217F6D82063E97207700CF317A70A353C61ADBCA65B2A49A91F4CB26D4A5713BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089269, "uuid": "5fe073bf-e6dc-4b52-a07b-dbae8f6831e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089269, "uuid": "85d29fdc-b160-4409-8ff4-774580409d13", "value": "12288:9Mr7y907Trf22yq/wPKk2M2WwnVWL0zEBvcifs0x/DxkC5LVb9ir8qbq+j:SyszLyqoPK+2NnVG0e0i00xij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089269, "uuid": "ef123f46-5e5b-4f51-bd0e-fb2799c8fede", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089269, "uuid": "18f01201-b595-4609-a93a-66a8a5088092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089269, "uuid": "4f3758d4-98aa-4c37-9624-b5b70fe6d359", "value": "d7c3d5e8ae14b370ea237a3af36c68c84f3a291d2f610c47825b80226cfb8ef0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bb6b61-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089271, "uuid": "9434e8a5-2f5a-4c42-b60b-e46e85b06c61", "comment": "Malware payload", "value": "c483a17b4f554678ae95aae43846fba7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089271, "uuid": "22205010-a7cc-428e-ac3e-6e188b1bd8f6", "comment": "Malware payload", "value": "d7c86fbdd1ac6268e757a9f3e1f1c20db36b82672b758977ae844d8b2fdfd981", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089271, "uuid": "c46d401d-4d06-45f6-9c86-7d60bdefeac5", "comment": "Malware payload", "value": "1c9c8efea4003ac9580df9b65889aaffbeb16f2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089271, "uuid": "dbef571d-bc12-41a5-9f6e-1a5a7e8c8375", "comment": "Malware payload", "value": "3c9c0da3adb738a325b9d2aef77975de2f735a68acbf82066f6ee78d3c92eb266f9e9e714feb8f4de4267e1b1f7a3247", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089271, "uuid": "69e4fe51-f185-4623-8a4e-59aae65c7945", "value": "T1D44523039BE95537DCB16B3018FB52D71F35FE60AEB8462AA7C0681D0DF2586693432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089271, "uuid": "cb311ff9-6841-41a3-aecc-feaab8fdd27e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089271, "uuid": "1d94872a-e328-43dc-9278-d17ab1313b0f", "value": "24576:IyXKwes4qQh7knFZdnh+AH5mmuViO1tZtDWDiKnseX/xjEaEB:PX1VQ90ZFsAH5mjoO5xWDi0ss/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089271, "uuid": "7641c090-f89f-45f0-a9a1-ceedeae03d7a", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089271, "uuid": "2c35e8f3-3410-44ec-a1a1-6c8080eb2a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089271, "uuid": "024242c7-4b57-4314-9f2b-5aba2932d842", "value": "d7c86fbdd1ac6268e757a9f3e1f1c20db36b82672b758977ae844d8b2fdfd981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a213d0-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089273, "uuid": "b49126f4-702d-456e-a6f6-6c7f5a78c24c", "comment": "Malware payload", "value": "161ad794206d99bbf849403cdc6afb3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089273, "uuid": "d2f924d2-2726-41ea-bf7d-0850453c26da", "comment": "Malware payload", "value": "d7d08809eeaaa72b382638d6facf28eac7c31e9fa7b385285784929c8fbb8aa6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089273, "uuid": "ebbd694f-a385-4a3b-9f2d-2eb395acd41c", "comment": "Malware payload", "value": "e00dfbc9f922b20dbc443d5d0c575b5be3b5bea2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089273, "uuid": "24fb15dc-3ecb-487b-9357-2d7cb213f139", "comment": "Malware payload", "value": "5284331e23dad01542dac436bacc01c6d7e19cd4d17ddc001776e9fca2517cf47a45fcdd7ec0f3dc21e7578eea3fd140", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089273, "uuid": "c6f675eb-7c3a-4039-a4a0-ae6cfaa29149", "value": "T14745231BA7D08033D9B227B054F702C30BBABC919C7C835AA74AE95A5C726D1D17636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089273, "uuid": "80268ef6-6ddd-4445-8940-16ec68cc1518", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089273, "uuid": "d4e78a6b-8216-4fa2-9fce-509ed1240a9f", "value": "24576:9yVpjnH09ZkZuJTvXsewieIR44jaIvKRiRMHB:YrQkZuJTPSIRbjfvyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089273, "uuid": "1aeb99fc-4275-46f5-b603-3eaaeba6a564", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089273, "uuid": "d184f0f5-ae83-40fc-b038-f57df2c66deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089273, "uuid": "192442cc-c4e5-4b23-852a-a19023c9471d", "value": "d7d08809eeaaa72b382638d6facf28eac7c31e9fa7b385285784929c8fbb8aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d4ca9c-f24e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684065564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684065564, "uuid": "866d3811-6d92-4a6f-a4f5-31917ed6aba9", "comment": "Malware payload (RedLineStealer)", "value": "da31fdb3a17911fe694a52703c130b22", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684065564, "uuid": "8851de24-35e3-4a5e-82f5-ea3419374aba", "comment": "Malware payload (RedLineStealer)", "value": "d7e41705bc2b887d3f64dd7e5ffbf73eece1fb3c6e1559480712c859ba90ec2e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684065564, "uuid": "0e071f56-d44f-4f47-be7f-8cd716e3cf9a", "comment": "Malware payload (RedLineStealer)", "value": "ca41e63e0358c61019966b650c56e7d1471ed1a3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684065564, "uuid": "609f26dd-2487-44ac-a313-b001f03aecfd", "comment": "Malware payload (RedLineStealer)", "value": "92d4bea4558e4a12369f31095aa726b08846b8ea1e297ef6d426f739f2d7670f216f0cf0afbe809ff551ffc25b65a584", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684065564, "uuid": "49309c03-cc2e-4c5c-b928-f8dba92616f4", "value": "T1ED4523436BD84232D8B11B3059F302D7193ABD409D349BBB2BA9A85B6D33351D970B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684065564, "uuid": "316913a6-396d-46d5-8a89-7f5b43ea6dfd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684065564, "uuid": "928cd046-0e71-4c42-806c-fa9d21ed1e4f", "value": "24576:2yJB5a94DckdX9QWUtCn9VVnExJQ88jH8h:FJrazk99QWUSEI88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684065564, "uuid": "230774fd-5e5f-46fa-a3f1-5aa93098ae66", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684065564, "uuid": "c884dab4-8a88-49b3-afc9-e1023eaeae18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684065564, "uuid": "d01c8322-c871-4db0-a28d-9331f4fa1dc4", "value": "d7e41705bc2b887d3f64dd7e5ffbf73eece1fb3c6e1559480712c859ba90ec2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3100a1-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089277, "uuid": "c139ab59-1de1-4dda-aab1-992a8e6152da", "comment": "Malware payload", "value": "007301da1046d2aae85572af9b9ae934", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089277, "uuid": "6454e444-e5a3-4ee2-aa48-cf57bc96b6c3", "comment": "Malware payload", "value": "d7f818cdc0949b0698bdb7a1e6b557b2e53d803427d360630602504c30be2ce7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089277, "uuid": "e4f63e94-5ae3-4b47-b50a-874ff57dadfd", "comment": "Malware payload", "value": "37af2509e91996059555e861795ad4ee50c60d86", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089277, "uuid": "cce7ab2d-e069-4470-a6ce-21cb8f7a1729", "comment": "Malware payload", "value": "0f08fdbc4fb9f5bac4ca75b341ad23fe9c4bc93deb749bb4b6e55c9208b769b8bc55520eaf09a9fc1c2ce13ba388df57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089277, "uuid": "c5849644-1c5f-4ad6-996f-966f98d93e88", "value": "T1C8F41222A3E8D072CEFA273044F603D3253A7CA69C79D62B3B56998D0CB3AD56431757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089277, "uuid": "6f6b1050-2235-4988-b090-42b88939182e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089277, "uuid": "7e15c1c9-6aea-4c61-bd91-5e3d9426f334", "value": "12288:pMrby90s7+5O58QmQJiIjrFIcQXolAtXJTkBotgm8vAF+sC6ALDG10T:2y2vVQLjrKcqSsbTYhHDGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089277, "uuid": "52b79437-6241-4083-8c81-9faa9d948352", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089277, "uuid": "5fe2d8c1-eb9a-42fe-b39f-21a1ecd191af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089277, "uuid": "d59a4af1-25cd-4bd4-9f95-8c9aad34fd2f", "value": "d7f818cdc0949b0698bdb7a1e6b557b2e53d803427d360630602504c30be2ce7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd495cf-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089280, "uuid": "7b08c375-b3d9-4f30-ac60-40174ba4bfdc", "comment": "Malware payload", "value": "69a9108238b9ef26a3a82823339a1824", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089280, "uuid": "a87d52a5-ac0e-46e4-9a6e-d3ee3d936c64", "comment": "Malware payload", "value": "d805b9b1e749d016d5ddc6bdd3b6f6598eb740c8da86530918a1c03c1d5c5a3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089280, "uuid": "9e7fd2fd-a21c-4c5f-88df-f023f11eb19f", "comment": "Malware payload", "value": "2b4ee8d25a5c91c26434727ca30a420f66c814bb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089280, "uuid": "488b0c39-eec3-45b0-9b95-74b0d2a36957", "comment": "Malware payload", "value": "b4c8cfb4819d5d7fc05d3cac2316319f8cd814e057765802a14fab65b304677bdadf33b34afd6a43f48943b050a8a207", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089280, "uuid": "a4da9086-0e53-4979-bf9d-a69d8081d61a", "value": "T13845230377E46462DDF51BB054F307430E35BEA09D788ABA5386A85A0CF3BC0B5B576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089280, "uuid": "20bfae07-381d-4cb6-9df7-40e1780acb79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089280, "uuid": "a35eb36a-cae5-44e4-8a63-d4d1dcbbd504", "value": "24576:NyGCF9VsoNttuuDCW5SdtznhO+7gFTTZx+3sfckwybP:otTttPmptzngToGWyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089280, "uuid": "a38aebfa-ec9d-4b14-aacb-ed170b0c9477", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089280, "uuid": "41e42aaf-c9db-47d4-8732-bffaa7892ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089280, "uuid": "57391b56-43f6-41a2-9d1a-823aecf090d9", "value": "d805b9b1e749d016d5ddc6bdd3b6f6598eb740c8da86530918a1c03c1d5c5a3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd992d6b-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089281, "uuid": "73abaa60-d85b-44cf-94d0-a9a0f6ef518a", "comment": "Malware payload", "value": "9ce6ba200254720e5639cf9a4a51d27a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089281, "uuid": "f76a544f-648a-4e10-89c5-279d96748f04", "comment": "Malware payload", "value": "d813e1bf0278094d48e5a504e0ec9dbe2aabb4bcf87aeae03317c72c7be89b10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089281, "uuid": "bb33018e-84dd-49ca-a830-c807772de2e8", "comment": "Malware payload", "value": "743eb508911aef8f059faf97c5416ca8c31531c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089281, "uuid": "fca6bef6-0717-416d-b5ab-8110adb6ac92", "comment": "Malware payload", "value": "893ba69a1a07e93b688dbfa73b9df384a8db2683a2e7818e5259e033d878b7c39745252a31511d54eb5d122c58e8027b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089281, "uuid": "a1fa2f18-fd93-4cb4-a951-3c6de76042fa", "value": "T1DFF41223ABD994A6D8F517B09CF207830B39BDA1C634975327846D8F58332E1A47376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089281, "uuid": "dabc66fa-e88a-496d-ab49-b7ca9ec0b717", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089281, "uuid": "ad026993-7c2e-4d07-8c77-20f1b9053ef6", "value": "24576:1yTw70It+ectW6Xsa2d99/TpM8Yc4jpvH:QTw70FM68zd99/dz94jp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089281, "uuid": "78c5458f-7307-4ca6-b860-3ec6af743b24", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089281, "uuid": "631df2ef-572e-45e3-841b-389e25f26030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089281, "uuid": "b36e2a1d-4aa8-40df-8b54-07c1491e540e", "value": "d813e1bf0278094d48e5a504e0ec9dbe2aabb4bcf87aeae03317c72c7be89b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4e9b03-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089282, "uuid": "bb06f1fd-44e8-40ac-9d9d-12a6c98d10d1", "comment": "Malware payload", "value": "5aa88ff8a38d3d853d63a86206ae3f48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089282, "uuid": "82647558-1bb6-429f-8d0f-aeee3c57f1fc", "comment": "Malware payload", "value": "d83f5cc310a0d2c689f7f511ce80607027c14aeafebbf50604170eb67b84db9d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089282, "uuid": "be1c1249-f9c9-4025-a9eb-a6f8d5763fb5", "comment": "Malware payload", "value": "193acc90d90fc07c401cdfe91b72819992062230", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089282, "uuid": "4e4d7f04-5f29-4aa1-a66c-67a6e75c056e", "comment": "Malware payload", "value": "e294ac147e5a5cb623a1dbc762c3f6c0c69b4c3c7d71a63b5cc23a6d290d66d356d9297e498fc7ffe65d5ef06be67bdc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089282, "uuid": "d326f5dc-ee75-4fc3-bba2-42a3d5a622c1", "value": "T1D7C41243B6E9C033E87617B058FB06931A327CF64E34926B2B4A69191C73AC46D7573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089282, "uuid": "8f2c6b99-7632-420b-ac3d-3652b6a0de28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089282, "uuid": "6b713895-7d25-4a6e-b299-a9ad82cbfc75", "value": "12288:zMr+y90mmNbZ+o+kg/rfPt1ut0w5eVHNbHMH0NZ:ty4Vd+kgPut0w5IeHKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089282, "uuid": "3cad5431-4fa8-4f0b-b2bd-1a463d1f598a", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089282, "uuid": "09a8c1e5-a3ba-4195-86ef-d3b947d21f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089282, "uuid": "a0d9f549-745f-41c8-ac3d-b4efaf76b230", "value": "d83f5cc310a0d2c689f7f511ce80607027c14aeafebbf50604170eb67b84db9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff92e1c4-f285-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089285, "uuid": "818fa3b8-0455-45eb-ae23-60db9e08cf60", "comment": "Malware payload", "value": "e3c5b543c925ff5205d715773a5d051c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089285, "uuid": "f98bf734-86d8-407f-a554-1fbdef9fe629", "comment": "Malware payload", "value": "d844a52aae36b20b116cdde87fff59d06bfec838384773514cda78f489b60c5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089285, "uuid": "e6ae14e4-d321-4c25-b0b6-86ba766008e1", "comment": "Malware payload", "value": "bce635347ac17ee60988e75dad26f91dc798f228", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089285, "uuid": "4d37b0cd-0a77-4150-80e0-2600f1fbf325", "comment": "Malware payload", "value": "4ab6fd0ed32ffe53a36e62b882a8da4e5fcd602ecf9e6240b450d61e6ef55ee1b37d3377288ef258b680476694956691", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089285, "uuid": "c14941d4-8039-4083-941f-b0f694f406fd", "value": "T1C04523A3EBD49122ECA427746DFB21A30E36BDB04C78436F26C29C581D732966871777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089285, "uuid": "795fa24e-5c3b-4e69-b335-578b52a37917", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089285, "uuid": "af17aaa1-d7c2-412b-a091-0ba64d93b96d", "value": "24576:fyzPpLFBqhhb8eRH92wY2S2dwPdlW5uwQHsr:qzLBh+H4RRDPdiQHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089285, "uuid": "edcaac86-0da6-462d-8930-318b2d07c3e8", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089285, "uuid": "9d6ca454-1dbd-4a96-b984-9a26013d71ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089285, "uuid": "df98b722-c965-41b6-a425-db606c6fbbe8", "value": "d844a52aae36b20b116cdde87fff59d06bfec838384773514cda78f489b60c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcb47ca-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684058301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058301, "uuid": "2088fc79-ba57-438b-86b8-2dc8ae7b7119", "comment": "Malware payload (GuLoader)", "value": "65820dfde632e1a2d8bcc039785c61bd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058301, "uuid": "b2cb1129-d7a3-4c34-a0f1-64381e70b0fc", "comment": "Malware payload (GuLoader)", "value": "d8552dd3abb84058086a009768d5849f3efb45725a4631c07525d0ab806d5ea9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058301, "uuid": "1ab03246-f939-4835-a2fc-a1c863b64347", "comment": "Malware payload (GuLoader)", "value": "c8f70b99defb122f9c42a35f2f4b98d627c6a356", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058301, "uuid": "c0d5c268-45b5-4872-b60e-fb07578e720f", "comment": "Malware payload (GuLoader)", "value": "2f1776a8b1bd7c434b89412792e4b28b5b73ddb7e6068dfeeb285ae0ce0312e7db1650220af4bcadd25403fb5b18dc8f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058301, "uuid": "6deecf67-4bb8-4d29-b995-b9bf9c92a9a7", "value": "T171C422961360C80FE46152B2C5B4FBF8B2359F11D4278B131BE1FD67393A9C3590E6AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058301, "uuid": "6b68cb85-fe79-4ab7-8fda-9befde6ddec6", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058301, "uuid": "ff4b74a7-e215-4fbe-8709-cca1368c4180", "value": "12288:Qng3VOqc35Tg4ur/cMabzGtSAOGwCD3dL8f0WYW2jlF7Uq9GqZPjf0oj8b:vVOqc35TubpjOrCD3Gf0WBoF7NdZr0o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058301, "uuid": "eb6d7bff-c025-4a1e-ae50-fbc221d30c7c", "value": 583144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058301, "uuid": "0d2c0afd-9955-4936-b8a5-6565b853a409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058301, "uuid": "4627e172-65d4-4109-b6ec-aabaf8d2d7e2", "value": "d8552dd3abb84058086a009768d5849f3efb45725a4631c07525d0ab806d5ea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a530bc-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089286, "uuid": "e1041ca0-33d1-4a0d-9baf-1ff905cad635", "comment": "Malware payload", "value": "9787b70f6e53cd4951163d3de7a820e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089286, "uuid": "d130472b-76e8-42fe-aeb6-695565f07ae8", "comment": "Malware payload", "value": "d88c53972d63e35d5a71874bef9cecbb48a5fd926b812d1acbaf5f1a79d3d482", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089286, "uuid": "790009ff-6ed4-4459-bf13-04960fee0b23", "comment": "Malware payload", "value": "e710b6a070d1ac1b52bc78282ec3c937b06d9aa9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089286, "uuid": "90580a13-2c51-4d0a-8c22-cc8b9499c848", "comment": "Malware payload", "value": "c2ab4754bc6c25dd83623696eb0d5777be8fb524535032f6ecf458288546169bf3eaf830d78594a9a3802859c3f50f0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089286, "uuid": "5ea5ca98-4654-4e83-8fab-754e876457d2", "value": "T160452355EBD89431E9B23770A8F717870B327C757C38476A2319A61A1CB3684A770B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089286, "uuid": "a4363c81-289d-4f16-ba14-2d2b10e92a25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089286, "uuid": "c5220949-0d93-4787-86a1-51c10baef647", "value": "24576:tyyjy90CW927XA6rb7mKO73DfHfcnnQjABAn:IkYAQQm8zf/6QjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089286, "uuid": "f12dbc8f-13f8-4d20-bbcc-e876ceb465f1", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089286, "uuid": "eda5d9b0-5a68-4884-a992-5ca727d8e1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089286, "uuid": "07ab1615-1cd6-40cc-8b0b-d5dd5f5daecb", "value": "d88c53972d63e35d5a71874bef9cecbb48a5fd926b812d1acbaf5f1a79d3d482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0190fc2d-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089288, "uuid": "f21194d5-b46b-4cd0-9232-56c9c05942f4", "comment": "Malware payload", "value": "99cffc50dc9723da1447dad74d857869", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089288, "uuid": "fd74840f-d359-483a-88cb-ea53f5ca3f42", "comment": "Malware payload", "value": "d89994b944d7f411b207f0d39b39f5310b6c8bae77561fb48a30c71449fc559c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089288, "uuid": "d86e715c-1db4-4f99-b763-acff0b58bd77", "comment": "Malware payload", "value": "c11f5cc74573bf88f94850971325aa403710999d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089288, "uuid": "a2c5f9f7-b299-48ca-9679-e6a86372b16f", "comment": "Malware payload", "value": "66369841e760f9dfed5675b86e2fec1cc4fd055bc31e866ef7ab02a13a45b510fededecef451f75382d4862838cc6b5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089288, "uuid": "9e370c85-95d2-455b-bcd8-07e9dd8a02a6", "value": "T133452347D2F8406BC4F02B78A8F21B971B327D5349B883576B09DD8769B3A88617137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089288, "uuid": "630774fe-5342-421c-bb3c-1cbf080a5e24", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089288, "uuid": "ce999e82-bc0a-4e16-b5e2-7ed276c5d72a", "value": "24576:gyOWoswTawkf4d4xXN1ohn2O5Rrh9lEAdZ:nr2Mf4ixjOrrbiAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089288, "uuid": "a9ec28b2-576c-437a-ab41-d6a7d7996366", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089288, "uuid": "38ca0382-4d04-462d-b244-b6ee81227918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089288, "uuid": "f79d6832-a893-48e6-b5e7-4435540d046a", "value": "d89994b944d7f411b207f0d39b39f5310b6c8bae77561fb48a30c71449fc559c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ad358c-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089290, "uuid": "34d545d4-3e3a-4fa8-84a4-14286055edfd", "comment": "Malware payload", "value": "e3bfc348fe2f4498a8655af24ba9ec27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089290, "uuid": "4474e3b1-a1d0-4527-96b8-225f06a2e842", "comment": "Malware payload", "value": "d8b5a3960f5aef160acf99aa6e004c428bc67265c7e559b2955d81b050f367c5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089290, "uuid": "dfd76e5e-3310-4d15-a446-e6ccd5cc319f", "comment": "Malware payload", "value": "44a7979f291e9df386976cde33c833061194671a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089290, "uuid": "fa4a1150-6319-43fc-9dfe-f1c31386bfd2", "comment": "Malware payload", "value": "e0805cc23377cfb5062e46e8a9674a93d755ed51dc1b1e6c2d218464e6009a2db32e1b68b8610959e090977bb25d2c70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089290, "uuid": "6bd8f3a5-64de-45f8-8d70-514fd642beee", "value": "T100452302EED85032DDF42B3038F95BC30A72BD619A78432757472A5B6DA26D49931F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089290, "uuid": "a2b16caa-8ce5-47ca-814b-94563bc9ce00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089290, "uuid": "54ce1965-0487-4cb5-9454-eade51465087", "value": "24576:oycPHSd/FuMrSRUw8lTWpNpiExKK/m4xTLQm7JA7AuSb7jAS6:vcPSd/FuaOUpTKTiExL/Zkuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089290, "uuid": "6817c0e3-6266-4f43-8a01-cf3d36615b91", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089290, "uuid": "423fd0c1-c3b8-4fd8-9889-07bf98f0ff90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089290, "uuid": "cea73ded-d2c3-47b1-818e-8a38a98d9b60", "value": "d8b5a3960f5aef160acf99aa6e004c428bc67265c7e559b2955d81b050f367c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039ddf75-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089291, "uuid": "a5ff55bd-5067-41a9-aa3c-dc3c41704a8b", "comment": "Malware payload", "value": "4ab930b692f37794b17f7e2bfb6730c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089291, "uuid": "69e6eb96-338f-4174-ba80-3565f06e3fdd", "comment": "Malware payload", "value": "d8fc27a3a73f3add555c9e6e63fa933e72038548af1e341323c3d7569e48636f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089291, "uuid": "9219981f-befa-430f-8aec-38f3f5163957", "comment": "Malware payload", "value": "b46c0623889031199366d247c41dc720e7423b64", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089291, "uuid": "07bfa34b-c533-49b1-b973-18f10506d3fc", "comment": "Malware payload", "value": "a3b7c070a7d7231a392f832b7be95a0878cd71ff11ad38e7615b2a3e3438dfa144c1bea67f5f18076f883adc95568db1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089291, "uuid": "1a9c5940-82b5-4563-9d6e-02cda3c455ab", "value": "T1E5452306FBC484B2E8691B7068F241830E3AF4B29939D36B379795855EF2781F172397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089291, "uuid": "f7140c3d-bbe9-42de-8209-4bcf186edd5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089291, "uuid": "93c99d54-a6e2-485c-bb3e-cfa299d7418d", "value": "24576:IyFY73+Q+xuogvK9pzDS9BcN7EW0Ie2nmFZB5KmnvM7LyABB:PS3T+8ogy7DSLA7Eimj+p7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089291, "uuid": "6a356406-2db0-42f4-8607-d3154be10c08", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089291, "uuid": "5d607f96-0fab-4b74-a55a-6a8df6ee613e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089291, "uuid": "c5ad4c2a-8f22-4635-af14-14f8c971edf4", "value": "d8fc27a3a73f3add555c9e6e63fa933e72038548af1e341323c3d7569e48636f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046f3ead-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089293, "uuid": "e59552f3-c65b-46ea-bc80-190ab6320d57", "comment": "Malware payload", "value": "b26d8cbed74a8ccae4569e59007c90c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089293, "uuid": "f0c8fe88-9859-4e6c-9ef8-8f237fc980e5", "comment": "Malware payload", "value": "d9190ed86347f9cba9332dda6df8b0908fa99d65d3f716ee478d7cd4075098ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089293, "uuid": "74ba7e49-e7cd-4e59-a6e7-b7de96f1c65e", "comment": "Malware payload", "value": "9a2cb85a8c5c3dc269edebc04775f81d523f46d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089293, "uuid": "2d8f8512-100e-4ed3-a7bc-913ba7e3c63c", "comment": "Malware payload", "value": "51ccce07fdd7ee3c02eac4a4710da21ce231101bfb056dac81e8163ddb0f22a1c2c1519fdaaabc7c1afe4b2ba9af56a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089293, "uuid": "11f0efa7-ff39-442e-bf29-4b3e716ea800", "value": "T16E152316B6D880B6E9B11B708CF613871B367C619D74562B2B598A4F1CF26C0E13937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089293, "uuid": "f673b4c5-e8f7-4c6f-8c34-d7e591acce1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089293, "uuid": "c6b8a7a8-5669-43d3-a83e-94b596931c4b", "value": "24576:YygohGhAIikZXAfQDYogy2k/buxH2w08Pb:fnGhak9uQDX8Wx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089293, "uuid": "c9a976a5-ce5c-4498-9fb7-58ccdcbb914a", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089293, "uuid": "77f54591-3ab9-4f0b-b2f9-56d007ca3ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089293, "uuid": "84398e1b-adb0-4720-a3c8-a6a641590e12", "value": "d9190ed86347f9cba9332dda6df8b0908fa99d65d3f716ee478d7cd4075098ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05985fa6-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089295, "uuid": "c54ab5a9-789e-4c4f-8217-c6894ea6666d", "comment": "Malware payload", "value": "3bca238510a29757ef4e621ccbc9f9cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089295, "uuid": "5730934d-e501-456a-877a-30a32398bfc8", "comment": "Malware payload", "value": "d91ec04c5411113210b221afe7d140b0b45afebdbf0c25da28b0ca34d055d42c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089295, "uuid": "c34ab3af-98d9-46de-a268-d18baec51ee6", "comment": "Malware payload", "value": "df221fcee7a5cda7ed4447da94547c663c0bc990", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089295, "uuid": "2a6494a6-152b-4b3d-8b3a-147b427fb1df", "comment": "Malware payload", "value": "03013f7f394f67ddd6cda595c8ba42a00e50e4fcaad8b22fc8b261f57d44c5a8b806e2bd77594890977dce30143b10e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089295, "uuid": "cca1a780-79a0-4102-897f-5ee463ceb855", "value": "T11C4523A365D88073D8F567B468FA03830E3ABDA09D3AD61F53C9684619B27C0657237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089295, "uuid": "60d30c8e-40e0-42d5-b38b-053340909724", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089295, "uuid": "b1c01c03-9971-40f0-8001-57bba0051f8f", "value": "24576:OyUfZHoo7usKHkDiGhUJhurBpJCi+AaaiWKNtRP22TXFRK/irdA7:dUR6sKEDmhMQi+Aa9zNjPJT/oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089295, "uuid": "36b95645-b6b1-425a-8b08-4de79f5fea3f", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089295, "uuid": "ad640bfd-7939-4632-9a06-5face50c6a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089295, "uuid": "e893e51d-9e37-4147-a10b-1ff905e3a6ac", "value": "d91ec04c5411113210b221afe7d140b0b45afebdbf0c25da28b0ca34d055d42c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067632e8-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089296, "uuid": "7f2fedfc-3615-4e2a-8b04-8eefb96fc9fd", "comment": "Malware payload", "value": "744c6daac97ef2783b1edb2501119896", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089296, "uuid": "06c89236-c515-4bb8-a86c-468706a7bbf4", "comment": "Malware payload", "value": "d91f57441261b037611da6c2820c9ff467675fb4e04b8a550409c99e93970ff5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089296, "uuid": "91b6dfd1-743b-4429-aa0d-6953a46e798d", "comment": "Malware payload", "value": "68e7db3d247601d7228fff96fcbd7297f76c44bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089296, "uuid": "cf7993b7-92ea-400a-a04a-e5d31232d63e", "comment": "Malware payload", "value": "57d69e7ec98454ae34cd4606cf8fefea2240e5033dd2a9ce3b3bd8c62cd85158a46e07f042e93e64d3ee219c9785901c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089296, "uuid": "65cd038d-3d39-4ecc-a4a1-30085a90886e", "value": "T13A151252FAE89633DD7927714DFA13C30B35BCA25E30429B5386495F0C726A8A5B133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089296, "uuid": "98de24ac-25e1-480a-8ad7-535485254752", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089296, "uuid": "66bd97b1-3f83-412b-a7e4-022d5f79fef9", "value": "24576:6yaJQSl7M5eVCjqkrN0n2HdXtSo9K8Bmh0kUWK7x:BaJQU7M5eV8VrC5o9K8e0Fz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089296, "uuid": "d25d7922-5ebc-49ab-87cc-9414f3684f56", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089296, "uuid": "2d3b0c17-efb0-43fe-be0c-bc37bc2f8a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089296, "uuid": "373c22fb-5825-4f25-a012-b6d4711aa97e", "value": "d91f57441261b037611da6c2820c9ff467675fb4e04b8a550409c99e93970ff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3858593-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089694, "uuid": "5e76c4ea-346a-471c-9a38-5fd447d13698", "comment": "Malware payload", "value": "fefbe2912c3a7203b24315333d9b63bf", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089694, "uuid": "01107f72-0c1a-410e-9d35-2d0a9c43bee8", "comment": "Malware payload", "value": "d9b8890ce626d1238d2d50536cc7a699347c01ee4d9567c1a0994e7fad3ec973", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089694, "uuid": "9b0b5177-236b-4fc8-8b8a-4efad01df56c", "comment": "Malware payload", "value": "8da5826f4d287e4c2920091597987ec496916052", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089694, "uuid": "a80e7d3a-6f9b-454f-8718-5aafb431468b", "comment": "Malware payload", "value": "7096a56ec123f9db6ddc4f9b326e89e962d87a7de425b6499a2bd658c92a9acfe004cf9890e4818874c1560d7668d299", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089694, "uuid": "5c09121a-d354-4988-89d9-0b5fba1d0efb", "value": "T1D304BF05EE57A8F2ED0B45301647E77F6660BE2083289E03E78236BBDC775A29703752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089694, "uuid": "eee5b73a-71fb-40fc-932a-599d683e1559", "value": "28a099a911237a28521d8b7ea250f089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089694, "uuid": "3853c794-5e59-4182-8eb8-2ca9214df323", "value": "3072:VnOn7t7XpdpCCTg/sxFgJDhQtmCw2lB/AQTmO42Pp73xd60diTbcUB78zo+8:VKpdcCrTqhUfw2xm/2Ppj60d8cm7lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089694, "uuid": "fe4013d2-c653-4385-bb9a-907659cc7479", "value": 178672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089694, "uuid": "52f39cc8-1c08-4d8d-81ed-b3b7cc727f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089694, "uuid": "8f63915f-cf4b-45df-b3a7-a85b6f3273cd", "value": "Spring2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a9d131-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089298, "uuid": "8212afed-40df-4381-a035-ee3adbd7df0f", "comment": "Malware payload (RedLineStealer)", "value": "91a130601f9f7b889e643124b90f45f5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089298, "uuid": "301190f6-5a05-48c4-bd3b-1a4e76cb783e", "comment": "Malware payload (RedLineStealer)", "value": "d9cd3cc8b8b5f1108c4ad502aeb3f94f468978206080c78a65266c02dc9faf44", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089298, "uuid": "86fe5115-1cd2-4ee9-aad5-f702080aa38a", "comment": "Malware payload (RedLineStealer)", "value": "650b68ff654157f7963a7db2c6a8d69d48d66b7b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089298, "uuid": "18573d89-15cc-47df-a042-a34df84beb1a", "comment": "Malware payload (RedLineStealer)", "value": "e4e76f6700ae73bd3bf444f96cd594d8200ea142b436f1b02d0cc6c6c47e16ee4e3fc220975bfde18c84dc1ea057d075", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089298, "uuid": "fd7d9b07-011f-4c4c-aa86-47c888086c8f", "value": "T1E7452303F7E90073E8B22BB654FA01D34B36B8625E79436B37559A5F2CF19888635327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089298, "uuid": "c0b55769-db18-4365-886d-c7862120c2ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089298, "uuid": "1f43a406-59d6-4efe-a9a8-6de49caa861c", "value": "24576:ay8V6fB1QsWZ9c45E4g9/fLBac0XKc5hWKWboeLQf6:h8VUe9tE4g9daJ/5hWK0LQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089298, "uuid": "cace9d9d-cb41-406b-9a23-a754d1666866", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089298, "uuid": "d6c6d8b2-c568-4bfd-a8d5-dc3a7803dcf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089298, "uuid": "86434e83-582f-464d-a027-431c77d9e7d5", "value": "d9cd3cc8b8b5f1108c4ad502aeb3f94f468978206080c78a65266c02dc9faf44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b4c344-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089300, "uuid": "fa944290-8546-4d9c-ad81-6413f6a87ee2", "comment": "Malware payload", "value": "29d7e45b43ec1d43ebb98fac13c15c4a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089300, "uuid": "52f70bdd-9211-4843-a8e1-c8843abf743b", "comment": "Malware payload", "value": "da001378fabef8421c89bf648c9729ac6ec8fe5a4dcf6d4255928ec997385008", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089300, "uuid": "3579b007-c256-46af-a4ac-caba7f145084", "comment": "Malware payload", "value": "c53bb9b748fe8ea407a255af188a9fd982e1a19f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089300, "uuid": "99a790f4-48c8-4d56-b54a-8dbca6ad12e9", "comment": "Malware payload", "value": "0a8f00e6d1f4d55ab6b2d725dafd03cba58499acee1721bf676e0c514daca4afc360f9f8ae32f757075f81e4ec6b88e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089300, "uuid": "eeeb8057-5f4e-49e5-a1fb-7b0991c694e5", "value": "T1B94523636BE48326DCB057B048F615631D3AFC726CB8939B2760A9470CB36C9A53176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089300, "uuid": "ab0d9ab5-f65c-42d4-a2a3-a142112bc1f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089300, "uuid": "f49d55de-5368-4b38-af6e-b0fbd1a01221", "value": "24576:hyL6F3AoLQUim3RSibOoRL7DjUDzabP4zqzodPy0Z1fTvx5+56:UL6VA41im3R7I24Guy0fF5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089300, "uuid": "8da5c295-dde7-46d7-adf4-ef2ad23bf376", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089300, "uuid": "050191a8-4bcc-4fb0-a58b-495facd26f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089300, "uuid": "6de715a3-eff2-4b3c-acb1-71f76aac5357", "value": "da001378fabef8421c89bf648c9729ac6ec8fe5a4dcf6d4255928ec997385008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c43b33-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089302, "uuid": "1f492da6-fe22-4ba3-be3b-f20ae9a632ea", "comment": "Malware payload", "value": "4ae9a83a96fd74b0d8b8af5cb5993020", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089302, "uuid": "2e4f99bc-4f6f-43ce-9d40-b698a42885ec", "comment": "Malware payload", "value": "da008f7dcc1d087a6f48cc5da1ed7c97e58261abbe31596ae68e187f0dc865ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089302, "uuid": "d942ed85-bbf4-4dce-9f1e-731e9543ec5a", "comment": "Malware payload", "value": "437f85512b0d43edaa2e6476bebc2bec53ab8e45", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089302, "uuid": "1bb1d418-0cb3-466e-ad2a-f6e9fb9f23f9", "comment": "Malware payload", "value": "54b7e4a1fa380c3029bda3337807d50565c9c173e597f5e569fda7a08ac93d616a2d1d1f5fa7e7bf951fcc808488b72f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089302, "uuid": "7d3d8235-4384-4750-990e-350427ad4c05", "value": "T1A7452306BBC90436E5B86BB15CF7074B073E7C829E79426B27D1098D4C73790AA7276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089302, "uuid": "7ad6e132-4021-49fa-9af1-8b9129dbb2ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089302, "uuid": "09b59cd0-833a-4036-b92c-cdf94d097f0d", "value": "24576:pyHflG149Pm3Kk5/j84pANdix6wylAwFpDa:c/l79k57oGOfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089302, "uuid": "ce70a07c-8f15-4fd4-ab8e-f2cef834ce55", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089302, "uuid": "8b70b9d6-5622-4af6-a7bb-30abad2e6929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089302, "uuid": "3a1b5a5f-6de7-4ac9-b190-b884ba4da6c8", "value": "da008f7dcc1d087a6f48cc5da1ed7c97e58261abbe31596ae68e187f0dc865ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca96458e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089625, "uuid": "a88c0286-7b93-4b47-ac01-34c22ffbd66d", "comment": "Malware payload", "value": "98f00819ec05955ae3109305e14d8f09", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089625, "uuid": "53e7cdac-5d6e-48f1-8951-128023079c3d", "comment": "Malware payload", "value": "da22c3632239f33fc51ca0b7617c606d60f3b1dd3a225b01febed0602553fe15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089625, "uuid": "7bf92f6d-5394-4714-8785-3ebc3c4681f7", "comment": "Malware payload", "value": "679d36a2d0d5d06fda72c725f63595e5e553a5df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089625, "uuid": "66b95ec0-a98d-4123-a9f6-1c09233d749e", "comment": "Malware payload", "value": "abcd1b000553a1c29a29d1057ccc8b75628680c2f8af9457a56f260dce56cc9ca0e29e988ad0b714235a568b2e327030", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089625, "uuid": "42eb203a-251d-405e-883c-9fdaed7987eb", "value": "T16A85BF0E56440D3BD7AC5B3E846E4241630BB454E302A53FA3DE59ABEE477A29FD4B0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089625, "uuid": "f3c36f4a-ecd6-4a53-91e2-2b8ff6bd2348", "value": "edb52e2d82bcafe2fba2f7d58f725f44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089625, "uuid": "7d464e1c-6605-45f7-9e83-dc00fa341ea5", "value": "49152:nT4iX9y6yDqEoTBxwmAD3Ptlj/h1wKHHJ91mD23av6+uAt8Wr2WvlIB8/i6u2poq:n/X9jhEIqmADVd/UKH1mD2qiuAx23ixc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089625, "uuid": "88551e67-dc83-415f-9aa5-fd724e6c97a0", "value": 1792816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089625, "uuid": "570f4e3c-c9ec-473d-a276-8045e6736769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089625, "uuid": "c34ba23c-1a08-4b70-b4fb-eba6481152cf", "value": "MicrosoftEDGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae9a8cf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089304, "uuid": "4b687805-7d72-4e71-9170-10a51ce9083a", "comment": "Malware payload", "value": "e6fc341a881755c724c443435f92fda4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089304, "uuid": "668619d6-5da5-4799-9ed4-b285baf4169f", "comment": "Malware payload", "value": "da4507e2d7a582e217e85ddbdb524f7a501ef6ba3fd366b325e43944ea02a14a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089304, "uuid": "169bde47-dc20-410e-b7b9-fa4e45134845", "comment": "Malware payload", "value": "20dd2a952df6d6fd6a337279f979eb56b3e46b2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089304, "uuid": "28abd6f7-68fa-458d-ba26-6cfda06a5db5", "comment": "Malware payload", "value": "4b2e742f23a49058a804c5931bbe36860ce6298bcba99efdc77b2df1b1daac903708498af9192f86dbdb9ad61f1d454e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089304, "uuid": "18512bf5-197d-485d-a085-d2854eb0c6c8", "value": "T12945230767D92162DDE21BB069F612C30B767DA32878D3632745098E1DB2681BD327BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089304, "uuid": "d6a87d5d-ce9e-484a-afd5-9ed169e86f60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089304, "uuid": "3756b5d5-bb19-4823-a1a9-6d06e7cee7fb", "value": "24576:lyvYGppmUIrIbPFPVISbx13/fsDxb4InB7Hb6KQdQn:AQ6pmUfbPFPVPHjKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089304, "uuid": "da59493e-812a-4a48-a5b9-9a460c239446", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089304, "uuid": "0ad0d20d-abb8-4a76-ad8d-811dcb4c58c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089304, "uuid": "37ed7b90-ca11-442b-83cb-561d7c44b5b8", "value": "da4507e2d7a582e217e85ddbdb524f7a501ef6ba3fd366b325e43944ea02a14a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3052b51-f26a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684077533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684077533, "uuid": "1056733f-8893-416e-98a5-c8afa98db9ba", "comment": "Malware payload", "value": "8fae3ae30d173db65c69861c8e45e7a4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684077533, "uuid": "ddc04bb4-fa9f-4143-b71e-ab19fc5ec71e", "comment": "Malware payload", "value": "da5c2c55c3e1353f6124dec5cd1524b9b93b8cbcf4036d6cc727aba5c8baf809", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684077533, "uuid": "129351f6-a66a-49fa-acd6-75890194d901", "comment": "Malware payload", "value": "ac02be4505e0ed73e4a33925c7d53ff6a46be93d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684077533, "uuid": "d333a02b-5f55-4cb8-82fa-d93115363f38", "comment": "Malware payload", "value": "8a7a4b33b79d72551cf31378929357e3aafbb871e30d8dd3239b82f20e9e473abde03ccef4cc74cff26366aa68118687", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684077533, "uuid": "b75dc12e-908c-468f-96ae-9442865a29da", "value": "T15E25336ED1ACD8FC0BC1EAD2217CB7AC59576DA8518B4B82D8A08543DC39D8FB047DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684077533, "uuid": "adbff73a-cb60-407f-8904-0954cb8bebaf", "value": "24576:KaFGbt9nCMcotiiyOgnWcY3MZzqTNaBQAWy8mX:Do59CMcMQWcUrUQAWVmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684077533, "uuid": "d8e56dde-031c-4e73-ae80-ca558aaecd0b", "value": 1007441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684077533, "uuid": "f7117c95-0455-4bc6-b33f-060fbc7ad0e1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684077533, "uuid": "f9752815-ff60-44eb-b4e0-786217db1826", "value": "Google_AI_Marketing.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307b6fbb-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1684055866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055866, "uuid": "30cc5f96-0f72-4564-b611-8924cbee2359", "comment": "Malware payload (Guildma)", "value": "7a367d3279bb3287198bb1cc84beb9f9", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055866, "uuid": "f63160bd-62c6-4b53-be29-772461539b16", "comment": "Malware payload (Guildma)", "value": "da642ad8df5a83ac147d858adf2b46381e9da2e6d68041415dadfa98ff99dff1", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055866, "uuid": "d508f5d8-c1cb-4d77-b066-c89797202538", "comment": "Malware payload (Guildma)", "value": "e0ae2d2593ac69084888d471784ea709f456a5ab", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055866, "uuid": "c8e5e461-3ddd-493e-8625-7ffc4c689fda", "comment": "Malware payload (Guildma)", "value": "0b99e5e7361c88c5242ad5b1361b29063e41a2c3689b219305bbd9c4c7a587e7ed2b745bf3588d3bb2399630a3c58c28", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055866, "uuid": "253a4b02-0990-4686-862c-ae77ac0ce4d6", "value": "T14C11FAA5D76A1EBAC8734B72CC306C0C58B99CB60E5ED09DD9233498C5386951F81769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055866, "uuid": "41dd0bdb-1741-4016-9a65-68340d0b9cef", "value": "24:8loGtF5FhNBuTfe1a8p40ux3FOjaa+dBtC:8loIF5z+Tfe1a0gZaOBtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055866, "uuid": "de1945ea-cc52-4fe3-a2ba-bc1954f1fb1f", "value": 1047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055866, "uuid": "8cfbcfff-3d4d-4e22-a81f-c439aa319fae", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055866, "uuid": "fb2c4259-53ec-4d10-8b35-2b2dc9f5ca31", "value": "da642ad8df5a83ac147d858adf2b46381e9da2e6d68041415dadfa98ff99dff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcf7912-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089305, "uuid": "a2a5bc93-6894-4bc8-a78e-6537992fbac7", "comment": "Malware payload", "value": "1ab3d9a89c7c90aed3ff48694e6e1df8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089305, "uuid": "551cb43d-1c00-4c8b-ba06-45e6d31669e2", "comment": "Malware payload", "value": "dab8677a33b32d5206686fb1c8b1e902d91181de755d1ddefdece055c8412a2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089305, "uuid": "a9820694-02c0-47dd-8816-5adb840aeb17", "comment": "Malware payload", "value": "7eb8ded24f4854d439a50380534cda8e4a301b16", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089305, "uuid": "ea387a21-40b1-4264-8262-cef4d1ee6cd4", "comment": "Malware payload", "value": "bee2ba43960b403ce14edf014e383e524e4ea311186be673160abbb681093d3ec9304814cd0813b5cd715c249ed92d92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089305, "uuid": "9860df87-d198-4833-8550-e9f4b816c283", "value": "T1EE452313E7F54032D8F02BB071BB12831B36BE553D79032A2A871A275DB3A85B971767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089305, "uuid": "1ebbe866-237e-4963-9956-72e21ae0b986", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089305, "uuid": "1db3c18d-92ef-439a-8c84-9dfdf536a5ab", "value": "24576:by+hQl9xrGnu2q+f88tHGw/rWYxy+K4yarA2zFmdYaf:O+oouhaFGw/l9jhpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089305, "uuid": "4dfed522-7efc-4752-9e50-8b1fdf765317", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089305, "uuid": "d669a62e-0337-4e3c-86f0-d805efb34f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089305, "uuid": "b2ce2f1d-9a36-49b9-a8d3-1905b05cc25f", "value": "dab8677a33b32d5206686fb1c8b1e902d91181de755d1ddefdece055c8412a2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7068a7-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089306, "uuid": "551e5e9e-8106-4467-b218-611a6cc3dd30", "comment": "Malware payload", "value": "89f79180e4f16bddc7ebd365c5bfc69d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089306, "uuid": "698bb8bd-0132-4d9f-9ba6-9f731b7ad773", "comment": "Malware payload", "value": "dac3393950edd77dc42ecfe5cff0081dd33673a7a37e1ce999d9b1e6fc6de879", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089306, "uuid": "bff45011-4cc7-4866-8b82-d523dc509cad", "comment": "Malware payload", "value": "7a40d5f01bfcf8238d254cbc5877d8fdaa23d862", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089306, "uuid": "319d382c-2aed-4e36-b2d7-fd38f4de5c53", "comment": "Malware payload", "value": "e39b2b7be4539b4aaeeb2bfc3b67d012cca7470ea244873f871579da51646a6f3a1fe4878db55709bed0211f6367bea5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089306, "uuid": "3cf650e2-238a-419c-9890-249a0bf965ae", "value": "T109F41252D3D8D037E8A92BB114F60B97253EBDB2A838853917859D0B1CB31C5E67237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089306, "uuid": "a9a90201-ae65-4204-8e6d-56a239baa787", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089306, "uuid": "a84176d6-737f-4213-9e97-15dfbf4f8fd2", "value": "12288:kMrEy90n/I8aQohasq+5IDuCTCnLWA0jpJsZ/Phm4xMwovxG2lRw3zJh:wyA/HaQ8aM5IC1KAWw/ZmWQDc3Vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089306, "uuid": "3da5f2e6-6140-4f04-9790-ebd88226832c", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089306, "uuid": "a0b27565-0d08-4030-bc91-eff8b3a43178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089306, "uuid": "0306a888-fd3b-4ee5-9e12-4de9320d16f4", "value": "dac3393950edd77dc42ecfe5cff0081dd33673a7a37e1ce999d9b1e6fc6de879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d88a9cf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089308, "uuid": "3668be4c-b7f6-4227-8f4a-862b4b8d7005", "comment": "Malware payload", "value": "239f9de8a3fae44b6bfe4c31b59b05e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089308, "uuid": "1fa9a2da-443c-446c-867e-e816a1a63fa9", "comment": "Malware payload", "value": "daf60a5bcab1649d22f424e0bc41b0a4d9cbd444c42ceab6f129883d32e4a675", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089308, "uuid": "37e87ce9-8964-49ae-8bd7-ab0ae6080190", "comment": "Malware payload", "value": "1bb7338ca10047a6cd242be59a6d27796c1816db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089308, "uuid": "7da22eb0-1324-4c2f-9de9-5f8ad243825f", "comment": "Malware payload", "value": "b43647944c69bf8c200193349ec1c661cab65ca10e717c261ab4e26fa1afa43b1088e120217cf0618893707ed4ad2d1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089308, "uuid": "e19da191-9363-4bbf-9c7e-612e5edc5183", "value": "T190452352F9EC5033CDB107712CFA03475637BDA19931832B33856C9C4A73AD4A8B5BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089308, "uuid": "fe5a27a9-66f0-454a-b8a5-1edcd89fa44e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089308, "uuid": "940baba2-c6b8-4ff7-b5b5-77fa7d67fe35", "value": "24576:1y2coo1nqFNHm4ubkwE8RN+sqG/O96OMOVghuglXf6Juua:QvomnQHGC8f7W/ghuAPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089308, "uuid": "40dd7a55-6193-484f-a5c6-2202184c7bce", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089308, "uuid": "71804a3a-e2f5-4759-98ef-24998226ac4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089308, "uuid": "27d75253-3f0b-464e-8c47-191cb964944d", "value": "daf60a5bcab1649d22f424e0bc41b0a4d9cbd444c42ceab6f129883d32e4a675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3a450e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089309, "uuid": "edc3671d-c6cb-4d1a-ac69-bb4f12ae35f7", "comment": "Malware payload", "value": "3f246db430d32c4d4aa98fe076fe11ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089309, "uuid": "9a5db791-0932-46b3-bf54-e551fee30e0b", "comment": "Malware payload", "value": "daf73aaa8c657787d6266afe9c9c489bcb694e074bcbffe9e3bb09109a82ec8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089309, "uuid": "85f43b87-a079-4cf0-ba0f-ace9a3922e59", "comment": "Malware payload", "value": "ed3ee3414a5fc06a2184445cba8b2554f663c6bb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089309, "uuid": "29bad894-9acf-4b8c-9102-be01df6e216a", "comment": "Malware payload", "value": "69e79bebd2671d3457fe0da371541d55c3147fa98586d5f1445dfcb860f5517842442dfc4d3cbc65d474fa21464cd77f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089309, "uuid": "7633faa0-b57a-45a0-b42a-b52a62176cef", "value": "T1A0452343FEE44073C4BA2FF458F613830D31BEB0AD6993A92646954A0D73A84BD72776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089309, "uuid": "be7b548e-0735-4c3d-9663-b318a7f12785", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089309, "uuid": "a3ab4a35-a793-4bf8-8e1a-0d869d031208", "value": "24576:XyNjvyihhdJ3m9/CvFEUC9mSShE8e5IsmddQZKSP0+Sf+:ikS33m8v2UHSwE8eiPddQZtPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089309, "uuid": "b26a90e9-559d-4250-b7f5-8e384397e1b6", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089309, "uuid": "25aebfb7-fdd6-4cca-ae45-b21e23279190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089309, "uuid": "ac34b6db-96e5-4919-b2c2-f498f7756dde", "value": "daf73aaa8c657787d6266afe9c9c489bcb694e074bcbffe9e3bb09109a82ec8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9455865-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057357, "uuid": "9b093827-1fab-4577-9fcc-e92fa01a482a", "comment": "Malware payload (AgentTesla)", "value": "c45beda3a101be6107772e098234eb3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057357, "uuid": "af174f29-7b5a-4c2e-86b4-b11592b92ba8", "comment": "Malware payload (AgentTesla)", "value": "db03d92258b91219363c636de58a607ef0f1346c6486f866e3500bfe24c85b42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057357, "uuid": "6fe1fc6e-ff92-4834-a2eb-d18d52ecf272", "comment": "Malware payload (AgentTesla)", "value": "e7a5a3ee509fb12f285dcc284a7ff1b50d3ae05f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057357, "uuid": "478279be-1a1e-449c-9719-3809d62cdd3f", "comment": "Malware payload (AgentTesla)", "value": "19dc8bc5703daa4e3f934717caf4df7610e284ed06899be71c0ef10242278eed02b14c4ecf9e0a9c2ef3104a19fdad2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057357, "uuid": "af35e579-9d48-4585-9d1c-632003ced168", "value": "T125F33A2972C99B52D72D4478C46011480BB2A143B61BE75D0EA19FFB3E8E7C3363AF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057357, "uuid": "ecb845ee-6464-4540-bbb8-1e615cf29da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057357, "uuid": "4a01fedf-dcb1-49a8-95cf-c63e71e3f693", "value": "3072:3kxWSGcJKcSpmHsRn7jtvaU0JrX1p2zxAIVWZDgwG0V5Lp2:3kzJKxQsR7jtx0Jp0RoZ6CZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057357, "uuid": "0b5bbdbf-37d2-4f2b-8fbe-0d463674ec93", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057357, "uuid": "8acf80d9-be79-405a-ba86-363b100f8679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057357, "uuid": "95d2cdbf-d7a7-4d17-b317-7b5977eacc4c", "value": "db03d92258b91219363c636de58a607ef0f1346c6486f866e3500bfe24c85b42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ab2cf9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089317, "uuid": "40285dfd-9657-4950-b731-8cde3c31a88e", "comment": "Malware payload", "value": "36d7edd88ebb8fc2632d64d6ff6e42fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089317, "uuid": "b9fb6f3d-757e-4179-a067-6ba42ea84060", "comment": "Malware payload", "value": "db385593fa5a6193a2010d3368892cfaf13b71a9bf86c8e38631b2fa35e51339", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089317, "uuid": "7706999a-2807-4d8a-9fef-a51c3bfa5591", "comment": "Malware payload", "value": "a55de1dfba92650affd8fe6fab11824267f6ced2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089317, "uuid": "0a434192-fddb-4dcd-bfdd-00be699d6c72", "comment": "Malware payload", "value": "f7f414a5a3c25a7d14ec75b2a30b90c971fae566e07329275fa6899e1399252c8bb2e5e0328722575d225bc8d68eb1c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089317, "uuid": "79c39646-bff5-469b-965d-3267365f7a42", "value": "T12B452313EED8A132EDB51BB408FA07670E327CE589E4839B2394658914B3FA1D13577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089317, "uuid": "f328fcef-9180-48c4-9539-78618f882587", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089317, "uuid": "1e954aad-c5d3-4136-b3ec-415ffc99ee4a", "value": "24576:ry9QoZeCnSmc+ubICYffZcKI6BnN/Hp2J7fMw+eoPlLtFh:eHnSmeECYfxcKT4fMw+zlLtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089317, "uuid": "106c616d-b8a5-4a8a-89bc-5007e0cec4a3", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089317, "uuid": "c7a1780f-a0c9-4f59-adc6-e4830456de4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089317, "uuid": "2e92b005-46a6-467d-b8a2-903678931a3e", "value": "db385593fa5a6193a2010d3368892cfaf13b71a9bf86c8e38631b2fa35e51339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135b1f1f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089318, "uuid": "5f8c139b-8b5d-4ddd-9f37-7e11e42ca464", "comment": "Malware payload", "value": "d40957899e583832b869ac607b5ab1e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089318, "uuid": "ac55dcf7-e894-4f73-be16-7172f7de4935", "comment": "Malware payload", "value": "db4adf065c37b1149b2ab9118d0cc7b7b76f7cc7c3ef053cb7b6975e539f2ba3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089318, "uuid": "3cc8b24d-20b2-4109-9cf6-e5ddeae43252", "comment": "Malware payload", "value": "034243bec9a7301c014fc3277a4175ac1170d5a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089318, "uuid": "4e32dae5-63b0-4a99-ba38-bc43d753be20", "comment": "Malware payload", "value": "8e8c05e9da49d2441e5a875bf205db6e4bdf7acee50f3218277e20ed7ce0b8a3f7fa5f400971fcd9b32e164d43ac4e98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089318, "uuid": "194b6d1b-3e26-48ab-a89a-32d745802e2a", "value": "T194452343BAE08476E87117B185F99AD31B317D17C875D63A23E8C98D5C323D4EAB432A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089318, "uuid": "acf9be70-f18d-4fd9-85bf-b31d04c1be89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089318, "uuid": "797e43e0-8c22-4c28-aef4-81639d2e7311", "value": "24576:MyYCGchqs+RXvPtUVb7SywHaBD9EzAeT6fqjgXwjFFVp3hgIV:7fvqrBvPGy/6BD9a6fqjljDDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089318, "uuid": "749d7059-a0cc-4890-b582-611e607d3d55", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089318, "uuid": "08258643-e348-41b7-bb07-47208cb40061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089318, "uuid": "ec0fffff-16de-474b-9779-7340a3975857", "value": "db4adf065c37b1149b2ab9118d0cc7b7b76f7cc7c3ef053cb7b6975e539f2ba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142d7932-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089319, "uuid": "1f74727d-5653-48fe-9323-d9e20ae28776", "comment": "Malware payload", "value": "8a26fac79a2831e0d76ede5af7aa0102", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089319, "uuid": "2a104f2d-dcbc-487d-b914-0095e076ff94", "comment": "Malware payload", "value": "dbbe21892c560d16dda10d1412804f756435f146bef6fbceb9f9d7d7cfe8dff4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089319, "uuid": "63dc515a-dae7-4c7e-a6a1-05c2e9156631", "comment": "Malware payload", "value": "a44853e23516e97cd2df05dc8f54ca0caab2ed34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089319, "uuid": "98120920-9b72-4542-9959-0abdc36dc280", "comment": "Malware payload", "value": "01e228cddaebed03eb753f4fc0741733dd2fdcd9a29cdf4d34e97e7cb8f7eb0f25903c26a97fb8bc6f88e368022f2b4d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089319, "uuid": "9e7135e3-29e9-4123-b743-3bcf4c25b06c", "value": "T15415230377DD4572ECB8637058F647D30A3ABD720AB8979A2740A94B4DB3244E87277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089319, "uuid": "9c957b07-9225-4c19-bb17-e066bc72ba1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089319, "uuid": "75e8b0be-1010-457d-8b45-089207ce3a2f", "value": "24576:oymeTrUf2VfZi9uPzSajnX1ftRhAZA12SZ32St+:vmKrPji9aOYnFLhAZYkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089319, "uuid": "802a808b-4d9b-40df-a809-02bb699d449e", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089319, "uuid": "f9822901-f080-4e33-b938-923f0c21273f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089319, "uuid": "51df1a45-7a73-4d67-9036-4bcf7fdf7f2e", "value": "dbbe21892c560d16dda10d1412804f756435f146bef6fbceb9f9d7d7cfe8dff4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159ef0cf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089322, "uuid": "bf67306e-1d9d-42bd-abc8-664e395a02c3", "comment": "Malware payload", "value": "d0b05e0ccdc691261585d7d2c06f1954", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089322, "uuid": "3c1b01c8-19fa-4695-932e-a5009842cc1a", "comment": "Malware payload", "value": "dbe683197f6a83939cbc1b0f212eeb76a0f714b67ccefd264452928e1232a629", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089322, "uuid": "a87c4ba4-5840-430d-bf40-4a7b92cf4e56", "comment": "Malware payload", "value": "92e2e528c04a97b03dac52c4e7cd40f78d4509db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089322, "uuid": "79d22391-88b6-404e-aaee-2a9f23a20849", "comment": "Malware payload", "value": "aff39d58b534b63ea0153b93fd925fb9c01dca637a92e123192c6df236ebae05e87168ac9c42c3ca4cb0c9d04c0ecdd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089322, "uuid": "5c015800-6d17-4771-97aa-109b065d399d", "value": "T1F0452342BBE49032E4FA4B782CF113C70F36B9B22D649207375594961DB36E16A7273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089322, "uuid": "3537acc3-5c9d-4705-ac3d-0b0f3c66e060", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089322, "uuid": "bcc43cc5-e1f4-4648-b9de-173249d354b1", "value": "24576:5yNrXK4sV0drTmiUu8Mbj4i9og/yAw5OlF0FaS0fBpSMMuaj3vhiryLeOicdDXf2:sBWV0driiUebUgF/MiSFUBpfMBj/hDaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089322, "uuid": "0edc2075-aaec-45bf-8633-4c10103a04fb", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089322, "uuid": "b50c0a4b-1b7f-497a-bd27-5d93ee48ae9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089322, "uuid": "4038e917-1d51-4775-9f40-2c08c660c5e0", "value": "dbe683197f6a83939cbc1b0f212eeb76a0f714b67ccefd264452928e1232a629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e640f7-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089324, "uuid": "df4feed0-2e13-48bd-b430-8a8b3e78dd29", "comment": "Malware payload", "value": "f01ca852265fb2c0a6267f7c3c05cde3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089324, "uuid": "6b449350-b30a-4706-8e0f-25ac6cba278a", "comment": "Malware payload", "value": "dc0d7d5fba6ac5cf9a83f5ad5c5519c3a622cd2aea74324a6a26c4b60cfb14d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089324, "uuid": "f8f21516-6a3c-4cc7-91df-abe22b8fbb17", "comment": "Malware payload", "value": "fd8dd033451c0f8f7bced663df70aebff5bc588e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089324, "uuid": "13820878-8e08-4f15-88a4-6b728a60f23e", "comment": "Malware payload", "value": "9ac8fde8fdd1b0d30e75c8f3c8c56d26752752322751878f78e82d3031ecdccb4464d8a4f7c9eea900f440121b0ce1d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089324, "uuid": "be5faa96-8399-4541-9b76-5a2fb9ae2abd", "value": "T196452307A6F45432E8F62BB014F24793093BBD918C3996AB1386758B4CB369075B637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089324, "uuid": "565ac433-924e-42bd-b93e-88986f722b44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089324, "uuid": "388d2bce-0790-432f-99b3-e71abafe5ee4", "value": "24576:FyALHGsMibkWzDLUKOo4kE+cDarWo11oCyCu1yqRKDI9Ox:gXHgekExD14KC0VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089324, "uuid": "93d62275-06f7-4f7f-aeda-4ee072772542", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089324, "uuid": "ca740970-30dc-4a38-9372-29ecb6733b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089324, "uuid": "c55a6a56-82ef-44aa-beb7-2f841d9ec7c7", "value": "dc0d7d5fba6ac5cf9a83f5ad5c5519c3a622cd2aea74324a6a26c4b60cfb14d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bd21d1-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089325, "uuid": "6a8a167a-80ec-4800-8176-473fcdbcc99b", "comment": "Malware payload", "value": "4a5f24cfd709a4e68233cd174bb6ba30", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089325, "uuid": "17710dcb-c30d-431e-8eb6-d62f045536b4", "comment": "Malware payload", "value": "dc12c4a904161e71e11c66421513be3c6714944bc8c0d7521d395879c361e213", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089325, "uuid": "1244763e-7cc0-4ac4-b0f7-4b928fc55e87", "comment": "Malware payload", "value": "2ac77fd56bef0dadcaead21802b246baa0f4bca1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089325, "uuid": "4c363ff7-d52b-4327-9e0e-22553598a3be", "comment": "Malware payload", "value": "cdfd53ccb7b18e6fccc1bc1e50b1b78d416e9a4d1fe926ec417215f04fbf1e4034a822ad7d8cf32d4220f556aed3932c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089325, "uuid": "d33cf1f1-8140-4590-8ab6-8799441a5893", "value": "T13B452312FAE400B1DCB61B7199F626D31A3BBD619D3CC3AE6742554A0CF21C439B673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089325, "uuid": "3e2f8e59-3a9d-4512-b4f5-e9af24603100", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089325, "uuid": "5f30f261-6e83-4992-8dc1-dd110511bbf9", "value": "24576:tylkgo6GfeuFwj1IBsA++q/c4fdim2mQuh9PKD2X:IlkgoVQLAiOiJTKD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089325, "uuid": "24471c8d-a0c2-422c-ab99-5268f160ba3b", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089325, "uuid": "cf945185-bdb4-4e7f-bca9-42e4a9e5f00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089325, "uuid": "0cf82e2a-e311-4774-88b7-e458694cb16d", "value": "dc12c4a904161e71e11c66421513be3c6714944bc8c0d7521d395879c361e213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187b8808-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089326, "uuid": "2d61e907-8adf-4ac0-8336-4615039fc573", "comment": "Malware payload", "value": "59f9c161b888d65a52cb086195bfc6cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089326, "uuid": "6593de50-2da9-472b-bfbd-d06d7fabb9ea", "comment": "Malware payload", "value": "dc476d17a4847cbac22174f204dd8b1e87adb1ccf56c092c4b04f4e3d91add71", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089326, "uuid": "356a0042-90a6-491e-9371-ccb8f31dd166", "comment": "Malware payload", "value": "b367f2d2a2244c5cf5e1a49aff09f97a71f61bc9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089326, "uuid": "96af50b1-4dde-428b-a1b7-1851ef25003f", "comment": "Malware payload", "value": "27492873cd1537170877893213fc59742b31e5f86c874e3799fbf81bba908ce89764578ac95c38735e1d534bdf3e1300", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089326, "uuid": "b7ef3763-5371-4813-9983-73d0aaf9bd82", "value": "T142252242ABD84526DCB51BB015F607C30A36BDA12EB5536B7B47E90F8CB38909972337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089326, "uuid": "5ab99b72-19fd-4c41-bf04-5ec6ca3d56db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089326, "uuid": "f71fcdf8-2da4-4891-b812-e49b27bef8d9", "value": "24576:8y6ONa/5APiaCfxta6/xBZrn+pltY3ZVJBNLaCbZ:r6ON0giRfXaWLr+plcZXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089326, "uuid": "f8959d81-81af-408a-87eb-4f829f6af51c", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089326, "uuid": "2d32fd98-bb51-4907-837d-39811d0a8ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089326, "uuid": "7862d9d3-da99-4fc5-9f0b-ea463877a338", "value": "dc476d17a4847cbac22174f204dd8b1e87adb1ccf56c092c4b04f4e3d91add71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1935de04-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089328, "uuid": "ddbb79de-0765-46be-b67c-aba1f8484d88", "comment": "Malware payload", "value": "b882ea90567a3e6636171ab6ae86ee27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089328, "uuid": "6111b3b7-9f2e-445d-883b-8e1a07022f10", "comment": "Malware payload", "value": "dc647409431a151cbc058716edef6ab85ec267022ed19ce3c971ac11b787321b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089328, "uuid": "e7d9a9a2-2f09-4d48-b3c0-516a76b016c7", "comment": "Malware payload", "value": "de37a18516e12c0ff7f554bc844fdd2f7b9eff67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089328, "uuid": "7a51f4d6-0eae-4b94-bca8-50145de08b40", "comment": "Malware payload", "value": "76b2ca1075423ee9505cbfd491d9b51af597d5db156d8c0db0ba877b4105db53b39e192fb4f1a1b8aea0993694e30190", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089328, "uuid": "d4253999-0feb-4d67-9b95-7d0367dcff37", "value": "T193F42206A6E18033D9B6677468F203831B39BD619D70C36767856C6E4CF3AC4BA3177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089328, "uuid": "c563ab54-b711-4c3b-9c5a-2918883af7d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089328, "uuid": "ad455db7-b07b-4d0f-8926-ced5975294c0", "value": "12288:8MrJy90cQHi7pa0WpdfWic3dydP67n4NTRqQKZEjUswTbq0AU7BWr5:NydUgpgra3qP6E1XgswTu27BWr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089328, "uuid": "e02b41a8-65bc-49fa-b5a6-e382da193119", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089328, "uuid": "9dca1ff8-f942-4adb-b314-94efe61f4b56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089328, "uuid": "1d5ebd8c-af73-4808-999d-ecd97bec06a3", "value": "dc647409431a151cbc058716edef6ab85ec267022ed19ce3c971ac11b787321b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aaa043c-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089330, "uuid": "5edcc3d8-f6ad-48ac-b27d-810297d26bf6", "comment": "Malware payload", "value": "2867927898a5c3103720de2efa94bfb5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089330, "uuid": "6757f4d2-9d24-4a15-94dc-8a300bbdc4a4", "comment": "Malware payload", "value": "dc7a1d68ff7da9cf2f842d9c2d0bae516917b49bcf12356c67805e2c93a138a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089330, "uuid": "889006a9-6119-4a1a-8d02-2455f1f1b634", "comment": "Malware payload", "value": "e16af85adb2187b29213f0e02242cd394f1ee382", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089330, "uuid": "0687f777-14ee-42b8-8c8f-c801103601fb", "comment": "Malware payload", "value": "97061dcb85dc1932cc2ee401582ddcb500b897357766d62b09139b37eda5e31b84000291129a8e76fdb480fcebf0b22e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089330, "uuid": "2d3275bd-187c-4ab1-a8e0-ab4382021db3", "value": "T1DB45231227F04132F9F52B7014F547D32B36BED1683842BA2294AD5E19F22C1E976B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089330, "uuid": "26e00199-3843-4015-89e2-ffcc713e94bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089330, "uuid": "c1a25eae-9c0f-49e7-af77-b0d85df2ea83", "value": "24576:mygyZgTE+aBSJAc9PWzfYibFAourOL7eFi7MbL9HPY:1gyWJaBSJAcIfn2ryqE7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089330, "uuid": "5af5a50a-672d-4d9b-a405-4cd19d822de9", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089330, "uuid": "a13109d5-1776-4417-939a-eb7bb2723a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089330, "uuid": "46ac4533-fb4b-4243-a722-e52d6b4fc15b", "value": "dc7a1d68ff7da9cf2f842d9c2d0bae516917b49bcf12356c67805e2c93a138a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec93c348-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089682, "uuid": "e527361d-481c-4c87-9b9e-0d181e2211ed", "comment": "Malware payload", "value": "fbfa665f66829ede0766ac2bcca99129", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089682, "uuid": "549b25b6-0113-442f-8176-12a7e4c4223f", "comment": "Malware payload", "value": "dcdc3662f866aaa3f37a431e29701d8f588cd462c69230b1aabbaf04de73ef32", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089682, "uuid": "d0bb47ca-2d0f-4754-9cd5-419de11fc6dc", "comment": "Malware payload", "value": "68f6147db6eb4c7ad463409f65686cf78cdf58b4", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089682, "uuid": "dde13eee-040f-47cd-a0ab-cc4fe36dcf51", "comment": "Malware payload", "value": "789e2703ed6d837ed4682197563114643f130f5bf330bd8090fe2d98acdc296e2eb6f97ba1909ef7c6c39a1696a5d61c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089682, "uuid": "6f014c48-e77a-44c4-b943-f0c0c861883e", "value": "T1944633EC0E8536DAA834B7BCFB78F30903849D94063A947651835B95D593BF0BA37836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089682, "uuid": "05a05520-1a81-418c-a726-b9daed5f0137", "value": "98304:1HbcbWLTWhgCrU2tpzn4LZSjLN9LJebSdf/DGt3C4nY1U4siGdfa0PXs92:tbcbOqhZYgOZKLWty4nYDGdftvm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089682, "uuid": "80629547-c82f-42bc-873f-434af1cb88be", "value": 5848440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089682, "uuid": "45d13e4f-b3eb-4e64-af4c-e77a993dabfd", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089682, "uuid": "8b1584d0-0cd2-4d74-ba63-62d83dfb924d", "value": "skype.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc86fed-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089332, "uuid": "5432b73d-35af-4753-a503-0b816556f114", "comment": "Malware payload", "value": "4854c1a008fbb1da446dd5eeaf87ac78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089332, "uuid": "61a3e3b0-8513-49a6-a847-dc8621c18067", "comment": "Malware payload", "value": "dce285bd0afda613cb8ed58a1980fe57bf9333fbc470aed3a182f4c3cd84f4bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089332, "uuid": "fadd0c62-767c-458a-a41a-246b2bc542d8", "comment": "Malware payload", "value": "cb977c8ac566b12a2d0c25fb558fe2aebed770e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089332, "uuid": "652397b7-7b38-46d8-9e72-0d2fe9ed378f", "comment": "Malware payload", "value": "bf28de2af3dddf35f63e1453982546ff874c14d20a4411c67ff20722afa972cf3893e55097473ddc8104145498f2a15f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089332, "uuid": "861a8807-8055-4401-918c-790f4fb89f81", "value": "T1BF452361BFE49032D9F027780DFA12972F39BDE2995483A7374648991C73680E9B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089332, "uuid": "3673fadf-dea2-4539-a37a-10a628f4ad5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089332, "uuid": "e0bee72b-b12b-47cf-acf7-d0d7c1144029", "value": "24576:MyKaiEY7a78YP8Mv+lOTmv7v8+jSiEuyHADWN00HoJ:7bTKo8a8M2ETmzj+dAWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089332, "uuid": "0e5b8942-772d-4eca-9cc3-605ace214ecc", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089332, "uuid": "ee9846de-56b3-46a5-a503-47894ac56904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089332, "uuid": "883265ab-3400-4bd5-8ca7-8b3d7a4db317", "value": "dce285bd0afda613cb8ed58a1980fe57bf9333fbc470aed3a182f4c3cd84f4bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9944fd-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089333, "uuid": "b4a59428-0bc8-4171-b70c-56681e2ccfc3", "comment": "Malware payload", "value": "d1215d96c9609ec8a0ce1b968476a59d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089333, "uuid": "230a6592-0028-4aca-a195-a86a92232edb", "comment": "Malware payload", "value": "dcea0db7472cdf95ccb47a112360b843762e3e289de9e4b57125a86186c8579c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089333, "uuid": "f6146a9c-434e-4b7b-86c7-c61d6db6786f", "comment": "Malware payload", "value": "b9ff99853179c315b690fab6ae76f8f70f6ab9f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089333, "uuid": "db73224e-6e23-4909-9dd4-30eed242be92", "comment": "Malware payload", "value": "1111ea9c72733b49cc98d1a876ff19fe59de36a3f9f597df3602c3583c58e6aa83348159cb4d25ff583b5c0c1433d451", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089333, "uuid": "b5c78b18-a881-4500-ba18-bfd46cc8ae98", "value": "T1322523029AD88137EEF927705CF707831639FCE15D70979B23A0585E28B368988757B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089333, "uuid": "f5e523cf-4d9a-4a96-8aa8-12a3cb18aff9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089333, "uuid": "5bad2dd0-4a1a-4713-b166-af12c8767e37", "value": "24576:CyiUb9GbgfNuJoVkkJDYJjq3PwRBG2QhhxMtcg/PF7Gj:pB9O0USvY03PKshbMttd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089333, "uuid": "039b4925-103b-4279-9355-e7b9596b6ae3", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089333, "uuid": "2bd9c60f-4409-44a9-aa13-53f8a48955ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089333, "uuid": "3f10a6b1-b1f2-4aec-a9c5-1b57b755f7f5", "value": "dcea0db7472cdf95ccb47a112360b843762e3e289de9e4b57125a86186c8579c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d80721e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089335, "uuid": "c12c4837-78c0-441a-a7ac-bbec18b04904", "comment": "Malware payload", "value": "2f4ea3603234d1406215003b65bfe0d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089335, "uuid": "1abd6164-d4f0-4210-b090-e0635421b9cb", "comment": "Malware payload", "value": "dcfa688395b63f54f26bb2d6df4bbdac7fbacd7a29f6abee3c03233119846a2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089335, "uuid": "84c2409a-15f8-41f3-ab4f-c47330f3ab32", "comment": "Malware payload", "value": "ca51c286b9e3bfc4c865730365014eafea6fd0b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089335, "uuid": "98d34ec3-239f-40ae-8a71-9fd9ccfc7bea", "comment": "Malware payload", "value": "45b5ed7f4cd4aaf1b3c834737e2fc389a5d2195ab7e8fd36d3c07aa5d50e6f45e338679c5668bfc508d1557af122b762", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089335, "uuid": "2e2aa738-a9a2-40f1-898e-82df100265e4", "value": "T1B3452305BFC880B2DDB51B7015F286870E3ABD31E5BD43A927869C464DB2694A533B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089335, "uuid": "626ed586-71da-4bd5-b654-4578dbe97cb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089335, "uuid": "2edce1d8-df6e-4058-9f25-2763a02d5484", "value": "24576:dy2AbOCXp9cCW0XJCHuSHi/y55yDZBFR0SYO3dYyY:42PCXpRWyJCOSHiXFX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089335, "uuid": "aec83030-478c-4a29-a4d5-07af399fa02e", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089335, "uuid": "a3bb1918-9edb-456f-90a3-bbdfe4191e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089335, "uuid": "162aa982-6737-492b-8ff4-b937dfaab83c", "value": "dcfa688395b63f54f26bb2d6df4bbdac7fbacd7a29f6abee3c03233119846a2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e595faf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089336, "uuid": "2468baf1-25fd-4aa1-bfe3-93b45fdfcc95", "comment": "Malware payload", "value": "db4184e046699d45e6fd73fa5de4e9d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089336, "uuid": "ce87d906-e70f-4a5e-845d-6711e72bfbd7", "comment": "Malware payload", "value": "dd3a2521b563ef6eba2df56c585b97b5020b04132fca7514ce441193a5a4cb84", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089336, "uuid": "f274f79e-4bdb-45be-83b4-79205638f728", "comment": "Malware payload", "value": "33331514996b3694b54a443803067513eaeea714", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089336, "uuid": "e861784f-5bc7-4b33-9587-425e36e4ec1c", "comment": "Malware payload", "value": "e8d2fac74d3614265028ef4d8bc65cd8dc3cda403fdcce63da736e366f8a3283fc55a79b3c87e762f8be3f68e8b46a7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089336, "uuid": "aff06e33-70d9-4ff3-85c0-9df06503735c", "value": "T18C452307B6F58432E9A82FB468F603970639BCF14D78826D3B4A6D972C325D495703BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089336, "uuid": "9e4c0a05-785e-4604-aa89-52f192442dbf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089336, "uuid": "a607cea7-fc88-41d6-9656-3953e8e71b27", "value": "24576:9yNFhC7KQn9QfVtd1BgwdJbmwDjLt1M25pXz:YNjCHIVxThLM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089336, "uuid": "bf66b59c-9242-4246-b7c9-156df7641b29", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089336, "uuid": "24d515c6-7b45-4338-bf19-89cc27f82fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089336, "uuid": "50186bdf-53c0-4c1d-864e-bf1235e372d9", "value": "dd3a2521b563ef6eba2df56c585b97b5020b04132fca7514ce441193a5a4cb84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3c811e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089338, "uuid": "50bc0119-f439-4ea0-b341-37d0f32e5da2", "comment": "Malware payload", "value": "8bbd280a064e81d593dfc5ee453d48ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089338, "uuid": "2b96f299-5447-4850-a2c3-f44722003b6e", "comment": "Malware payload", "value": "dd49b9a83fb77d7dde1f0ee06dce6ffad4899b61c98da76c80e18b0aa3ef7c07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089338, "uuid": "3a475582-a9b8-4e70-bcca-dc0d901b6272", "comment": "Malware payload", "value": "be11164481b8579afa8db60921b1a7fbd926f5dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089338, "uuid": "cbf0ce8c-72b3-4b8e-a7b6-8a13b6a8d052", "comment": "Malware payload", "value": "7619440c7d85bdc2bf2e9381a4cff1a3e8a0a90456601e56cae19fc868ab9dbeb934ac93dbcdcdcf0a884fa7633ddf1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089338, "uuid": "30d0ba6e-9c50-42c7-9b18-707ad251022e", "value": "T114452351A5C49451CCBD17B0A0F716D32B397E215A34877B3B49A9A72D32FC0A63633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089338, "uuid": "77cd1fcc-59be-4769-86e9-3597f1bb1c79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089338, "uuid": "e03a0a20-4867-4e49-a49e-e297b1f21ad6", "value": "24576:gy1Yf8FPJ+9WST7aJfw+tG7gtp7+0UA/84eF1Y/JslDLg:nWE5J+9WSXaJfwn7gtpy0X0/Y/qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089338, "uuid": "4544257f-8284-4305-85a5-4a4ecfbb6043", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089338, "uuid": "6ad5a056-58f8-4279-837e-a59407cbbf4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089338, "uuid": "8d1c58bc-1b31-4067-83f8-4c969b124b47", "value": "dd49b9a83fb77d7dde1f0ee06dce6ffad4899b61c98da76c80e18b0aa3ef7c07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fd23d6-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684067495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067495, "uuid": "b19a9a9a-08b9-4401-bdd6-35a13d7f791a", "comment": "Malware payload (Mirai)", "value": "c7bbd98fe6a093b77a58dea0ea71d6ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067495, "uuid": "0b525eae-6fc4-477b-84b2-5f66a69aaa98", "comment": "Malware payload (Mirai)", "value": "dd4f19465fd5c766b3dc56a588521f2fd0f99b00c85c153b0170389d0976539d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067495, "uuid": "647311de-3d6b-4406-a71c-2f15c34e6d59", "comment": "Malware payload (Mirai)", "value": "f3287ec370986e06267a722d736200a4daf49a77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067495, "uuid": "877e8407-64ea-48b7-8c3f-1050b2fa6751", "comment": "Malware payload (Mirai)", "value": "c2f76a4e37dd432c4c151a328aa91a169e65be6a3656687946718c6920ff082574278b8ecf099eb545e34d1ed08a36be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067495, "uuid": "92898acf-4ac5-43d0-b2b9-cc3ad219fc66", "value": "T1B382CF3061AB75E5CBE10430EEEECEC697160BBDD1FC369317586B78898210661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067495, "uuid": "9553f46b-1f0c-4725-bdcb-ecd5ee35df7c", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa7Q4hymdGUop5h5lP:2dV0P6+kom0tVAoNvm+to17bs3UoznlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067495, "uuid": "85c0f4de-6112-4014-aa9d-fc6642f1867f", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067495, "uuid": "f62ec774-7351-4747-b431-848b20f43d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067495, "uuid": "c20ecb69-48e9-4a94-bd71-801193b905d1", "value": "c7bbd98fe6a093b77a58dea0ea71d6ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20316fdf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089339, "uuid": "bee9256a-581c-4e3b-bc47-7bd723437d25", "comment": "Malware payload", "value": "f0a5660b3e2f4415e541ec315e61ec86", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089339, "uuid": "f3d3eb47-cf29-4ead-9e15-1aa8a1e48120", "comment": "Malware payload", "value": "dd4f68077b2a4a74f21d8853cd68c222c6084e93ec059c07069bd1cd9bce3fc6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089339, "uuid": "0e96ffa1-bdf7-440f-8d76-460aa6a82ddc", "comment": "Malware payload", "value": "be0d422e8ee50c6b9271a715a4069a523c27ec18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089339, "uuid": "f47d06ef-bf99-44c7-b508-8cce45a54c32", "comment": "Malware payload", "value": "4f220fd818c176006842e4ec888f2fdd3590b0cf0b14dc01077121bb06f2130a92f840ddc9e0b73d2cb0328a8da1a1b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089339, "uuid": "5abd51d1-d401-4114-9740-f2c3a34d70c5", "value": "T164452306EBE88173D8F617F098B242C719367CA15E39863F2354E8AA5C73EE1D13535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089339, "uuid": "92bee463-457f-4288-9a00-3735f8a5c3c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089339, "uuid": "bfc5569c-b1a6-4fdc-a06f-4d69c10a729f", "value": "24576:Pyr6wNDxkVckkEuGsjT7Jc0BWcncv6ZUV67wRhTTvCK5taD9:aLGVOEudjW4WwypV67wRhT+KLaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089339, "uuid": "0614eb91-2587-4f44-959b-9c9abe63f7d3", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089339, "uuid": "99ee078e-6770-440f-bc24-85fe9e8f7a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089339, "uuid": "551f50e8-5a1e-468a-b38a-560795383788", "value": "dd4f68077b2a4a74f21d8853cd68c222c6084e93ec059c07069bd1cd9bce3fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d88528b-f225-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684047862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684047862, "uuid": "93f60fad-9969-4db8-9227-be1fa4af3492", "comment": "Malware payload (Mirai)", "value": "445f912d608b58974a9fdefb57165752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684047862, "uuid": "0c4ba5f9-b26f-41c0-84a0-23c06c85dd22", "comment": "Malware payload (Mirai)", "value": "ddf3c5f2cc0707697395d2555327e3d08640fe68a81301a0e0aa1ab1ce169591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684047862, "uuid": "d975ae14-eb95-4691-b788-0c35de7c98be", "comment": "Malware payload (Mirai)", "value": "dace70557c642687bc6d09cc905e2175bb5ce8bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684047862, "uuid": "a25d9ae8-1144-4b3c-ab74-ec5c8a0c0aa5", "comment": "Malware payload (Mirai)", "value": "0603aacb702c287d3a46ad6324db6f6f41018c2e20bea2d850fe84a2105087dd69dcb984494afbcd772681002a9aea75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684047862, "uuid": "a622546c-e56a-467f-b3d3-07c611e9133a", "value": "T189233AC0A683F9F1EC11457C307BA7726E77F43AA03AEDDBD7D99423A841602960729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684047862, "uuid": "7beef55a-7184-488a-b403-9af3e969ebe6", "value": "1536:Ovmt6GStZRjrMcPzOubN8yMoP7dgYfQ5I00mv4az:O5GS1HMcPCuhIoP5g7iqvjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684047862, "uuid": "124f89ae-75d6-480a-b2a2-e110e1560fda", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684047862, "uuid": "f73a7ea2-bde5-4c32-adeb-6d9e7d025763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684047862, "uuid": "b0b59e5b-46e6-4211-ad41-f25bf69583c5", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d080ce-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089342, "uuid": "7c478c6a-c382-4c4c-a1c2-78b972fad070", "comment": "Malware payload (RedLineStealer)", "value": "b666c3f096819ddf9a8659afe19d9dfa", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089342, "uuid": "53096ccf-f49c-4d01-8c70-d2d49ac2a3a3", "comment": "Malware payload (RedLineStealer)", "value": "ddfd0a5d8a310f9c5397ec3be3bbe2ca4d0cb0061709796ff3f2f28d2f61ad02", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089342, "uuid": "ef51bf4b-a095-413f-b9fa-f1a88c7a53d2", "comment": "Malware payload (RedLineStealer)", "value": "3be1148616f6f8af82089f50fa204c2690b4d6fb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089342, "uuid": "4fca7d3a-cdec-455d-9282-ef3c818cc853", "comment": "Malware payload (RedLineStealer)", "value": "3f3c1e265be90ff44fe8eef9470df81a19c8de8e0ab651a48d0a90aac75a3f6e5e840174f350d653dbb118bca2ea8301", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089342, "uuid": "56efb338-966e-4a69-b47f-72c9acb151c2", "value": "T1AF452326E7D4C473E8B127B009F613C31F3BBE115C7443AA26416E166E72BD4A63672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089342, "uuid": "e2cd081c-2d01-4e07-a141-bb2b012aecd7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089342, "uuid": "9ed7da56-6208-41e7-b997-0087a03a4f00", "value": "24576:fyYT8/fcgYsEBFk098RMV+A9k+MqLXmymL75A6qUJDlHdjRXB:qYscgJEBFk9+5JXjoy6qUJDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089342, "uuid": "a8626afe-4027-4ba4-a3b5-f6a6e4fdc65a", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089342, "uuid": "85ccf4e5-8f89-4f39-b9cb-0f107ba024fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089342, "uuid": "8401766b-a3a9-4d92-9c01-8f41ee42d292", "value": "ddfd0a5d8a310f9c5397ec3be3bbe2ca4d0cb0061709796ff3f2f28d2f61ad02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b05b34-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089343, "uuid": "d17e3565-bc94-4121-addf-7e21081583c7", "comment": "Malware payload", "value": "bcccb32a615482d6df3ccdad6676e336", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089343, "uuid": "3c289200-e14c-4d9b-a038-d1d2d3e68ae5", "comment": "Malware payload", "value": "de78ba5564b64a73783205c5c54ec3267fce63776cb30d1a3edd14fb1e9a31cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089343, "uuid": "beba6d1b-080a-47c5-bd1d-00aad8838230", "comment": "Malware payload", "value": "4a0e15825db932960a3053e02f269af8e43b873c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089343, "uuid": "aa6db150-1630-42a2-943a-54fd6f3b56fb", "comment": "Malware payload", "value": "17bbe2c5b610e7982132055d685e5ecc93ca596d543d701204d987a38b5c6d00c239d05462bc6a231705c0d4fa5362d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089343, "uuid": "e409f954-de64-4f0a-abea-0593c8f1a075", "value": "T15F45230A7EE4C172D9F52BB428F283530A35FC903D78835B6349995E4C73A83A672767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089343, "uuid": "ca8dfd10-bebb-4b44-aa26-b261604e0e49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089343, "uuid": "0d6f11fd-05df-4d2e-9964-08954138027d", "value": "24576:jyBt48pCQyYo2CZZ9BfVydedi91WApo/McWzXQnWcK/3sgEj8g:2zxpCQyYo2yZrVt4IAm/zWzXQYEgEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089343, "uuid": "a5834ef7-9b13-4a82-86cf-0b3391e299da", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089343, "uuid": "03be6a9f-62da-42f4-ab17-cc5b5e308a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089343, "uuid": "6e8bfb74-630f-43f5-bcd3-f374ce1c502d", "value": "de78ba5564b64a73783205c5c54ec3267fce63776cb30d1a3edd14fb1e9a31cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b43a53-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089345, "uuid": "37bfd3fe-e2d9-4c79-b484-c52b0cc2528f", "comment": "Malware payload", "value": "45e06b85f87a47bbc1d145235ebfd6f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089345, "uuid": "47dd7d16-e7b0-4034-a2fc-e3751a5bf871", "comment": "Malware payload", "value": "de8f7c869fc3ae5c5ceeb9b472b002c0e56bd3dfc933339920ecb94a2fa338f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089345, "uuid": "995bb9b6-8c16-488e-afd0-3520fb8cc363", "comment": "Malware payload", "value": "7cd2baf3960f81f5b30b4bfd0990e32b7d0e1878", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089345, "uuid": "bafeb581-30ad-400e-bd19-e122648bf8eb", "comment": "Malware payload", "value": "10733d4b6e3accc83b2f4fdd3decfd6e1b35e4d4317c811328f4d4fb7b88a20dbc48f5ddddbf3ee23d7db6f866411448", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089345, "uuid": "0511c6f7-89bd-4e8b-9264-02899ffd9f58", "value": "T189452312D7ED4137D9B13B7165FF46831E38BDB5EA6843AB26008A570C627E0927272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089345, "uuid": "302f0cf1-89c8-475e-a75d-d7c4972fa2cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089345, "uuid": "60eba2ed-b57b-4674-a422-a2af769570e2", "value": "24576:AyQG1HYrjo8PsSn+FksqciefjxS1P6Vt6cgjdls/13scUKe9CacoYf/D7zSC:HQG14gEf+FksMCj48PbaTs/13s19vcor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089345, "uuid": "c1bac1d5-26c3-493c-93ce-0e051833adf6", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089345, "uuid": "0712fbc5-4bb0-4a1d-8ba2-2d9f8a7c70dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089345, "uuid": "cd371306-bc51-4bf9-b4fb-aa61a152f329", "value": "de8f7c869fc3ae5c5ceeb9b472b002c0e56bd3dfc933339920ecb94a2fa338f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b345de-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089347, "uuid": "e26a9d91-3342-43ba-ad45-4942e9d6cfc5", "comment": "Malware payload", "value": "475d5ca996f0de21b7ecf565327db707", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089347, "uuid": "b288737e-392a-49e2-878e-0b17f045b8cc", "comment": "Malware payload", "value": "de94190915a0d716fc09cca52d0ce97f2cb5e7bb1a2d95ea794a68db2f847676", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089347, "uuid": "f3aaf6b2-0327-418f-855d-cafed4e08aca", "comment": "Malware payload", "value": "fa7db9edce86fe9571dbed0c1256624d15534aca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089347, "uuid": "e6898ae4-2f78-4c6a-bace-03f744f7466c", "comment": "Malware payload", "value": "fb6c0ef046f567242479112424830099b4ef437ba20c30d4ccd97a4a17d04c21215b5fe10a1c061e716832ec35e4591e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089347, "uuid": "63f620f7-31b7-42f1-8fe4-2ac55df5709b", "value": "T170452342B7F89473D8B66BB158F202972B75FDB61878526B2388A8170CF35509472F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089347, "uuid": "a3b59d65-f193-4767-9309-309d07c8f7a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089347, "uuid": "a1fb888b-d066-4bde-9a71-0fce7811849d", "value": "24576:oyoESX+zkZ39wJAUD8m7FNJ9O1iqsaUa5AIpdDXeGNy4lxi:voazkZgAUJ7nJuU0DpgGNy4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089347, "uuid": "8a5f2249-fd75-4dbc-bd17-000cbe3638ba", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089347, "uuid": "8fb5c81a-dbd7-4dfb-8f77-1921911ff584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089347, "uuid": "0c2406ba-ec51-400c-9638-7e6b71266269", "value": "de94190915a0d716fc09cca52d0ce97f2cb5e7bb1a2d95ea794a68db2f847676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258fcd96-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "73a9af69-07ae-41ca-9404-226243ef9866", "comment": "Malware payload", "value": "1ced96a4310bbe719fbf608b1de7dcf8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "0454310f-bc6f-4c71-81d0-d231f1036270", "comment": "Malware payload", "value": "debeae477e24ed5b0a3dd6feedbaaf7ba66578da4240753b3a8de5849ec6ca21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "4526d46c-c6a6-4575-b1a3-7aade316fe8a", "comment": "Malware payload", "value": "1a57f36f0171c4f098b7eb0aa197a22c28f35451", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089348, "uuid": "d07bcaa0-5de7-43ec-b0c1-f61b53fa6880", "comment": "Malware payload", "value": "ff5d02bbf78f8cb0a96327516b126b0e28ec21601526ddadf99d35f13f660ec49fdbe51f42411077883eae8fc9c9c7c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "efd626c4-8c46-45fe-aef3-7b988a9420a5", "value": "T16045234B67E94473DDB01B741AF903830F35B9B65A38436F37C598AE0DB3690A832766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "c23b3c69-1359-4847-a9bf-ea76adaec651", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "3d3a72f6-dcc4-4610-9c9c-8e12c6c91e31", "value": "24576:1yUwCaAUTjRbLGLYEsKzDjT1V1YW82Zzp2hRA6b:QUwCqLGLy83T1LYWnZzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089348, "uuid": "9590f91a-7c1d-4ad3-ba06-f19ab8aea774", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089348, "uuid": "63f5e99d-da67-4efd-b811-01ef37743c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089348, "uuid": "0692658e-d752-46c6-9fe9-60601ee3b43f", "value": "debeae477e24ed5b0a3dd6feedbaaf7ba66578da4240753b3a8de5849ec6ca21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dc8ade-f237-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684055422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055422, "uuid": "84bad64a-efaf-478a-8a87-8a1b73583182", "comment": "Malware payload (Mirai)", "value": "7a722c923cf3f27d462efe8cca89a498", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055422, "uuid": "77320f57-e420-426f-999d-f60811c5cf70", "comment": "Malware payload (Mirai)", "value": "dedfbee2bbcede1d8332182c5a81be7ae6cf941aeae36a933edd768fc442ffed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055422, "uuid": "4b17aed1-3d09-49cf-97ea-44f5c714ef23", "comment": "Malware payload (Mirai)", "value": "6173b03b5e2b85fa71d6deacbc8217b9d89533dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055422, "uuid": "52ac8a70-f508-413a-b9b2-2c98e50d3028", "comment": "Malware payload (Mirai)", "value": "476daf6090a002190337fdc6bb5364c710b09f9bf142679e3273f307f9d719046219112ced1a237eaf346c2be24cc86a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055422, "uuid": "dc530794-b790-40eb-a1ac-6c80865aaedb", "value": "T14E336B36E029DED0C5960234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055422, "uuid": "ebe56b90-b67f-4626-b063-f5fdbe496118", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+ydZCZQoVjfjmCozw:Oa4U7G7SvT6ftBTydZKVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055422, "uuid": "c67c60a8-b074-43a6-9450-33236ccd5d42", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055422, "uuid": "0b43eca5-d1fe-46e1-877b-85c34fb2ec85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055422, "uuid": "a9f373c8-3f4e-406d-a17f-3a323f5a139c", "value": "7a722c923cf3f27d462efe8cca89a498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f9175b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089351, "uuid": "b7ec6a7a-8267-44ea-95f8-f30de5a5c869", "comment": "Malware payload (RedLineStealer)", "value": "00c4c507492521e9ac5ae6091c8770fd", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089351, "uuid": "c91479f2-ccdb-42a5-aca2-f90aec5f4b47", "comment": "Malware payload (RedLineStealer)", "value": "def6dcbbcbcb5463ef1b02a3f1a833ba61a015f6d1afc9a302ea235941c96b2e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089351, "uuid": "de0ea5ff-076b-4c12-9581-7008a10356e5", "comment": "Malware payload (RedLineStealer)", "value": "9ef134f2e7b9e391e274aab8598341283eb1695d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089351, "uuid": "50328c2e-c769-419d-b6fc-8a45c414b910", "comment": "Malware payload (RedLineStealer)", "value": "a8876ad8d402f3a3f03cfd498f5e9865ea7d9748558367ab90d26b406bf46392d32fdc650689aa5140ad7a3b7d4ae236", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089351, "uuid": "96929762-051d-4d18-b319-e695bd459d58", "value": "T1F245234BAAE885F1E4E9777098F702D70A35BCB19A68423B231A5D091DB37C0E57436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089351, "uuid": "7c12e71d-4ebc-45cb-a0f2-7cce7bc8a826", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089351, "uuid": "fd941ac8-821e-48b2-a296-bb312a38c8e7", "value": "24576:ZysEG7mlmMp51BkAHYCAlTc0jdU3IDi8eBPLCUWl/qCShrEHsowhQR:M6s51aA4CxASrB+UWZqRYso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089351, "uuid": "1b5f2abb-bd1a-4390-a102-21415eae5f3c", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089351, "uuid": "750b2027-46bb-46ab-b10a-60bb1ef1719e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089351, "uuid": "85e9680d-753d-4aa4-b679-89736400b41f", "value": "def6dcbbcbcb5463ef1b02a3f1a833ba61a015f6d1afc9a302ea235941c96b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281159d4-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089353, "uuid": "c3f80350-d4c0-43c5-8859-0b5abdd8d69f", "comment": "Malware payload (RedLineStealer)", "value": "e7a6f05023481037b54be73b254d46e2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089353, "uuid": "8d3e5359-1e38-49f1-b405-b0824fec0feb", "comment": "Malware payload (RedLineStealer)", "value": "def768d957986a608a3131d57e90125aef51b4f348cfbfe6a613a7c02620d569", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089353, "uuid": "d5d34e04-cfb4-4d56-bfb8-c723e3bb3554", "comment": "Malware payload (RedLineStealer)", "value": "497a907e076d4d0b789ae455f52317586504a98b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089353, "uuid": "ff73f982-7a52-4cf7-a7f8-d215fbf1a57f", "comment": "Malware payload (RedLineStealer)", "value": "376f45c5140ae492875d7906bebed4a2202291948bc0ff2b9ec2046590777ea0e85612515e701d06b6a60a5a52f90548", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089353, "uuid": "3f3cdd8d-29bf-478a-9153-01fdd2d0f1a5", "value": "T13F45235770E89461DCF127B00CFE23870F75BD609DA8826A178D89DE0CB2AC459797BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089353, "uuid": "ccfd36d0-56f9-43d2-9433-7cf8c36babbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089353, "uuid": "c17873c8-54a0-4f34-8098-8c7ca4c25390", "value": "24576:My0iYEkQMNL8qge7sjth67TnNr1jB1p39WuC:70FEkQyA7XK9B1ptWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089353, "uuid": "ac6c9ac2-a43e-4210-a919-8843d6d9bab3", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089353, "uuid": "1b7edf5a-c3a4-4d5e-8e7a-627269e561bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089353, "uuid": "ddddc421-89b6-4400-9c8b-f3128136b55c", "value": "def768d957986a608a3131d57e90125aef51b4f348cfbfe6a613a7c02620d569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6908d3-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1684056481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056481, "uuid": "59c6ccb5-08ae-491d-b169-afa8f3fb100e", "comment": "Malware payload (ModiLoader)", "value": "d0e4d2c9c280b02c6b11254f52f3bb36", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056481, "uuid": "2cb269c7-06b6-4282-8bc0-7db722c9bd5b", "comment": "Malware payload (ModiLoader)", "value": "df4b4190cfbee8e0c9e6b8b6b02ba217bb25d7d97132bae5b447c4a039d25872", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056481, "uuid": "2d51feda-c4a4-4329-b91a-4fc0e4c2e793", "comment": "Malware payload (ModiLoader)", "value": "6b73010c672e3d933149944972e67759b4b6c903", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056481, "uuid": "8430f351-b7d0-43c5-90a5-346f0fab802d", "comment": "Malware payload (ModiLoader)", "value": "d9ad25943f420eca69739d61f676b9e31fd0cdf889aeda665be8654864930fff3ffb143a715cedfc1689c46801619418", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056481, "uuid": "9902d346-2beb-45cc-9add-475dee1b30ff", "value": "T16A15CF21A1E2D037E2B317389E160395E81D3EA02E1C679FEEDBBD4D2B795653538207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056481, "uuid": "7643713b-99b2-4e37-b628-7379d7b0dc8e", "value": "1b6943cba45637acffdb0f9d0b74387c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056481, "uuid": "4a17c0f6-a45c-4399-b08d-180bf85f3567", "value": "12288:zBTU8A8RppNfqVu3TZLt78lFC927150Pbkttml5OHN6dPph:zJ8+fNfVTZOlFbsKImHQdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056481, "uuid": "095fe0e6-b7e3-4ef6-b60b-b145e5d5c253", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056481, "uuid": "ba704300-8ca8-460f-af95-3274b1c94c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056481, "uuid": "5c1570d0-9ae6-4ff6-8afb-d09e9f760d49", "value": "df4b4190cfbee8e0c9e6b8b6b02ba217bb25d7d97132bae5b447c4a039d25872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c882be74-f23a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684056980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056980, "uuid": "c8dac9bb-d7c8-4bc3-a0c2-b4fd244320ab", "comment": "Malware payload (RemcosRAT)", "value": "da6b84ba6274fb9988ec6416600b1444", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056980, "uuid": "64938f9f-03a3-4ea3-9bb3-559c4d711cd9", "comment": "Malware payload (RemcosRAT)", "value": "df5481a99a394e2019c2665fa75f4b81bb4cf0afcd5b7c268ea6f01988ece3fc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056980, "uuid": "ad27359c-f1d8-4b72-a976-540e39d98683", "comment": "Malware payload (RemcosRAT)", "value": "14e4d495dd7c6d02424c16c8c57c5912a4db418d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056980, "uuid": "6366b5eb-68bd-4773-aedd-caac5291939b", "comment": "Malware payload (RemcosRAT)", "value": "1a46b076d773fabe1e3ebfbe8803c2fdb2b532e6c14169be5f7e7a3777f8d7a1d38387d1fe7722b1d1edbc32d3e50d9f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056980, "uuid": "d0c34a86-50d4-4377-b017-c686e6cf05bd", "value": "T1E5D4AC45D2C598DEE56377707C2FF9DC18639E3A4668AE869E263C252573E632033C0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056980, "uuid": "707114a5-230b-4029-9db8-29a836b03314", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056980, "uuid": "9b6a923e-fb70-4734-b099-9c3ab7aa5b9e", "value": "12288:AYAiFm60o0rQlhFPAGH0G4t9fnwLBZBTgCbHnl1/b:AYZFm6J0rQlYaFQnwdLcCbHn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056980, "uuid": "61edb88e-1e91-453a-a93a-6b425863eb02", "value": 635917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056980, "uuid": "92a625d3-dbe6-4790-b432-2a78a3bb4b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056980, "uuid": "c4985d00-f20c-4a67-aaf8-1b6e11995dde", "value": "df5481a99a394e2019c2665fa75f4b81bb4cf0afcd5b7c268ea6f01988ece3fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29727a40-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089355, "uuid": "e17803bd-2a93-49f0-9438-a0f0316bdaf8", "comment": "Malware payload (RedLineStealer)", "value": "15c5bd090ff6d8f99e3cd0688c7f2259", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089355, "uuid": "78b829fb-89ff-499c-9347-c758da9af74e", "comment": "Malware payload (RedLineStealer)", "value": "df585b45ed9e364b668774339725964621b3d196363b7131f7a50cc1abf7905b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089355, "uuid": "c59d788d-d26f-46fa-91d9-210cb7a5b884", "comment": "Malware payload (RedLineStealer)", "value": "5d16ae681f779b4f15da058c2d151cf0418c1ab7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089355, "uuid": "f2134a58-c1d9-49b4-877b-990454b0c38f", "comment": "Malware payload (RedLineStealer)", "value": "b76f2f8b0c2ff39af513b1e9b53067521b916c240bdbb4a8bda0d3443f01864772308dc6f4281969fd63343e3ed996eb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089355, "uuid": "d01c341a-54ee-4e57-9c3c-aa8f836c85b5", "value": "T1B7452302E6C084B2D9F123B09DF642971B36BCA1E57C67632746A46B0DB3680F672777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089355, "uuid": "7f7b97f1-8dc6-445d-be94-8386515df32a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089355, "uuid": "ef4a279a-dc3d-4fcd-b972-2ec3c4cc96e3", "value": "24576:Myjc4IcFFPzTUrrESqjZrU4M4dO3n2Pqlzsn1tqZbgOU23KG:7jc4VFdnUkSqjlUGQdzsn1tAblX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089355, "uuid": "d8f9ea8c-91b4-45ad-be20-632601def083", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089355, "uuid": "1c9f228e-a0a4-4d93-9795-67dd184506f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089355, "uuid": "4d7cb217-d010-4776-bbdf-030cadb04a38", "value": "df585b45ed9e364b668774339725964621b3d196363b7131f7a50cc1abf7905b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a929bda-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089357, "uuid": "1ace4048-d7db-4f24-94c8-b24352b0c47d", "comment": "Malware payload", "value": "8917b652997a60b658ced52bf19c5c45", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089357, "uuid": "7eba32d8-4111-4e90-a965-e2b3f7efc6ca", "comment": "Malware payload", "value": "df5e5adaafef59df8a3ecef6b7ec8e8e79b5b998c258a22f248255218d9ba1fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089357, "uuid": "905fbd98-8bbb-4aad-bfd2-1e2e7e6fd5c2", "comment": "Malware payload", "value": "7cab9555c27d00ed2cc994f4a8663cbfc2616783", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089357, "uuid": "e67e63c7-55ea-4313-9ee0-748fa1fe3e88", "comment": "Malware payload", "value": "e13ac53653f00a270bad0b14681af77a42d5bbfd54baa2e7a83c5cc2e6fce03f33a57e81d377ff08d93d3f94b9828aaf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089357, "uuid": "9843c9c3-8890-4947-9f9b-4b66018859b2", "value": "T12D45234176E88037FC7213B19CF302931A72FEE3AA74C79F17D5A9151871A849A31F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089357, "uuid": "d1cb3ce2-a27c-4014-80ec-4c4feb750af0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089357, "uuid": "7c655676-55b2-4b52-90f3-572a7e691653", "value": "24576:RyZDRPtU4QLaEmYTdNyRZ4lNBp2zJMSwUnvwn77oQpZHvI+:EZmWPYTdsow6yvOlXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089357, "uuid": "e2b11271-064f-4536-b3e7-353a266d2df3", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089357, "uuid": "7bff62be-50af-40d6-ac0c-b4bc334695ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089357, "uuid": "c5d0571f-5ce4-4f0a-8986-77b97866fe83", "value": "df5e5adaafef59df8a3ecef6b7ec8e8e79b5b998c258a22f248255218d9ba1fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b56bd27-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089358, "uuid": "627dea99-4e82-4447-be37-bd39478a5e60", "comment": "Malware payload", "value": "499e82717f472990c2a9e2db26bd1131", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089358, "uuid": "9eab1160-f38c-4440-a007-4953504efb32", "comment": "Malware payload", "value": "df66d72c3c6d6c70f4784e9c24b1af4a3cb07ff9135531903ec1f54b752db6b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089358, "uuid": "3bacdac7-5b33-4c85-8bb8-3d323d9ca393", "comment": "Malware payload", "value": "032405b7aaee880968556f0910604a0a41d7c009", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089358, "uuid": "24427239-ef3d-4379-9ec6-7c6e87fb3bce", "comment": "Malware payload", "value": "37510bf410bd681f4dd649bcc5f09074f07a94fe2f3e54d3f73cc0798959524900a2919beb6557ad93932e752942fae1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089358, "uuid": "f1910d20-00ec-4ca1-b2b0-b08946f30ffb", "value": "T1C9F412515EEC5133E9B2237558F70BC70B3A7CA10E38966B23896C5E4CB26D4A5307BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089358, "uuid": "8574d097-1041-4a48-9812-df5268d45ba3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089358, "uuid": "476a845c-df96-47bd-8e0d-74ba00b061c3", "value": "12288:qMrVy90DehuIrR0ZxXLYWRPkCG0dV/1aY5ehM82fRk0KfDO8YEJogTVrzBgoIKG:HyLR077Y6HG0dV/9eSQ0MLTJKKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089358, "uuid": "549a2522-56d4-495a-98d9-a4d781da048c", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089358, "uuid": "3ee91424-860f-423c-9104-318f69644db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089358, "uuid": "01777d05-8c62-47b2-9a8c-1c2ab830d13f", "value": "df66d72c3c6d6c70f4784e9c24b1af4a3cb07ff9135531903ec1f54b752db6b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb89c13-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089360, "uuid": "d788e87e-9b6f-4b77-945f-5012e450c9d1", "comment": "Malware payload", "value": "64500ef9a41d96f8d9a965408b28dc96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089360, "uuid": "bce98793-1af8-492d-a06e-392f554efc2c", "comment": "Malware payload", "value": "df97edfdb04ba9c6baa03f9a209cc280c5a39d349b31359240849be90a1f1e6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089360, "uuid": "e9746778-a6b3-4ad1-acdc-056335de0a87", "comment": "Malware payload", "value": "9edc1ac7d2b8e086dfdb1b6f413e5a3998029fa4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089360, "uuid": "f9c6e6e5-c779-419e-bcc9-66dfe8fabc61", "comment": "Malware payload", "value": "f1c0e4c72cacd8701dd20042cc5a23ca0967831f24f1c77e93b11b5770eafc1e4d2c2a5ec118b1b08460a9f867012f63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089360, "uuid": "a6ed226c-555b-4f22-82cd-bf43d9ecd513", "value": "T150452346B2E88072CEF6177198F60793063EBDB5DD39852A274AAC6E1C73D50653232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089360, "uuid": "714605df-c1f5-423c-91d9-9af86af2e1da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089360, "uuid": "2be8edcd-68dc-42d8-a82e-65d9c6881a3e", "value": "24576:WyT73qyDcl/sBJQGKf3GO68+XNN7ToKTIgCFmAy0Y8zIghyT0Tf:l/hYCReSPN5kKTIIL0H80y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089360, "uuid": "21f61820-cf7d-4af9-9ebe-c8e8259a48c8", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089360, "uuid": "70268dd1-d25c-4a2d-92e9-cee20dad64ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089360, "uuid": "d91524df-2da3-463f-acc6-92ded27011af", "value": "df97edfdb04ba9c6baa03f9a209cc280c5a39d349b31359240849be90a1f1e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8f07ab-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089362, "uuid": "5144cb01-d1fe-42e5-a774-455937bf7fbc", "comment": "Malware payload", "value": "d723a40050ec7630977a9400c6ef7e9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089362, "uuid": "b29bf234-c334-40fa-82f1-6c85dc76a838", "comment": "Malware payload", "value": "dfa50aec7acb8553aedf43e2ab3dcc1b226895326d631de2acd1714b89d53794", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089362, "uuid": "fce0d8f7-6235-409b-94ee-fa3a0076f910", "comment": "Malware payload", "value": "86ad9eb347b2e72ad0457b0b5317c45ff2713cbb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089362, "uuid": "3d4f4eee-b077-4c3b-ae4f-c2db88e44d63", "comment": "Malware payload", "value": "d95dd0699d121304e86c0810f5dcf6671797448177fa993f9f9100175422042d040e617f68f9354582b47f1947eab679", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089362, "uuid": "c80dd3c8-fe40-421c-92d7-d1667d68037b", "value": "T133452316FBC504B6C9FA0BB094F342C31B37BEA26935976E3345D96B18A26D1E431723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089362, "uuid": "42c28cd9-d40f-4c6a-b169-f800006e0411", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089362, "uuid": "5c18e0dc-0329-4bde-8730-a80dd0f77418", "value": "24576:LyR0J0eB6l/bmc0h0GRu96W+ldA5qNE0+OqwOgdKyQpeVBGiWREeKrHn4:+fTccq5RuT+E5qG9QndpAREh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089362, "uuid": "82348762-dd3e-496e-9790-298bd2210968", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089362, "uuid": "f99d948f-4d57-4751-a3e4-1f8dce55e7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089362, "uuid": "ae4bbbb8-138e-4d17-9a17-f8bb6afe8b64", "value": "dfa50aec7acb8553aedf43e2ab3dcc1b226895326d631de2acd1714b89d53794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab3c4a2-f291-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684094350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684094350, "uuid": "71ababb6-b6d0-496a-ac77-3a3fcfbe4e8c", "comment": "Malware payload", "value": "7ca0212317ea1937de1f3b9f32d7f8cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684094350, "uuid": "248dd2c7-8e2b-4ff4-bbeb-a3529085fc17", "comment": "Malware payload", "value": "dfb26a5a7a0400cbd0222880c8627f23cd955e25c2decb76049a377ff7c9e9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684094350, "uuid": "5a068ef5-55ef-4315-ac46-585616585479", "comment": "Malware payload", "value": "e5c97cc43e9f591ac0c0c1ece020f9bf3cd97325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684094350, "uuid": "22f580bb-0104-427a-b55e-39ec4a5d0cbf", "comment": "Malware payload", "value": "63c31128f4e1a806d170c5de95555f96bf481cf7392a9e394c1a69a628edb1b53f68affda2439c212b346b0a4b69b8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684094350, "uuid": "b358b276-8112-4600-8291-68be425abac4", "value": "T1E345239327D80026E576A7B12CF712630A3BBD354978C37623156D9A1CB3BA0E53936F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684094350, "uuid": "f7b4b9c0-e97b-4357-8fcc-ce2172a4ea1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684094350, "uuid": "5b8f340f-4f3b-43b4-ab01-cdd8afb7dc04", "value": "24576:tyNcgBodpiom95qoV3TQ6caJPPHoZn6UHhxBqOSaZRZL9z87nX:IOgBonio200jQTaJX+62jIDaZRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684094350, "uuid": "c4c51c76-b35d-469e-ac17-7895392de754", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684094350, "uuid": "20987a0e-0957-4951-8275-6f2058d51229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684094350, "uuid": "57a25c64-a5ef-44b7-bc2c-28b2f5fe5722", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e81e8fd-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089363, "uuid": "b025a8c3-c1e1-4b57-8459-2808cd3986e9", "comment": "Malware payload", "value": "bed96006bff65bf42d3ef4a43cd65741", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089363, "uuid": "7fab8d00-5094-493a-b066-303a1dcd4370", "comment": "Malware payload", "value": "dfd9f73601aed35cb90d2d5250410efea74dba75afe5ef60efff166bf318d2f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089363, "uuid": "157bd963-0283-4803-8bab-f220ef80e696", "comment": "Malware payload", "value": "54d7d3155e81341a9fd44a79778c55c1c4fb7676", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089363, "uuid": "c2e6b290-b56f-48e1-b104-4f9d56b4536c", "comment": "Malware payload", "value": "c1c37e45996f7cbbebde24825cdc56ba3cbb18c64de611a2db39ae6084e70cbefa0e9019324419a99daf25b181089103", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089363, "uuid": "5fed1555-c7aa-46ba-b92f-7cbea6fd4f45", "value": "T166452303AAEC9535DDE52B74A8F702DB4E3A7CB14E7C87670546E58B0C72A40A9307B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089363, "uuid": "f373177a-db0c-4b06-b9e2-0b1bfc26dac8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089363, "uuid": "c31aea13-5d1d-42ed-9bc0-0c9a364f7074", "value": "24576:GyDAFWItwpQPtPbIH/JbEzXXSOZTMwJKDGvNUvB2yA9N:VDAQCP5EH/FETTPCoyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089363, "uuid": "b7653ad5-f676-46d7-b65c-ae09cee9e3f6", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089363, "uuid": "08efe084-7d7a-4a95-98c4-7d754f66fc32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089363, "uuid": "3cb413b2-48c9-4602-8de0-8d129647f243", "value": "dfd9f73601aed35cb90d2d5250410efea74dba75afe5ef60efff166bf318d2f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38641a0f-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032686, "uuid": "9791a27a-0130-43a7-adc9-89222861953c", "comment": "Malware payload (Mirai)", "value": "74f32bd247fb9ff7ae911635db85be9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032686, "uuid": "75a438bf-f81a-40e9-93b5-a04ae4703079", "comment": "Malware payload (Mirai)", "value": "dfe35e8bb388047560308bd259bd628e324cd32f1fbba0cec5764713f035a7bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032686, "uuid": "f7086508-20fe-4c39-b211-978aa6ade471", "comment": "Malware payload (Mirai)", "value": "4fcc341dbba3fd17f98aed476499d8ca6a2ff5cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032686, "uuid": "5c539885-57b6-4036-9103-faa6dabb94a0", "comment": "Malware payload (Mirai)", "value": "f5bf30960ac744d50f02b548a217d137c35fd9b60be7bf3b1b1e51f5e8bdbbf8edb4753143ae0842a6b5f0c6d35d894e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032686, "uuid": "996ae247-0513-4b0d-a13d-75fb7e7164e8", "value": "T1FF230755BCC28A2AC5D0627AF93E899E3311A3E8D2DF7217CC201B117AC650F1D67E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032686, "uuid": "8d57db6b-075b-4a34-8519-0c87ee140f36", "value": "768:cE3OpA/nNgmQW1R1w7NDE4GCQVe5689agFQoZWayPlqP9C2p8gQNMvDPCVMXrbOt:tOENgXqR1w7NDxGCsOagTJyP8g2p8vuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032686, "uuid": "cff2e56e-6153-4d98-8b7a-5dbfba62658e", "value": 46664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032686, "uuid": "5d4e96b7-c243-4ac3-94c1-3d66c8ccf1a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032686, "uuid": "ae3732d7-37e8-49d3-b139-10f56aeed8f9", "value": "74f32bd247fb9ff7ae911635db85be9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300644b1-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089366, "uuid": "ff037b1c-072f-4161-bfb1-506f42147b72", "comment": "Malware payload", "value": "e60a23a656ad9482bad142353ae0da4f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089366, "uuid": "59d2d8de-b02e-4a5a-84b5-f5762f6a1624", "comment": "Malware payload", "value": "e025e623e6d1494a330b5934fb2803467a4517ffbcb1a774c59b692598f4591b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089366, "uuid": "ff2824a5-36c7-4baa-92e9-3424c0352b9f", "comment": "Malware payload", "value": "fdad3a01d347278e9da35fbe41fbc1c2ef0b0a6f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089366, "uuid": "5304248a-c66c-46f4-9e19-fe33df183acd", "comment": "Malware payload", "value": "d652eaba0d96661dab8c25e2ef0eecaacc4dec98aeff300a3b335bf787291062bf63532d15d5643e7a560cd86297ad55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089366, "uuid": "4985923d-3b61-484f-b53f-b4f0f4ca532c", "value": "T1D2151203DBD88832E9B92B7484F387930A3A7DA19E35877B2B55585A0CB35C0E971377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089366, "uuid": "a0942059-3e70-4487-9b15-88e7f9323a4a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089366, "uuid": "8c564823-1711-4491-bce8-96622e721e1d", "value": "12288:zMr4y90y4o9otlycKCjjjKBKWnXl89hVlpmO6WvmW1/6MQP/9cq3hVvGXEuweLpk:DyX4oWu+jA+hd512cqxVvGEqLpEEhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089366, "uuid": "907eea6d-6651-4b46-8eac-35d11af35ae4", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089366, "uuid": "85a8cd96-ebc9-4456-b02a-531d0b7cbf03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089366, "uuid": "8b78d022-6701-47e6-841c-4d103ce60679", "value": "e025e623e6d1494a330b5934fb2803467a4517ffbcb1a774c59b692598f4591b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322c892a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089369, "uuid": "ad244588-78f9-4224-97e6-5be228a5ce20", "comment": "Malware payload", "value": "468f61c4ebcf2d105a98aedf35c87573", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089369, "uuid": "ff204714-2d58-4621-880e-bdddbbb04927", "comment": "Malware payload", "value": "e03a9e1e1776e4b867750ce2fedb93d2cea0b843b570e62839c16e451a8ca9bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089369, "uuid": "624e3ad1-a553-4d41-ba2d-6f35a2f0b33d", "comment": "Malware payload", "value": "f3f7727c294f254ad885cd54047dcbfe650dc067", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089369, "uuid": "89b9f45b-5d5c-4fe5-830a-db952dc65de8", "comment": "Malware payload", "value": "39ae37e7af51e40b6804bd5ead5bec0a9c35afbe59b155899991a38099881dc9d6b36fc9511d6dcea85c6ef45ccf287e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089369, "uuid": "6b7f8e3b-b670-4e2e-a0ac-0651a3abb820", "value": "T1B8452323BBF55533E0B537B02CF942830B317DA25968827B6360F94A6CB25D09A3537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089369, "uuid": "ac6f4352-756d-4458-b58a-0b02cafa07df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089369, "uuid": "8b5c4318-07bd-4438-a146-f7685ba42c07", "value": "24576:OyndT/pBFbxhCJ3n4yVHokgqfzCn4aKVQWCb/ZxLk4ttFK:dndbFCJXfHoIfzC4aBVJJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089369, "uuid": "e734fb17-04ee-4e2a-b999-fa1fb3f88d75", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089369, "uuid": "cd8e38ca-b772-46b7-bc05-1f1776fd5270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089369, "uuid": "e740ea65-a09c-4979-9539-38d31f6c7954", "value": "e03a9e1e1776e4b867750ce2fedb93d2cea0b843b570e62839c16e451a8ca9bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33109395-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089371, "uuid": "7d1c68a1-d4d8-45ee-b2a2-f4a1f5c8b27e", "comment": "Malware payload", "value": "3282c53e81915c17e99b7d2797ba2ff0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089371, "uuid": "c1f3ff61-1171-4f30-810a-c98608191c2b", "comment": "Malware payload", "value": "e040903a5ed4cfb75edd7149c5e3aed3a4fc03bc42d143fcd5b77a05830b9c0f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089371, "uuid": "e491d455-039f-445b-912e-29c44175efe7", "comment": "Malware payload", "value": "ebf0894444b0f3766541a990f1450372fd053114", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089371, "uuid": "5e7ddb1e-9683-4782-b064-218bfb0b2c58", "comment": "Malware payload", "value": "570e79d74a1528389b65a45c449c1c9705d080fc37dce938c76fe8c570200068a28ce5c4f0170f76545abbcfc0c1912e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089371, "uuid": "0d5bbf72-5363-444d-aaf1-8804d59d31ab", "value": "T175452313A2D0D435D8B65B7054F603E3073A7D6A5CB8C2AB675DAE1E2CB22D06932377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089371, "uuid": "0d7117e1-30d6-4faf-bedc-dd99f8f26fde", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089371, "uuid": "4ee10ac3-f063-446e-b46a-b979fd371762", "value": "24576:cyb0Be4VPE+UorJwRR5uhmDOhWpjwHLc1UqL12lsJZhPF:Lb0JVs+UuwRR5uhmDoSj6cjbJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089371, "uuid": "dcf8a22c-46b4-47ea-983e-af1b7189d7b1", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089371, "uuid": "475e1e04-10d9-418c-b2b9-c3362d6056ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089371, "uuid": "5f2e2bf8-9557-47d8-9205-9a994e5c160a", "value": "e040903a5ed4cfb75edd7149c5e3aed3a4fc03bc42d143fcd5b77a05830b9c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6d6691-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058302, "uuid": "8d3ab33a-1a08-4f9f-a0b3-9e9b25ed891d", "comment": "Malware payload (AgentTesla)", "value": "f613231cd8bb886c5e231a3174540456", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058302, "uuid": "269d92d1-c9ee-48b6-8eaf-ad1b3c628f6d", "comment": "Malware payload (AgentTesla)", "value": "e04268f6e6265c7ad7f9c6f5e4edecce0cd7e3e399d096c288ab6089ab552734", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058302, "uuid": "609ba630-61d6-4d4a-ac43-f2c9bb9db67a", "comment": "Malware payload (AgentTesla)", "value": "332d336572274d0befeaf3c21814f6df22027c82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058302, "uuid": "1c2b794a-187c-4ef7-aad6-c92f267ad7f1", "comment": "Malware payload (AgentTesla)", "value": "17e0c527357ed68ef15e5c3ddfcebdf9d386fc94afd314f1eb2dc2883d64344a6c5235af8358f684e9d0b0126c1e03e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058302, "uuid": "4c64936c-c20c-4e78-93d4-5fe8b2344bac", "value": "T17A05E67C2578E96FC16AC5A58AD4CC67F320906B3306DAE6AC9303594309B53B9C71BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058302, "uuid": "fa74dfb5-996a-4abb-b791-0b5bd6ac6472", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058302, "uuid": "0c6f9005-c0c1-43a6-bac9-4ed9ac61a2e3", "value": "12288:o0eoc3kPwbDvWEVJpgBbOctL3gn9+kc+MjTJaZHedNaRBDy1TcmO:o0edkIWEb4ScduLMjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058302, "uuid": "edabc22e-94f7-420e-b889-06f85b2a85d2", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058302, "uuid": "bef659e1-649b-4bcc-92c4-3dce73356895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058302, "uuid": "4d6ffb05-45b7-45c9-9354-51a83eadd1bc", "value": "e04268f6e6265c7ad7f9c6f5e4edecce0cd7e3e399d096c288ab6089ab552734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341ca45b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089373, "uuid": "ac20de8c-62be-4441-b0f3-065d20cd6aeb", "comment": "Malware payload", "value": "55db6060e2088a273573383c4789c3c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089373, "uuid": "60772b85-0e42-465b-a7b3-c26826529016", "comment": "Malware payload", "value": "e04e5d101d0d716311b6b71e2958c3493199b14d787f0da6b22a84b78f71e93a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089373, "uuid": "3112ac8f-9078-48b0-827e-a0be549d91cb", "comment": "Malware payload", "value": "a2633cd98d48996a740b8b0a05a5b60ff873bdb9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089373, "uuid": "d4a09b61-552f-4b28-873d-2f9de96f2525", "comment": "Malware payload", "value": "91a897d8aff1dd3ef8a6d7e2d7d6e2b732effb0ffd4199c4ab052ba82d956c04cc0cec703ef4682d7a3df1bb3754f009", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089373, "uuid": "df73eb7d-211f-49ce-b816-00d408318f73", "value": "T17E45236BE3D41072E5F81BB44DF706631E3ABC55987887A713892C8A5E722D0F035B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089373, "uuid": "59e22f68-44fa-4b77-9a7b-173f50e0a456", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089373, "uuid": "99049cee-d58d-4495-99d2-dcf034a20082", "value": "24576:GyMrGI96ZsJoC0xIwucHRYcWLTxRk6j6IxVapeqBAkxybUHNlD2Sq+:VM10Zsiiwu+SxqDwSxWKNlDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089373, "uuid": "af6f190a-db1e-4842-a6a7-ec242dd87b7f", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089373, "uuid": "42d8f117-6be1-4211-8986-dc36438c3c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089373, "uuid": "49036fb0-6448-4278-a256-f876f026826b", "value": "e04e5d101d0d716311b6b71e2958c3493199b14d787f0da6b22a84b78f71e93a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353e248f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089375, "uuid": "aa6fbce2-90bb-4c36-8126-2a2205537ef9", "comment": "Malware payload", "value": "d21ee45fefd089e3ba22158edd482199", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089375, "uuid": "6e965aa2-e5ee-4be3-b79f-5a01df6e76ff", "comment": "Malware payload", "value": "e05b5996361a0a1fd8610b45dfcc2a9d351e625db947117b1a35c3f7ce931b5c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089375, "uuid": "5de52373-a0d2-4283-8696-c50717c47e57", "comment": "Malware payload", "value": "d7bb2f8542dd5ae61b0ff393aa4271a1b7aaeeb0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089375, "uuid": "165f8442-bcfe-48a8-9281-3963d472ae85", "comment": "Malware payload", "value": "b1c229a9f788607c60e67835b1f7b654c8787c0e9db217b743722d54c80702ccb0d56ef584758afc7a08f8a9ab3bb00a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089375, "uuid": "c44186d2-08df-44e0-b854-bb509efc474f", "value": "T151151253BED99032EDB4277058FB12D30B347E928C74C71B26AA699F4C73648653272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089375, "uuid": "90b7761b-5158-46a0-8593-71945b06af86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089375, "uuid": "3da995c0-02e6-4a63-bd1a-1a208d9878b4", "value": "24576:dyLHMOuSVyZrv5TL/3ffdgJcflHXGWEc9Hg3OR:4LHMONVE5HXdgJgHXGWEc92O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089375, "uuid": "353b08db-91b1-4a77-aea1-53198a03a753", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089375, "uuid": "b4b00554-91da-4421-9af5-ad157228a9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089375, "uuid": "2783fb87-7a37-4d18-8da9-c7db1f8918bc", "value": "e05b5996361a0a1fd8610b45dfcc2a9d351e625db947117b1a35c3f7ce931b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3688b680-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089377, "uuid": "b8ed1488-51f7-4abb-a0de-950e71c7c7a7", "comment": "Malware payload", "value": "a2e655b3c8409d8c4f35c7500d3d00d1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089377, "uuid": "27a20679-710c-4f67-a19c-dd7fffa765f1", "comment": "Malware payload", "value": "e068999528fb6b78287ba49598c1042c163fdd18ca3c0a4732d03ddfeeb80f16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089377, "uuid": "ae7ceef2-d811-458c-8ba4-bc704e91c1d4", "comment": "Malware payload", "value": "5da32dd6fcf961d4083ca6199af2c9164c995bb9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089377, "uuid": "9c20164c-6326-4b79-bee2-acd84b5cf447", "comment": "Malware payload", "value": "a05e89d2efdb3ce8b8982c8384bd4b6d7ab024f405ef5088e68d2d69ad3e423522d1e6a50157e9422e56d5360ce1327f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089377, "uuid": "4842873a-cfe2-40a5-827e-5286f95cb7b2", "value": "T12B4523A7A9D89566D9F52BB10DF713C309323DA80D7987B73282151B0973ED0A8363B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089377, "uuid": "d58d8706-463e-4e69-a837-1030b9d6c7ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089377, "uuid": "47350ec9-4fff-4e09-8748-c5850214b3e9", "value": "24576:1yn3Kz1bltxqYI6vQP0ZxUe2MjI7ZHlpi5r2RbsZDKNuPiVqViM:Q341P1ZUXMjI1FpQaR8DKN2iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089377, "uuid": "c04dd5c1-0651-4f58-9e97-a515a8203cd3", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089377, "uuid": "061b27a1-0ccc-4845-a703-27a3cea338a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089377, "uuid": "5d649582-9309-4098-8bb8-db0f667f4456", "value": "e068999528fb6b78287ba49598c1042c163fdd18ca3c0a4732d03ddfeeb80f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376e9280-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089378, "uuid": "7840844a-0ebd-4133-8e85-1db06f82721f", "comment": "Malware payload", "value": "34521dab581f0f6fb9f1d6af0bfa8eb9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089378, "uuid": "fd81b70a-601b-4de3-8c21-e436f0070088", "comment": "Malware payload", "value": "e08c4ab1b72928d238e7c6c5eafa7bd35baee46abbb2422a4513d0d0063c9f61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089378, "uuid": "ad102a19-122e-469c-8b78-ab09b70a2fbc", "comment": "Malware payload", "value": "8d76c836a8768961d489b2939b3bafd19eb9bf7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089378, "uuid": "e41981c8-2c6b-4a62-bba2-2a5f2b35581c", "comment": "Malware payload", "value": "15edb44801c98a8408ccde62a3438d682de1f2ad58f794792ac35bb268ec879b5496c8a9740f0607d4e6862475c1a5fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089378, "uuid": "13c3382d-5bc3-4430-92c4-644a4b732933", "value": "T1FE4523A397E49177D4F42F7024F623030E393CA25FB4532B2381995E1E72A52A5717AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089378, "uuid": "f82252df-ca9f-4180-b213-de3a7546324a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089378, "uuid": "818367a9-cd7a-4528-8b96-8a77d058bf75", "value": "24576:pyPrtF32O9NfVkdHs7laoUD8/ycmKNoB31eMYM81zvbNuRy5RB:cPn2O7VhXyqNySV1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089378, "uuid": "6cb5f51d-21e0-4e9a-95f6-39b70025a1f8", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089378, "uuid": "344bb4e1-be56-44c9-81c6-622437d4a92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089378, "uuid": "eaff504a-3037-4030-b19c-c91aef62a779", "value": "e08c4ab1b72928d238e7c6c5eafa7bd35baee46abbb2422a4513d0d0063c9f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38795679-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089380, "uuid": "1aa3d81b-f16b-403c-bfbe-764c929d1650", "comment": "Malware payload", "value": "bf641b9993b66a973b218e1d6f5a8583", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089380, "uuid": "d5ba297f-2dcc-43d1-8f3a-3f02484d2233", "comment": "Malware payload", "value": "e0b703dc45ef6d542e2ab0c803a9e15d78a047211589765267ee8c59f151e76c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089380, "uuid": "07864dd6-2a6b-4f8f-827e-308366dc761c", "comment": "Malware payload", "value": "ed7cb947391096068e88186f3f46193ae0367998", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089380, "uuid": "ac31a184-8748-47c2-9714-c268d3e84985", "comment": "Malware payload", "value": "0df7e46f09becc35498ab81d8f915c6f898d5292e39ade12f979a400e959220706b23a739ab755219c072fff37a6387a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089380, "uuid": "59f04da1-116d-433b-b742-d25d9952ff96", "value": "T13445230366D49232D8F627B488F606872735BD705C7087216B85E95E4AF29C0BB367BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089380, "uuid": "0ef9b97a-2543-4e19-9b1b-13c4e2819016", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089380, "uuid": "dc2960d5-7928-4544-82d8-58c4f0afc5d7", "value": "24576:gyFIxjlF2DSnyiUE8gLao+uFDgpa5WNt3Y6EoM2u+v2vgnLGuwVfWE6udW:n6HmSnHUYLR+uFDgpa8JY6EorSgLQVfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089380, "uuid": "f19d2fc3-62e3-4093-a37f-20ad497f9992", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089380, "uuid": "dd296355-11be-4d46-adfe-8b89677dd7d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089380, "uuid": "c010369f-60b7-45f3-98d2-054f8ab6592b", "value": "e0b703dc45ef6d542e2ab0c803a9e15d78a047211589765267ee8c59f151e76c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39610d71-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089382, "uuid": "03511697-1aa3-4126-8b2e-99d1777e10e8", "comment": "Malware payload", "value": "cc3c2886c63ae3635aa98cd820e6f81e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089382, "uuid": "49d6ff7e-2733-4a58-8a06-6a3501f46cc0", "comment": "Malware payload", "value": "e0d283c0ffa6710d51b8143e60ed5fa55b772ec1e130f7f3b1d2a914a0122ec1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089382, "uuid": "bd97e2b4-7c71-4fce-9b32-28c63d4735f6", "comment": "Malware payload", "value": "689c7054078ee818139387fe911204b3b1be53d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089382, "uuid": "dd5a185c-2b30-44e0-8f3a-53bffa5c77fc", "comment": "Malware payload", "value": "82e0400b70c79ecf8f7662f627287aa58202e3e8b9c585b7363154a1fd13356f7e4f425f83676109eb18d338f5836149", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089382, "uuid": "e478cc7d-ad20-4b0e-9fe8-e16dde5b49c2", "value": "T1694523437BC48126E9B017309DFA025B0B39FE924E7C876B2796E41A55716D0BA31B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089382, "uuid": "745b2346-920d-41a2-8a61-e0ad7687e149", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089382, "uuid": "1d45ab79-a971-4cf2-9df6-546487c03a66", "value": "24576:Mypl3Cs3iv3ZlJVt5yyPJzHeMtLAqzYfR7F08m4auWvUo5+:7plrirJVt5fxnSfddauCUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089382, "uuid": "7408b037-c7b1-4f05-8b3d-6f0bedfcb61a", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089382, "uuid": "6f795162-6dc9-4db9-8a90-b8fdf75bc8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089382, "uuid": "4fdec4e4-0f52-4257-a797-a22c752b380c", "value": "e0d283c0ffa6710d51b8143e60ed5fa55b772ec1e130f7f3b1d2a914a0122ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3f46d2-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089383, "uuid": "25a20733-9168-4d34-a55c-86c1142b469e", "comment": "Malware payload", "value": "310ab5c8a3c06351dbff9cf457c24c15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089383, "uuid": "6f7096d7-ef9e-4bc4-9d42-319b2deb34fc", "comment": "Malware payload", "value": "e0db73032f4406b4e717c2e5be370c1a0449913c27ad27e0b2dfb81bb0c47f5b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089383, "uuid": "845bcb6d-b833-4685-ae17-8a534d490c06", "comment": "Malware payload", "value": "3cf7b621fd911e93040f4800b27b2056911fadfc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089383, "uuid": "8ba413a8-be56-496d-93a2-1df037cc2d94", "comment": "Malware payload", "value": "836cee34465907f9ea85847d4f9e49bd456dec42a309f5ed40c1a240c9d05935895ab3812f919b99a54f713446dc526e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089383, "uuid": "27d3412d-2692-402a-9b44-a8a5b2f0309e", "value": "T159452346B6F495E2D9B4233018F64393193A3C65DE71D7A33305AE0A1CB3999B53A33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089383, "uuid": "837a6d50-b627-447d-a4a5-8a94636e8bf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089383, "uuid": "7faabb0f-7085-474d-af33-80b2daf3fd6e", "value": "24576:2ywuZEW+0+sUqLBtUx/f3sTDIr8wJXEjqGXmGyyu57U6:FwuSWQxYiXcg35EjqGXpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089383, "uuid": "62ebe926-7ea9-4e50-8ca6-a4587566b8d4", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089383, "uuid": "4321427c-f94b-4572-b0ee-0518b952af72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089383, "uuid": "d36596ac-6429-48b7-9196-13bdf8d4c1d8", "value": "e0db73032f4406b4e717c2e5be370c1a0449913c27ad27e0b2dfb81bb0c47f5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca5bf17-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089387, "uuid": "63b5767c-7aa1-4559-aad5-e0e80973a1f9", "comment": "Malware payload", "value": "e5dfc7c3f960cae7c3febb8eeb5f4d30", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089387, "uuid": "28c3e253-2d98-484d-9846-fe17aa816698", "comment": "Malware payload", "value": "e0ea92c12699a56db41787358f0ace7e8fa340b12c7df2f0ec060e47a8615637", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089387, "uuid": "0c2da562-ea0c-4c77-a704-0a3d25928bb1", "comment": "Malware payload", "value": "6c80ff4699a3f4fabed4f022895c539b7603023d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089387, "uuid": "061bc662-9497-44f5-99a4-b7b58dd03df1", "comment": "Malware payload", "value": "80559ad216a7317e82dbeb90ad0b761e52ae9e4bf841fe79a21929b3a1f7934da91691e2307189e23ddcb1f5cfce1ba3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089387, "uuid": "3319d890-1e32-489e-b56e-ae9f1294b9f7", "value": "T13B452302E7D95173D9B527B019FA1A870E39BCA14D29C69B3A45787F1CF3A80D13136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089387, "uuid": "58c936de-430c-4512-8d05-78ed8d6992d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089387, "uuid": "2e38be5f-1ff3-4dad-8125-bfe30935d85c", "value": "24576:zyg1LHUrZLqRJ6VTJDzLeIDRCj3IU2g/mjQ+:G8LHUrpqRJSThLe17nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089387, "uuid": "ff4a84c3-3aff-436a-a75b-6da5de3d95ce", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089387, "uuid": "bc61c991-1e91-49a8-b1a9-a1e6014a7559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089387, "uuid": "9aa80f15-fce9-468c-80ea-52daabeac213", "value": "e0ea92c12699a56db41787358f0ace7e8fa340b12c7df2f0ec060e47a8615637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7b89de-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089388, "uuid": "7fad59d2-0453-4141-8af1-d0893dd0f17f", "comment": "Malware payload", "value": "92333496a04a90cdc78725940436c319", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089388, "uuid": "bb94eda5-8a2c-49ac-8114-6abdfcf75378", "comment": "Malware payload", "value": "e10a82f81335c791b660602e8b382ba6d32f34f87d748bf78ea084785022fe3d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089388, "uuid": "7e73b8c9-a746-4938-a887-fb286cf8e39f", "comment": "Malware payload", "value": "38132e6460af6b22928fe8d43eb653232dd43b94", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089388, "uuid": "92a88871-6f15-4658-a53c-43589b583036", "comment": "Malware payload", "value": "f45b10a6cec7fcf89122dc1bc57c52bc7a508e279518c6b4bd6039457552c798a9a21941022ebcabcffdd306cde93d05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089388, "uuid": "25aaa768-3b32-4ae4-ac3d-87421f9486d1", "value": "T1114523177AD50132DCB93B7094FA87E31638FCA19428865B670FEA6B0C71AD424F536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089388, "uuid": "c280e24b-9899-45ff-8e27-fda0a10ead71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089388, "uuid": "e1e028f6-e8ec-4684-a920-439c5f794d08", "value": "24576:Vyec8IdrNr5B+GCL/Yz0jFn1MPVM/QN9JCSozZy9rIxq0:wKIdZNB+Ge+MSPaYpW29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089388, "uuid": "fcbf1e37-87ae-4162-a312-98e426e25f6d", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089388, "uuid": "c86b3cc1-1a1e-4d97-8aac-16821ef63340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089388, "uuid": "9f487c95-b224-4470-8486-defd0b39fd9e", "value": "e10a82f81335c791b660602e8b382ba6d32f34f87d748bf78ea084785022fe3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6959e0-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684066868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066868, "uuid": "e6ff80ed-2b46-4aaa-b55f-6b3661c8b99a", "comment": "Malware payload (Mirai)", "value": "f83fa0073ada4d7b981e6eb20d6c1576", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066868, "uuid": "b7e37194-d65c-4d5d-ba82-7526f02799ec", "comment": "Malware payload (Mirai)", "value": "e15a210a96aa0b8c863c290f330f4b0940c64b0ae18fb467a3e6e56c47a9a9fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066868, "uuid": "e263efce-58a7-442c-8348-1c5ab2649445", "comment": "Malware payload (Mirai)", "value": "e56e29be0611dafaf2967ad812a766fd4e624179", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066868, "uuid": "9e3ad30e-b7cf-46b0-ad0d-476102bace2e", "comment": "Malware payload (Mirai)", "value": "953bbf842ce1494fb1df9f6eb672e493629be16433daabec27538577d8ade71544a60b2e4d958ad9e04ff9aedc1d270f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066868, "uuid": "55ca877c-1deb-4192-b9a1-0d52a516c8c9", "value": "T1CDA2D025D345AEF4DFEF9DA452C2C2C276E543C6268AC8E340FEBF026906056B748D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066868, "uuid": "9668fd15-f6cf-4c5f-b5e2-8f6ec70357d2", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5MM4uVcqgw05VxJh:9RxsSVsMD6xiJJE5zRWNh4uVcqgw09P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066868, "uuid": "6491e51b-a8f5-490d-89c8-090a2ba345ff", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066868, "uuid": "a5179c94-d1ba-421e-98fc-95616984f4fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066868, "uuid": "ee104cf5-9c29-487e-b2b6-4d94dbefef16", "value": "f83fa0073ada4d7b981e6eb20d6c1576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec807b2-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089391, "uuid": "50b93b12-47ae-4f67-abc4-905623cb4ed8", "comment": "Malware payload", "value": "37d4e414d8fa8f955a55a49a19463b12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089391, "uuid": "d593bddb-7c02-48ac-86d9-c52c38737119", "comment": "Malware payload", "value": "e189acd674efc58d7d1f34b6b0492a7701b1f6e6ef044397596ddf23a18da3bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089391, "uuid": "0476f3d5-bc5c-41e8-945a-99a3a1680a09", "comment": "Malware payload", "value": "f1c95a5557b9243303ee47adb16a49bfab93d180", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089391, "uuid": "b3a5627e-12bb-4228-9c1e-f82c404ba3f4", "comment": "Malware payload", "value": "ce769352591781e7304cdf79b27c3913108f486a8ca758825be74c969c9f70c2fb3f75b27cc0d7c69e10a91a47f23986", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089391, "uuid": "8e2b1681-3984-47bc-a403-257cfcded8a3", "value": "T12E55232695E50423D4F90BB04CFA03930734BDA1AE78C76B2B4A5DAA5CB26C1D47277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089391, "uuid": "41c7ceb7-a01f-4c1d-b654-a9f065ad52b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089391, "uuid": "e60a3a75-5958-4137-896f-97a2a5a3ed1f", "value": "24576:Uy0CaqoJexgB6YLM3zBEaqBKEhTgMmv2BBfxAaUznELjs:jlHA6NWZjWZKbLQELj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089391, "uuid": "e6e4be90-04c8-4382-9701-c81003de013c", "value": 1291776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089391, "uuid": "3e430fdc-042b-4c75-9845-873849d2f7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089391, "uuid": "87464885-fab9-497a-b0fa-91e6cfb4de8c", "value": "e189acd674efc58d7d1f34b6b0492a7701b1f6e6ef044397596ddf23a18da3bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7b19d7-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089392, "uuid": "e0bff139-67a4-4697-90f4-1be0094a7377", "comment": "Malware payload", "value": "1806f73dfe2e8c321f245f532dae3fd1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089392, "uuid": "2f4f4368-8160-4ad3-89da-7fe99d138db6", "comment": "Malware payload", "value": "e190bd71e3eff06d47f0345989cc8f2269fc592ac6060b5855331b3a3e5c577b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089392, "uuid": "7720eefa-50f0-49b4-9cc4-7af58f5f0a5b", "comment": "Malware payload", "value": "a8462a4deea5a64a6824fcd7e79e1ac064ca2849", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089392, "uuid": "72c93e0e-0948-4b7f-a474-53b7488cf5ef", "comment": "Malware payload", "value": "c65df460b7df979e9a68c54361dea82a305b94cd8bb2016103b46b75f1c98a9b24f9ae5c2effa71b6c3a2ba04c4c82ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089392, "uuid": "6e1363e1-274c-4798-aa3b-c7faeb0d2e37", "value": "T1C2F41203E7D88573D8F823F04CF607971B7A7CA445A893A727856C4A5DB37809876B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089392, "uuid": "d684a40f-0757-4ada-879b-00a8704847bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089392, "uuid": "67222089-50c2-4add-87e0-1d8bd01a8ac6", "value": "12288:bMrPy90WtwTYeegey+x9LUHVtI/nLO8KcOxga7eAQVTFy9twnGMfHk6:cyDwTY4+xhU1C/L2xga7ebkwnx/k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089392, "uuid": "b38a2a61-1835-4e82-8cc6-b91ff1f1762e", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089392, "uuid": "b8180d03-3706-498d-975c-1414308b6e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089392, "uuid": "6789174d-bd93-410a-b1e9-697bd00e4766", "value": "e190bd71e3eff06d47f0345989cc8f2269fc592ac6060b5855331b3a3e5c577b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f85488-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089394, "uuid": "35ef4e7c-8cf8-47a8-8cf9-ca0e50259d23", "comment": "Malware payload", "value": "b36774545a331c697d39ac4b3009caa3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089394, "uuid": "77b990eb-e1fc-4359-8488-2b1717cc0a19", "comment": "Malware payload", "value": "e196972679d31597c23fd5d24d6cf341abf8a8c5d3ad5c7b677d81db11f54377", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089394, "uuid": "5d95fe7c-0ab6-49b6-ba92-f74cf0c6b2ee", "comment": "Malware payload", "value": "d28618e3912abf0ecbec9493d09686e10c12b0f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089394, "uuid": "18199ed0-184e-4e0b-975e-788fc1670c2a", "comment": "Malware payload", "value": "8a8beecaa1938aaf586e9aadbf4e63861a0453a811698a4307363206355c388f62eb5f3d6420f83c8a9c77dbf28ac49e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089394, "uuid": "9ae89315-97b6-4470-b8a0-bf85fa358451", "value": "T125452306A3E85033CDA3277864BB47970B3AFC965670936A3389691F4C72BD0E57173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089394, "uuid": "0f986dc4-059d-4014-a40e-6539f675fedc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089394, "uuid": "4ecc9236-4d81-47c0-badc-30965ce3659d", "value": "24576:7ylAYjqgEXyagUO8zpBL1HHZYz732lavJuzBN6giK0VwWmitTRG7a:u85XaU5pxR5YzbgSJudbiK+wU1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089394, "uuid": "8056dc06-a883-4d3f-9a4b-5ec6fbc85480", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089394, "uuid": "9c48006f-2b92-444a-b703-a6c00a6c5b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089394, "uuid": "b53a44aa-13b1-4c62-aefd-05ad9feb1f72", "value": "e196972679d31597c23fd5d24d6cf341abf8a8c5d3ad5c7b677d81db11f54377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a15a32-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089395, "uuid": "d6b660c7-d0de-4adf-a4cc-d0bf8bf1924d", "comment": "Malware payload", "value": "509265a8df3471813d6ba4ae0f680671", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089395, "uuid": "b0e97e3a-13fa-4341-b556-4477cb3a63f3", "comment": "Malware payload", "value": "e1a9bbaee7fed9154443855980be42650aa3cb040803db7d7335348caf47d1e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089395, "uuid": "945aa043-c71b-4e4d-86c7-621e094ca201", "comment": "Malware payload", "value": "124a2bb09976d4ea3da6a780a594bbfce3249f08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089395, "uuid": "0ae83586-13f6-412b-9884-1686a7c1c6a2", "comment": "Malware payload", "value": "6f8f4a0d6c53cfa2a0ee15a06384993b255a2ff9448ea11658200f995184eb6ff74b62db6d66ce2c87aee5e9712c835f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089395, "uuid": "9b86769f-8ea4-46c8-b11a-c96ce6fa8899", "value": "T1A1151242A6DC9033D8BD2B7009F612D31839BDC2893996AF7385AD5E1DB16C0E4747BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089395, "uuid": "005a835f-8d93-48b3-9e1d-5b86c9bce112", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089395, "uuid": "f4b84b52-2474-464a-a437-7b92761c1dee", "value": "12288:oMroy90Ok8UZuc0mBq2NQmnoM7pk/ItIQtr/ogUNByQRuw3O07V/xQmAKYe3:AyRi0ng9kocByt0JLIe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089395, "uuid": "61f38186-4593-4824-b16b-e4ec902b1a92", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089395, "uuid": "e0426554-36e2-4790-885a-668e5a7b876c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089395, "uuid": "fac6df36-fe0c-4709-af41-53f5ec5b2164", "value": "e1a9bbaee7fed9154443855980be42650aa3cb040803db7d7335348caf47d1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424ed039-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089397, "uuid": "e03844d0-9ffd-4fe3-b8b5-63dfbbf93af8", "comment": "Malware payload", "value": "98cebeb25287cf800b65ac09103b0356", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089397, "uuid": "f15a6132-f0ca-4b61-9be7-3811402e5a3c", "comment": "Malware payload", "value": "e1c1f35c0befb6a2e46e18b28ad1f0b9dcf963706aa0d78e26e2aa76fc93c65f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089397, "uuid": "8c2eae6b-ffd1-474e-94b3-acf6b0ffbece", "comment": "Malware payload", "value": "58f7c5ec8c8ecd702f54c231a1c7424bf845f5cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089397, "uuid": "cd09bb97-d539-424d-bbd5-2013447797c0", "comment": "Malware payload", "value": "6baa2bae9ed87789dced89a68bfaf1bfb0506bc42922a9f093809d9e8ebbcf091476252867ba38b5e12c5eb34ca5a302", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089397, "uuid": "02976d06-b3c8-4e7f-a2d8-b427a006c458", "value": "T1A5452313E2F95876D8F2677158FA03D30E36BEB06C78432B469A695B1C622C0483677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089397, "uuid": "e6430521-404c-4ec5-9192-c8da75c4b607", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089397, "uuid": "25678e46-4369-4691-9567-0d357a21fc66", "value": "24576:XyFmFokEzYUsXzvMUdCdKrxYDSX+RB5v5I8Gr:imokcVuMUUKR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089397, "uuid": "2c6379a4-3e97-42b0-b1f6-9323efd2db9d", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089397, "uuid": "22331fb9-81e1-4b4d-aa01-31a0ca365271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089397, "uuid": "2fa01fc8-f9f1-4f04-a578-3ee9e54e80ec", "value": "e1c1f35c0befb6a2e46e18b28ad1f0b9dcf963706aa0d78e26e2aa76fc93c65f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e87f60-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089398, "uuid": "9cfca688-48fd-4c50-ace3-6c80b01c2f9d", "comment": "Malware payload", "value": "a0083d895fbb1574c9418f7c648f8739", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089398, "uuid": "3ca11a4e-ac71-4f71-b53d-2c1d3588cefc", "comment": "Malware payload", "value": "e20059c975e3b3ca0d2bdc906ce4608aed80d4a938667b83fc97990fd0bf5c73", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089398, "uuid": "e5ac3879-3930-4b4f-b0bc-8472cf8ecd35", "comment": "Malware payload", "value": "e045820286d02711c69f84ac7ded1c06674a10a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089398, "uuid": "eeb42df2-cd13-4d5c-9897-4e4796846a13", "comment": "Malware payload", "value": "acc7844c435f90b083422b40da6407dda27c360480d7dfbb8d57f91feb1063e763e62f9ad75be2336f53122badaf0b7f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089398, "uuid": "51a06ead-9704-409f-b912-a4b035699ae8", "value": "T12F152392F3E45431C9B027B448F912D32B387CE0A9BC535F1A56AD5D4CB2660F836B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089398, "uuid": "4bf82c32-805b-455e-a7b9-ce72544e3fe1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089398, "uuid": "280b2ec5-4537-48a3-9a02-ff0879afd39f", "value": "24576:Cyy51BfzrL2+WbQU/BaMxXHOIZlq+X4lR4+EI:paL2GC0ITF4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089398, "uuid": "858e1cea-d976-469b-9235-ad18b4a9ed3d", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089398, "uuid": "66107344-dd0c-4e23-92ab-7b93383921c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089398, "uuid": "c7c05b02-58d8-49a5-be33-f50de3cdb255", "value": "e20059c975e3b3ca0d2bdc906ce4608aed80d4a938667b83fc97990fd0bf5c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438b7e78-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089399, "uuid": "b10f3d6b-8f5c-4ff0-93b3-db6622d9126d", "comment": "Malware payload", "value": "2d2123290508540bcdd217e62cdbc4b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089399, "uuid": "75bea585-3bc7-427a-a8bc-4f953a029328", "comment": "Malware payload", "value": "e20757a6d327dcc4bf152f62acc4eac6804d5682afbe9f2a94a3c095bfd30af5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089399, "uuid": "19c33d88-bf23-475f-8961-8e6e75bbeb57", "comment": "Malware payload", "value": "5cc9377910752ad55f4086497dc8a20556e82512", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089399, "uuid": "4f48eb51-e4c5-4cfb-938e-77e6c13bddc7", "comment": "Malware payload", "value": "91183ede604bad260cb7cbf74cfc89619deb1a72c2734af3828b67b4e44029fd7a35eb3860f3c6c57cb2a4123f5dfa45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089399, "uuid": "74d7e0ff-6885-4ee4-a57f-81b684020472", "value": "T143152213A2D80426E8FA17B028F603D7063EBCF265B983423A54799F187779558B737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089399, "uuid": "6779fe12-804c-495e-b4c9-5505733d90e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089399, "uuid": "c2243e59-cd41-4dbe-9a43-a0d0cc8cb1a4", "value": "24576:9yRcUS3KmIDHIlahSMB64M60lpOzHTj9Ps:YXS3KDDHmFDB6HzvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089399, "uuid": "ccfa87cd-5847-44dc-a6b7-3fa140a233ca", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089399, "uuid": "27c70e65-1c30-4427-8df9-2fa32109a29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089399, "uuid": "85ffaa76-a929-4684-b8bb-27a4fe887989", "value": "e20757a6d327dcc4bf152f62acc4eac6804d5682afbe9f2a94a3c095bfd30af5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44380779-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089400, "uuid": "87362fe6-e487-4693-8b06-574fc0934e80", "comment": "Malware payload", "value": "d154debd02464dc69a4c9cfd6c592dca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089400, "uuid": "58c0a92f-d189-4e62-9e74-1a83ce756384", "comment": "Malware payload", "value": "e21634605f0da9eed3640707ef20d30634972f4e603d1600c41d18db1fdcf076", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089400, "uuid": "702a6d4f-5ff9-4850-8c94-ac4694b9c74b", "comment": "Malware payload", "value": "cd0c2f06d8953e908525becf265aed62882a24b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089400, "uuid": "a539c435-f8dd-4475-ba3b-4945631dfb49", "comment": "Malware payload", "value": "5805c9d667dffd8fb4c4de7bedeca524f6886f592f42c608d1a7029648755f80c100d493547bd17eb71e196488220a68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089400, "uuid": "42552a47-50c1-48f2-bd60-b1ef08f60aca", "value": "T14F45234AF7EA9572C5A41B7028F202C75A31BCA26E3967233744954F18727CA7E32337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089400, "uuid": "32e1e94c-f257-43f7-8fde-9567c431fae5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089400, "uuid": "facf7831-a0f9-4008-b167-0bbc525ae7c2", "value": "24576:+yWYeAYYvg9F3d2WdC6SsG1bDI0WxK03n/AlBHWNpNZyLw2GFmEst2:NWYe/ZEWdEsW9WzoWPyc2Gn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089400, "uuid": "b1002db5-35c6-422c-bff2-9fdb2a1a547a", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089400, "uuid": "e467876a-f17f-4310-b8e1-b672ca1d0cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089400, "uuid": "9774cdc8-4c7d-4a4e-9447-08c9aafc9ce0", "value": "e21634605f0da9eed3640707ef20d30634972f4e603d1600c41d18db1fdcf076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ee12cc-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089401, "uuid": "863196d7-7ced-4238-980c-59d383bea4e2", "comment": "Malware payload", "value": "e2cd3006cdf89e2f6f8fb8b3f9a96583", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089401, "uuid": "9da94461-fb8b-419f-bd5d-d0f68e2f545b", "comment": "Malware payload", "value": "e23103eeed0983612db2cc91e5379650cc11bab08a0c576e890c7e39524a4c32", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089401, "uuid": "51cce24f-77a0-4398-bdac-a622b3cd4fde", "comment": "Malware payload", "value": "41bd1631ec4efa3a0e13f1c6b1f8151be9eaa5f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089401, "uuid": "a9cc9e54-f66f-49b8-be2c-6b359aa31d1a", "comment": "Malware payload", "value": "2c0df5b7075c6534f4c6af29f5b75dddfcd4e24a9d00656c101506bb8f28c8b416a6e30c06517584efa5369053f59073", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089401, "uuid": "9d8752be-d566-477a-a9b3-5cd4d96c8d7e", "value": "T14B452343AAC89031DDA917F898F707C30731FC52AC78C7AB27958C4E15B2594BA71B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089401, "uuid": "13282a31-31f9-461a-afae-29d683cdc124", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089401, "uuid": "02a6fec1-6816-48ab-8b9c-961a52a417ad", "value": "24576:TyEsEXKRiktYEmjx3R8ismbjFogsT/eZfqC97Slfyj9orF:mEN6okOEmjxh8iLbetypqovjGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089401, "uuid": "2ddace17-c976-43c9-bf5d-cd8167b88705", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089401, "uuid": "2a5db91d-9910-4dc2-a8d0-c2d194983038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089401, "uuid": "eb1593d7-feda-44f9-8675-e0edff959f7e", "value": "e23103eeed0983612db2cc91e5379650cc11bab08a0c576e890c7e39524a4c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459881f8-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089402, "uuid": "be309dc6-487e-4a78-bc30-07865402309c", "comment": "Malware payload", "value": "596e126a145fc17eada236c3e06262d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089402, "uuid": "fc03a31d-967d-4986-afa6-c4ae3d60d73c", "comment": "Malware payload", "value": "e29808acd1c7b69e115774334086dbd205aa0e181ee4a660327a5d02a81e4c7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089402, "uuid": "1046e39e-34bb-4420-935a-62c9a07f8e87", "comment": "Malware payload", "value": "3d320c868a1417e709ce83663e24c665629bad54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089402, "uuid": "a3702f02-0f34-487f-a473-c77cb24775d2", "comment": "Malware payload", "value": "7d11b48a265e99b9f4228986cbadde842a9fe0ed30b629436aaa0b1dcc38ce8494d37b1080885e160a978ad591a50dbb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089402, "uuid": "142b715e-ba09-4921-be0a-d52466684b88", "value": "T1E3252356FBD4A271C9B94BB014F303C30939BD619C38D32B7B859C2B48B16E5A47277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089402, "uuid": "34d41e97-b097-4dfa-a656-7dbf93ff9dc3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089402, "uuid": "901a61cb-6e24-4a4a-a715-409e076d8bc0", "value": "24576:pypIY3fcTe3Fw6GSVQkF2R+4SbZ94Mg5WYtneu1CJYiSb:cpNOWikVQBR+R94MLYhAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089402, "uuid": "6f1ca50a-df22-4b0b-84e8-597b9484c960", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089402, "uuid": "1ce399e1-b6b2-40ba-990b-c5d86bdbecad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089402, "uuid": "365aac87-d538-40fb-b8d9-333e2f74405d", "value": "e29808acd1c7b69e115774334086dbd205aa0e181ee4a660327a5d02a81e4c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4665e434-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089403, "uuid": "1c857428-667e-472d-8f74-82802a26bbf0", "comment": "Malware payload", "value": "7bcf45b31186e7132db3e9d8c6a21f8a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089403, "uuid": "8bbde94b-14e8-4e77-90d8-b5281a622a3b", "comment": "Malware payload", "value": "e29a3d17ce56a890473462e4ba1babb97061fe6f2f41d14db3da72dfe5ddcb8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089403, "uuid": "6e37f078-0340-4ff8-a17d-be2cc826ba02", "comment": "Malware payload", "value": "d20f52fd934bbfdd539a0e630ef87e9edc006120", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089403, "uuid": "730545a1-2f19-4080-9262-b5497d5bf190", "comment": "Malware payload", "value": "3e37807539c59c283a05c672d43bd9a6769c6bb84be55a7cea555f667c4d85467217cbf9ab2e5abbb165aa0d211ebb7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089403, "uuid": "1c391e91-e165-466f-b7e1-d3b23b8c177b", "value": "T14B452302DAFC8222D5F81BB125FA43C30E32BDA2DD7443666206BDA75DB35C5A17173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089403, "uuid": "5d1bfdeb-89c1-44f1-8435-4f933cba67a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089403, "uuid": "02a9f177-8782-443a-b12b-7040010a04da", "value": "24576:JyFbGgbFDAs3qjBJe/7M02Vbo10FyGqznFaoOuy:88gtAs6NJeuxogR2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089403, "uuid": "7408b6cd-c6a5-42a0-9708-99e06198f746", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089403, "uuid": "e8060d74-81ff-48ff-ade3-2f1918da5d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089403, "uuid": "5ace1ee8-e4b0-48e7-b119-bcfa1e3179ab", "value": "e29a3d17ce56a890473462e4ba1babb97061fe6f2f41d14db3da72dfe5ddcb8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4740d215-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089405, "uuid": "7f4cf911-c951-42d4-b516-b3d712314d0f", "comment": "Malware payload", "value": "4fe120e02866d7b4629ff6673ec3a3e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089405, "uuid": "e4fdd3ad-a0e9-46c4-88db-a27b52f1eece", "comment": "Malware payload", "value": "e2b2664bc1ae0bc34326e2a4bd6b4699afe2401c8ef72858e1dc9c21972cdbf0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089405, "uuid": "bf975f00-6380-477a-9a27-3ceb7281260f", "comment": "Malware payload", "value": "3592070f5b06c89d4c7ba24f145b015ddcfa6813", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089405, "uuid": "fd07bd10-9802-495e-9284-ebd636ea6332", "comment": "Malware payload", "value": "5beaa18f1c282811cc1ca02e3bf675d3be78ec52ee3876a0cbd06d661d27bf243fd1d65521e739e2d1927c7aaa0c0a25", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089405, "uuid": "e3d327cd-5a21-47d6-a1b6-2b66678ab12f", "value": "T17E452207B6D59173DDBA6BB448B703031B3A7DA0AC74428B33866D8E4D326C1E6B5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089405, "uuid": "1233f527-90bc-418d-9dc6-a5d55f28ad3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089405, "uuid": "39a2fbd8-334a-4167-b618-bd3b4ad6beff", "value": "24576:Sydy4GoJkLyl9q9hhVm4Z03U9ndr1SN+JcH2H4dN07kGo:5dy4YtFVi3+ftcHaGN07kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089405, "uuid": "698ca98f-4e7b-444d-8dae-db8d0a26b386", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089405, "uuid": "c8af1183-0669-4bf5-a56d-644488ace7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089405, "uuid": "315d57f2-7b8b-4ef5-b438-dc1f80daf3b9", "value": "e2b2664bc1ae0bc34326e2a4bd6b4699afe2401c8ef72858e1dc9c21972cdbf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cbaa73-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089406, "uuid": "0939d53d-548d-4367-8398-62049c8a7921", "comment": "Malware payload", "value": "7022578af4a5fa7a049b568559b97c89", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089406, "uuid": "381c47d1-5168-4cd9-80f0-94476ce36b6b", "comment": "Malware payload", "value": "e2bdcfe5796cd377d41f3da3838865ab062ea7af9e1e4424b1e34eb084abec4a", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089406, "uuid": "6d4b8700-52f9-48e5-80b6-1e9fa3807f9e", "comment": "Malware payload", "value": "24cd5086383126a9cdbb43d7dbe5bcb91d9bb13d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089406, "uuid": "a72797b2-9ee9-4065-bc0d-71349e1a2bf0", "comment": "Malware payload", "value": "d685be95a9e8b98635f233fd88c10c9947e2bc6e44dd3727dd027ce03be7a8902b3a537f998a64cf543d9c0377210b94", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089406, "uuid": "bc89351a-7c0c-4765-92f2-4e97dd1b0aae", "value": "T197A4238BA2415DDBEE75709C885F4F8A2EC940776FC03AEFE2B65729801482207BD959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089406, "uuid": "e1d2f54a-e559-401f-97cc-d0dfe63d1673", "value": "12288:Bs3cRQ3cLJEHYiHjblGZpUJh/VEWwhKuCdVwGV:bQ3cuzjBGoj28uswGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089406, "uuid": "1382f760-76e7-4079-9d39-f68246ee1af6", "value": 478605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089406, "uuid": "90ed8345-d305-421e-92b9-458701ca7127", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089406, "uuid": "899c8fda-6756-4730-8048-8af6b6f13b20", "value": "E2BDCFE5796CD377D41F3DA3838865AB062EA7AF9E1E4424B1E34EB084ABEC4A", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494243a8-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089408, "uuid": "9f14864f-91ab-4a15-b607-52cace7353f1", "comment": "Malware payload", "value": "1e0c9e5dd6a5c13d85209d4d4e98009c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089408, "uuid": "1ab8efa9-854e-4cb4-a6be-20f9073298cd", "comment": "Malware payload", "value": "e2ced1a635687dbe9b4ba8643db8c072696b952bc51310dc1e33b776b5651233", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089408, "uuid": "098dd6c0-ecce-4a5e-8cad-fca729fceaf3", "comment": "Malware payload", "value": "6a36c21d9c9ab10bebafb95bbb36086a356bc933", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089408, "uuid": "e9b6839a-4407-4ae3-9abc-252536b08239", "comment": "Malware payload", "value": "bfab9f1bdb344cc45d40dbfbda418097e623ecfdafc94109b2c03505f97e23e1629df32cde53817296bb340feb787426", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089408, "uuid": "e9d32beb-40a3-4330-948a-c97f22a48ec9", "value": "T11145230652EC40B3DAE66B7064F713C71A36BD611D788A8F5707A96E0C732E0D4B2B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089408, "uuid": "0dad2ce4-c9a3-4b4d-b560-70df42bd2f39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089408, "uuid": "1e530165-5662-4691-b46f-d76a58ebbf90", "value": "24576:kySld+4OKwmL5LjugeaHJqbUXz5MIDa5Bp3HhYFOtA:zS6tK/vRe6j55apHmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089408, "uuid": "66856dd7-0bcd-4d0f-9f90-3ce4200ea977", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089408, "uuid": "f8989c48-5f6c-4ada-a16b-d74093a4c3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089408, "uuid": "af3a8184-50c8-4c7b-8d53-09ef9a5864db", "value": "e2ced1a635687dbe9b4ba8643db8c072696b952bc51310dc1e33b776b5651233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2f33bb-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089410, "uuid": "e5bfa8a2-32bc-4cee-8d24-82907e3d43d3", "comment": "Malware payload", "value": "830dd227ec463ba2463fc4371d86a194", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089410, "uuid": "5e73eb3c-ecd3-49cb-b9f7-0e6350d8a8fe", "comment": "Malware payload", "value": "e31e680c888a3a820aefeb26d475703dae71bdf8ee772fe2aec4cdfcd1cebfea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089410, "uuid": "42577711-6571-4e90-81a2-ec5ff1a817a6", "comment": "Malware payload", "value": "30ec79f9b29a2addf7624af16458cc2ae81c6876", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089410, "uuid": "8b8737ba-253f-464c-996e-c04311fe57a1", "comment": "Malware payload", "value": "0249ae211460a2a0904171e88a4b03cce6da96200b98513b9da152b34262e4efcd7bc68434b4981f0a6e25236ae18ed1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089410, "uuid": "99d74538-d555-4758-be6b-3284771d866c", "value": "T1DE452346FBD81072D9F00731A9FA87D70E347DB1ED74822A26846C6F4CB3589A63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089410, "uuid": "bc5b2153-b7ed-433c-b3fc-929ea3b1a449", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089410, "uuid": "39733097-2145-46a9-8b43-0c21ee6ad03d", "value": "24576:iyQFQSpkxFfVlzy33TxEAlIhKBy/dXaP8FsrFo3TvIgn:JQaVlzyDIg4/FaPm6o3Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089410, "uuid": "b7e70ef7-ab71-4f08-8101-d4414cd17f8e", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089410, "uuid": "5cddd472-7605-4825-a6ea-f97bdb1d9740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089410, "uuid": "0f5fdda0-2213-464c-a62b-f4cc20d564be", "value": "e31e680c888a3a820aefeb26d475703dae71bdf8ee772fe2aec4cdfcd1cebfea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3d8043-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089412, "uuid": "ad45193f-21aa-4e12-95ec-f101e4f2249d", "comment": "Malware payload", "value": "e0cb81a6ce1d9d7d7c8bf2540cfb4870", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089412, "uuid": "e81534cd-6beb-4535-b5bc-279404ad99a6", "comment": "Malware payload", "value": "e386f1b0d82f365edaa257a8d317bbaed25c7c648614bdcc4f33f1969aa035d4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089412, "uuid": "61e483bd-0ee9-446d-9dac-e8058a358042", "comment": "Malware payload", "value": "6aa6bd6b9747d625fb38626e8eed965ae7274476", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089412, "uuid": "27be7ff9-5437-4f96-9626-3a96d4a68329", "comment": "Malware payload", "value": "973bf10b858cabcadbc626fe3697b77b580786d98833f0e4c521a6dd9925472e73b6439a05158052f9d45851db145571", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089412, "uuid": "33910129-3e90-4447-a9fa-938c500fb6a7", "value": "T14045230A97E09521E8E5373155F867830B3DBCA2BE78831B37591D5B0D726C4E234BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089412, "uuid": "45d128b2-ef0d-472d-9821-7dcd917ff657", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089412, "uuid": "03a9d1e8-2340-475b-9ddb-a699fd8c49d0", "value": "24576:QyZ01xLzVB0kdsokdC7aWZv8Kcll1d4fHFE6Rocil:XZ01jdJkAaWZv8TH7SvRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089412, "uuid": "5915a2dc-3e01-4c4e-8ede-4e4f7ca41b7a", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089412, "uuid": "fb9a6ff9-bc02-46c7-b57e-6c98a26002a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089412, "uuid": "899c2cb9-0c86-40db-8fcf-36a918ab1b8d", "value": "e386f1b0d82f365edaa257a8d317bbaed25c7c648614bdcc4f33f1969aa035d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112f2ba-f238-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684055867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055867, "uuid": "ba960c1a-2cf2-4688-9b44-265ae8a29d97", "comment": "Malware payload (Formbook)", "value": "f4fb22b77def98b9cc1231ab69a98f58", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055867, "uuid": "0648a1d6-5057-4c1e-a2a3-8bed8382072d", "comment": "Malware payload (Formbook)", "value": "e3afde7d787a34ec4480bc68be8f7b49ff2f9684bb3ac43cbeeb0b24c2ebdaca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055867, "uuid": "2fe59136-b382-4d8c-9ee8-f0bfcebaea54", "comment": "Malware payload (Formbook)", "value": "30cd2bd95cc57ee50b40cc473be488900ea142c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684055867, "uuid": "196e4a6e-d43f-418a-80b2-82d374354e56", "comment": "Malware payload (Formbook)", "value": "d47ff80fd8aae9c25d77f875b7601524471834b1888b8dbcb7de35cfa127eb06ab090b4ee7ef771e4888a2e1ee7153b3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055867, "uuid": "3b914e87-43b2-49d8-9d47-09cd684a52cc", "value": "T1324422247290C1BBE55311324DB71A7F0F67E11704EC5F4FAB848A197E3A691E60D7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055867, "uuid": "76e812a2-8782-4652-bb12-3d15037382cf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055867, "uuid": "4a031fb2-7f02-4ac2-8197-f32cd9706f1a", "value": "6144:PYa6fVqq8WYLW+L7VMcjl8yGZbtYQ9/sF74ACya:PYdVnY3L5M2lsZd0F74Dya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684055867, "uuid": "3837be9f-576d-4c75-bf64-4f9b253d5503", "value": 254342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684055867, "uuid": "8edd88c4-fb93-4a88-bc05-beb6d2ce8aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684055867, "uuid": "f27e21ae-16a9-4429-80d0-e0e927f7abee", "value": "e3afde7d787a34ec4480bc68be8f7b49ff2f9684bb3ac43cbeeb0b24c2ebdaca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0f577e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089413, "uuid": "c1d33a4d-359a-48a2-8655-db6c8f15cae5", "comment": "Malware payload", "value": "afe411f62fa3d2a1f6f04848401a2758", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089413, "uuid": "bc2f9bda-eb81-47f3-8557-072c1306fffc", "comment": "Malware payload", "value": "e3b29233e6a6a4ecaf96ba5099906eebe12f264469c88940df03ff15d1f61dcc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089413, "uuid": "a25748c2-bead-4522-8612-bc039edccfe6", "comment": "Malware payload", "value": "9f57190ab2cb002f0cc7416fcc5d31ddd5b0e12f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089413, "uuid": "531fda6e-d644-4439-a1e4-4e775cfb8878", "comment": "Malware payload", "value": "e0c388b27e4ca0a6cb451a7a89b5291db8756712f87165155ab63c85e90b9053cbcb0236020f3d828a0ab4a3b4808db6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089413, "uuid": "158aae11-599b-497b-ac0d-34bc340613a0", "value": "T127F42312BAE54473E9B413B048F707D3063B7C9498B8929F3385595B6DB33C4A476B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089413, "uuid": "0ee2da4b-78c9-4d8f-b796-fcdc86866482", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089413, "uuid": "26d169d6-66ab-46c7-8443-b0af0ad7f404", "value": "12288:vMrny90mcwwl8Suwiomg5khaxF0K0OANaggslg/DHeLLkH4dV/nlmKZHc:EySw28oMhIHANafB7evk4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089413, "uuid": "e7840e73-f54e-4076-b1ea-92204138bcf8", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089413, "uuid": "2f72f4c0-38b9-49a5-86fc-0636deffd0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089413, "uuid": "712b0da5-377c-4a8f-92de-a1a37242190b", "value": "e3b29233e6a6a4ecaf96ba5099906eebe12f264469c88940df03ff15d1f61dcc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d165d3f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089415, "uuid": "663df689-24cf-4d2a-ab45-8d0e92a25bca", "comment": "Malware payload", "value": "e53d011d0e7d7e2d49fa5b2cf7407735", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089415, "uuid": "4df96b28-e896-4c7e-8dc7-df2011964b35", "comment": "Malware payload", "value": "e3bdcac65d4014166b2beaafe02f23ffd04102bb0c5dc4e1851d0c699ae7d036", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089415, "uuid": "ed565792-e6cd-487a-93d2-620df8736762", "comment": "Malware payload", "value": "98175404fc09c1d1004fe50238135540fc1560fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089415, "uuid": "522d7101-1d0d-42a7-9d28-c02a534ea5c6", "comment": "Malware payload", "value": "56b49187a14cccf2915f92ebe5ad16906a48376016fa446419e584a73e115d80765491102591c4b36bdc11470d2a4531", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089415, "uuid": "ecda0892-8203-400b-81a1-cf3ac69828b5", "value": "T120452310CBD84837E8F167B498F617830733BCA95A39422B73461CDB1C326CAA97576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089415, "uuid": "4b8df6ce-889b-4ab4-b5bf-e0cd980eaf37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089415, "uuid": "40e8f735-50ff-4d0a-88bb-10004a0f1068", "value": "24576:Myl2R+CrsBSxcMvT1LUQ+X0pFGMB8sd7PA7Eg/JEt+tUx:7l2R+esER1AKWMB8s547Eguwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089415, "uuid": "9fd36762-1a9e-41d1-8c7f-b4a2759bae40", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089415, "uuid": "a20f940d-badb-4c1c-875b-18ef19419898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089415, "uuid": "d60837b6-6f19-4252-aac9-2a1069483bda", "value": "e3bdcac65d4014166b2beaafe02f23ffd04102bb0c5dc4e1851d0c699ae7d036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee5e9b8-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089418, "uuid": "8e16ac99-6dff-40f3-83fb-b677c5fea5d4", "comment": "Malware payload", "value": "2d660c8235be4c5446ddef429dd78eb9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089418, "uuid": "6e19c09a-e1c0-4e1b-847a-877d3558e62c", "comment": "Malware payload", "value": "e3e82c868b618e76a560f315097bf6fe9ba10c909abb1b51aad942a16a9c525b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089418, "uuid": "5fae7480-e706-4cba-889a-c3576e6fb6bd", "comment": "Malware payload", "value": "09a6c33d6f0da7d93c1b1ac7338d42d9e08a8ee6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089418, "uuid": "a5a417a8-70df-408f-9db2-cd011bbe0a7c", "comment": "Malware payload", "value": "d91cf3540b6df242a605ac0f1e9e5536c84c6d56cf1924ef88ecf906c4dabe84c4a11ab98e6f92cb211577ae2669c9ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089418, "uuid": "48ae8bf0-4b9b-4b98-83ce-c71a707c2275", "value": "T18C452383AAE80032D8B527F064F59AD30E36BDA3AD7483175785984F1CF26C4E63671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089418, "uuid": "195eaa2c-e908-44d9-a7ef-42cbcdee69ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089418, "uuid": "0685435f-1356-4dda-b999-8ece2cee5b4f", "value": "24576:Xy0JeiVujZUl8aGEoLjkHN7RraAyHQcoS85Zmu4dhDLPY:idiVoUbGBfkHNlradHT/850h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089418, "uuid": "bcb35563-a768-46b3-afac-21b4672c1f2e", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089418, "uuid": "d3703c14-f937-4ee6-9305-defc02219d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089418, "uuid": "fe1aecca-962b-41ca-bcba-4a06a930fd07", "value": "e3e82c868b618e76a560f315097bf6fe9ba10c909abb1b51aad942a16a9c525b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc708eb-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089419, "uuid": "fb9eeefd-fb83-42c3-ad0b-961e0587ae67", "comment": "Malware payload", "value": "d82b5f8a9e9671d229858593f15aff0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089419, "uuid": "c722bb93-51ea-4ef8-9a02-290307ca282f", "comment": "Malware payload", "value": "e3f7cf58dcb207b01b5cb48364c7870133e2f18a8a272fbc41f8ed6613500d7c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089419, "uuid": "e424269c-d2d3-4c3b-b1af-30526e3d3caf", "comment": "Malware payload", "value": "c51d86fc1e0d86e11aa90fd228094a7f3f37071d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089419, "uuid": "e1530ee5-9bbc-44c1-ad15-e39ee39ed97f", "comment": "Malware payload", "value": "148f61d262003296514bdbb045262dd994a9ff3442d8b8f9e7666418f59af1e46558def4350ffc2fb356e4e41e7b4be0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089419, "uuid": "82e0e684-b485-469e-90c3-81000e9de3a5", "value": "T1D745235375FA4532D9FA1F7408FA06830B363DB2992452AF3784AC5A5DB63C13232B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089419, "uuid": "56f53d66-f40a-4415-ae17-305dcd45c621", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089419, "uuid": "8541bae2-7388-4e27-9e55-4626591219fb", "value": "24576:fyNHWkoRgw9+4+NFk/FAtscYoWwzQYXazS7SN+emXoMtiswt:qNHoRg+8NFk/qtscYo9zQYX52+lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089419, "uuid": "29df633c-e677-42d4-a07b-8116fdea5322", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089419, "uuid": "dbc18a3e-b89a-4968-ac6c-2905449318d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089419, "uuid": "0510fa63-8705-40d3-8bfe-b20f68a2e7ee", "value": "e3f7cf58dcb207b01b5cb48364c7870133e2f18a8a272fbc41f8ed6613500d7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ca834e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089421, "uuid": "7df8ed81-686e-4d13-a797-ba6df00c54a7", "comment": "Malware payload", "value": "02decf3dce6aa7abba02d0891eba3752", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089421, "uuid": "e6c1e117-ac6f-405b-a9ea-dd07fc152a5f", "comment": "Malware payload", "value": "e424eaea895de876ce2d1d514715183cefae3885590be9a0a680d36f4b31cc93", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089421, "uuid": "8d527b50-9578-4e82-b12f-84137714ddcd", "comment": "Malware payload", "value": "4be3c3870379e1154e2a5098f88a025608b64e27", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089421, "uuid": "4eed20a8-f029-490b-9a69-a0a28c6a79f5", "comment": "Malware payload", "value": "143a0d0760d8d877fb7f541ec9cdb0d35f576ef0643d7e93ed2574c0d77ac252bcdce8576b39244415a0b087f112eb0c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089421, "uuid": "524d9b4d-1d44-472b-b662-ab4a1972f621", "value": "T1024523119EEC41B6D8606B70ADF256832935BD72AC7482A773D9DDFA08707D025323BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089421, "uuid": "55e9e3a5-52c9-4263-8026-b01cab79ce21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089421, "uuid": "5605a0f2-fdb9-40f7-a836-f35c1184710c", "value": "24576:FyzRsvzKEQ8TvCFknJZjt0hP8etZIGgU3nnI:gzRwzKEdCFkJZjtU8et+BU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089421, "uuid": "72d93b53-4d31-4442-846d-344792c4d96d", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089421, "uuid": "54cacc07-7982-4db9-b11b-45ceaf222e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089421, "uuid": "048fc36b-2c19-4c65-88dc-275538e3dd28", "value": "e424eaea895de876ce2d1d514715183cefae3885590be9a0a680d36f4b31cc93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a6c70a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089422, "uuid": "1fc0febc-d735-469a-a24f-030e330d780f", "comment": "Malware payload", "value": "06967c5e1f0171c17003d256b85fd6b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089422, "uuid": "58df97c4-5325-4e00-9e9f-a32ce7ac434f", "comment": "Malware payload", "value": "e42ad0e70feca06dc6ef1b8f01c86c3e9d594a879af18ee6519b90092b240412", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089422, "uuid": "45f6719c-5cc1-418e-ae5f-996512c66997", "comment": "Malware payload", "value": "6b947e04347f410a917447a71b510d1f4baf3dcc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089422, "uuid": "846bd512-ae12-458a-a691-e40520327f5a", "comment": "Malware payload", "value": "9e6ddaa7fa8d2b4fe474d86e19ecc62ce146a4992bc0cf19a3a1c63e24069b9a8d9b4ffd2652674a55211a58950884ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089422, "uuid": "0548681b-da43-4add-bedd-3abda66d2158", "value": "T15845235776FD10B6DA7A3BB054F2079B0A31BC606DB5C2BE035A581A19B3BC0957233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089422, "uuid": "2a236abe-4639-4804-b5cc-e4cc8fd024b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089422, "uuid": "ad23cfb2-c120-4c66-b5d0-e85a60b105a6", "value": "24576:AyfQkaxoIHUySPI8CSiMb9Yx6HG21k75GckRz:H9vIH3SwlHx21kdGck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089422, "uuid": "eb56190b-8586-4336-a139-6a5f198b6ff6", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089422, "uuid": "77f36a94-0d38-4f61-bfcf-7ee7fc8ab1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089422, "uuid": "6d3a0743-3625-4330-84b8-164ff632a486", "value": "e42ad0e70feca06dc6ef1b8f01c86c3e9d594a879af18ee6519b90092b240412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528713fa-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089424, "uuid": "d9850b75-4b5b-47cd-9e84-c56b9201a252", "comment": "Malware payload", "value": "84d5dcc067647398390ec0f2bf07c571", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089424, "uuid": "6aa7711b-a691-4fc8-8021-c19b1224d226", "comment": "Malware payload", "value": "e491786b190f602cc43deebb467d3a61337bc41bfb941a1bf00450ba58c3c563", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089424, "uuid": "ecb8ccef-d50e-4ef3-afdb-3aa8489cb0f6", "comment": "Malware payload", "value": "b525e5a1e21761fea806fc75e3cdc1465557a09e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089424, "uuid": "4fff7c9b-c3d3-46ca-a359-9d56a7b3d76e", "comment": "Malware payload", "value": "429d1dfe88d79843c5206453b585e44d7061c3b22c91f467d838b80f81b355b205261f947274d1ef0acd46309b9578d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089424, "uuid": "938e1c8a-073d-441d-9674-a4661246a02f", "value": "T1852522C1BBD88032DDA44F70A4F706431B34BDA22E35427A77856D9A4D73BD09AB077A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089424, "uuid": "1311e5a6-5902-4152-ad4f-9a04054d06d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089424, "uuid": "abcdbcc9-36cd-4e2f-a53d-f6881c3ef680", "value": "24576:wy+Fjl2DW846dqcgWE9l+Fe/8cqvKmVOJJIkWrTr3Cr:3+Fj8DiWAlueEdvKsOzIBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089424, "uuid": "93a5f67d-1ac3-499c-8a8a-5447264feb3b", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089424, "uuid": "c9a5a9dc-3460-4740-8b25-d93e279c65a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089424, "uuid": "6a023b37-907b-4b7e-b361-8b066e35390c", "value": "e491786b190f602cc43deebb467d3a61337bc41bfb941a1bf00450ba58c3c563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5372d7fb-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089425, "uuid": "36d8401d-a789-41c4-b758-bc3d90ff64cc", "comment": "Malware payload", "value": "8afe114f2233a8d26664ec8613c70ea4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089425, "uuid": "6fb72695-13c6-4bbb-b0ce-6770f462d14b", "comment": "Malware payload", "value": "e495614edb892fe7b0ed7749f34a7679c48109a84a95e39d6cc66d8592b0692d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089425, "uuid": "78245437-8f68-490d-bb48-44ac74fb0669", "comment": "Malware payload", "value": "73823655d8f006e7deb7dc55a3d5e938eea8af05", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089425, "uuid": "228ebe70-2933-4fca-8aaf-1a4b7b2b6f46", "comment": "Malware payload", "value": "a9b19c85d5db8122ad3437e74e6157eafa05d30c641e1aa362160619f5a6689b2b64915b27a9c3ab8e826d9dcb19ba53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089425, "uuid": "92c13170-4fa2-47f2-92db-4fc493f56504", "value": "T11845230375D69471DCBA2F34B9FA57870E3AB9D0A83443AB2208514F1C72791D6B23BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089425, "uuid": "e17ffca2-dfc1-4a8b-97d7-748bda43a2ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089425, "uuid": "3db0c8c2-c03b-4180-ae40-edf0132e5641", "value": "24576:6y5q8otoGyFvl/SVoPCmZA+LznoU1zEOpisM8g:B5blGy9laVojO6EOgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089425, "uuid": "28a5475b-92db-4b13-ac7d-3b62736bbe0f", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089425, "uuid": "0bd83526-5c5b-4bb2-b80a-6f3f712d88d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089425, "uuid": "14acdf1b-952a-4894-b9ec-e4534deb66a3", "value": "e495614edb892fe7b0ed7749f34a7679c48109a84a95e39d6cc66d8592b0692d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54431bea-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089427, "uuid": "9e0158af-0ab8-436f-82dc-2f0b18a672ee", "comment": "Malware payload", "value": "c69aa6595c1081bfe26e098893b9a687", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089427, "uuid": "709ac172-9785-4b89-90ec-294b5dc1ad50", "comment": "Malware payload", "value": "e4c216a2255e6234794a98d4b21db92de09054f153ca9a326dd9b1f3b716ff2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089427, "uuid": "3f4af45c-6bbd-4fc7-9b98-5458a10d2d6b", "comment": "Malware payload", "value": "632d9b3a73c6949b6cabf49aed1f49da7472981e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089427, "uuid": "1151eba1-fbd3-4855-aea7-723875944e73", "comment": "Malware payload", "value": "2795acee54f6e6f2422e3d2c49506facb7173a99f69641c119de69a16e036701f4b421bfa761d6442423459a4dd8e2b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089427, "uuid": "1f6aa543-4ffc-4e15-8158-bb6ae0288044", "value": "T1BD45232EFBD84071DCFA2BF015F915D70F76BD920C79032A674158860C736E86A36B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089427, "uuid": "b12a7e19-64c4-48db-9e05-65573a10babc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089427, "uuid": "e4d561f7-ec0a-407e-88aa-692f368e8cc2", "value": "24576:jyr8dSQJGV93g93fVhdy2+PsMS1SF4Wrec7efbzWfz1LX0+ar:2aBQVJgFVm0IF9Kc7hz1Lk+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089427, "uuid": "167600e9-e3f0-4607-96cd-eb00b89b54a0", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089427, "uuid": "65be4d09-db97-4200-8a18-8ebbb1cb4e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089427, "uuid": "baf5421c-c995-4774-810b-7f0e887f8a9a", "value": "e4c216a2255e6234794a98d4b21db92de09054f153ca9a326dd9b1f3b716ff2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554f591c-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089428, "uuid": "718afa70-3ab1-4c8b-a095-cb5c2203da96", "comment": "Malware payload", "value": "ea9a6f5b88419c7d2c78adc7ffe8e1be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089428, "uuid": "d564b666-2efd-42e6-bea3-7419b476a228", "comment": "Malware payload", "value": "e4d2bea8c3806906d0e15433fb933351d22fe793862604503d76046a47b677b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089428, "uuid": "7568c471-f8bf-4f02-9c81-594ca7b419d5", "comment": "Malware payload", "value": "8980a90361b4cbbb391df48f10e6451355df1aa4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089428, "uuid": "60466df0-a744-47e7-a9e5-8734de5319ad", "comment": "Malware payload", "value": "71d1a8beae78fad18a77a6647c75627e8f4473676168e0387004f9c5fd8782b7b0e71f2ef502564def6492dcce8b240c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089428, "uuid": "701b1d9a-22b3-4123-b1c0-9a429fc2db49", "value": "T1EC4523526BC14832E8B66BB889F541D70F34B8E29C39874E1741D85E2D737C66432BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089428, "uuid": "bb960da5-fe88-45f3-ae42-89a1e380cbcb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089428, "uuid": "fa36b22e-4759-4c4c-9672-8d0a2708eaad", "value": "24576:XyPeB5L5/bG+2URqAPBk1ur1DUrg1LvZb07vmbrb:iPAN/bG+254qribr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089428, "uuid": "eccbaffd-d741-48f9-9159-24ad7c0b957e", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089428, "uuid": "a45b252a-0d98-4e01-8348-f6889c42ae39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089428, "uuid": "97ad4f8d-acbe-4da0-82e3-24f3cae66ec8", "value": "e4d2bea8c3806906d0e15433fb933351d22fe793862604503d76046a47b677b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562babab-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089430, "uuid": "720e906f-3a96-405e-9f9a-6cd0b07a976b", "comment": "Malware payload", "value": "65c6400a8bbe42b22ea719c1acf8dfe2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089430, "uuid": "1bf0d883-48e2-4f2d-add6-814b963e5a5e", "comment": "Malware payload", "value": "e4e4cb6303b8e4b7f52439a5fd470d1d362850b4cfe0491af1152c89f70bf0c6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089430, "uuid": "3cf13854-2603-4e32-9628-ab331d0016d5", "comment": "Malware payload", "value": "8a2936318d274e3be1d21aa3ed54811a3b905885", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089430, "uuid": "c14a9870-4979-46c1-848b-2a98597d5451", "comment": "Malware payload", "value": "5b305ebf9094226636fbcbd1a70931b4a13bdbe3243fb64e6541ffb9fb3b146b01d172fb30a93b476628cf2c13576b7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089430, "uuid": "b9369809-2136-4b47-90d9-816f6450ee39", "value": "T183452313A7D85182DDF51BB078F743430A35BCD29D78831F73909A5A88B27897971BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089430, "uuid": "771f13b2-72b1-4fd6-8bd2-53a6d5172ade", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089430, "uuid": "677cb9d4-5de4-432e-a9ef-0310c39dc70d", "value": "24576:dycArg9ppg6xQE7jSaQ18ZjieDEhioNLzU/DEcT:4wRgWXjjQ180eYPULEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089430, "uuid": "7754b36d-7b26-444b-8acf-10f950a41c39", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089430, "uuid": "0d1a5faf-39f6-475e-873a-9eeb8aab486f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089430, "uuid": "2b87d7c5-0235-4551-afdb-7fc90fdf9619", "value": "e4e4cb6303b8e4b7f52439a5fd470d1d362850b4cfe0491af1152c89f70bf0c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57082925-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089431, "uuid": "0fc92e88-5a16-406a-bac9-9127384f94c1", "comment": "Malware payload", "value": "acefb04973bb19f53834d4bae0ddf72b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089431, "uuid": "def5bc35-7a64-4b53-9b57-267586e9a95a", "comment": "Malware payload", "value": "e5161db0cafb251bc3d6f5ada6a22da53af9ee15438c5e4fe28403fd6632092b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089431, "uuid": "51b994e2-6e8f-431e-b8ff-7b6658f0f86f", "comment": "Malware payload", "value": "bad80a02b9123ab0eb4545a25789fcf3937a8f50", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089431, "uuid": "222623f4-f151-4910-864a-67d3362f5503", "comment": "Malware payload", "value": "a9904f7dbe787a196bbd360d3f8af6339543c25f341c7c19b8b3253e94d7d674e487682b68a6e7250db9a3e63db33b52", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089431, "uuid": "85239135-9ec0-4dc5-a01a-767abdc837b9", "value": "T1CB452345DAE584A3DDB20B7094F501A717323C8165B483AB6759AC2A0CF33DAF53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089431, "uuid": "be3214ab-58c0-4b77-9947-8e61b61b3f3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089431, "uuid": "4d6e3eee-41c9-4475-96c7-1f9c1f7cfd7e", "value": "24576:2yWM0ic+fKQSsYm0B+PshYSBCJo/SahT9dliH/b2beV7SdyrIgdn:F4i5fKhB+o5r19/Mj2I2dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089431, "uuid": "f3f50057-941a-47f7-bfbd-0a66002f5a97", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089431, "uuid": "22b4f9ca-12cc-451b-bfa9-fb1af88eb485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089431, "uuid": "0286100f-d459-4980-9ba9-fedd78c3144c", "value": "e5161db0cafb251bc3d6f5ada6a22da53af9ee15438c5e4fe28403fd6632092b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b39b7d-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089432, "uuid": "76f34792-b331-48d5-8d1b-96f6f0924ac4", "comment": "Malware payload", "value": "3caa86d1c0d776cca376a895218cec55", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089432, "uuid": "a7008ae2-4c35-4d7a-8ee7-8701b4530d2e", "comment": "Malware payload", "value": "e56dda4ca0a4b76f6ff760867db4b55e644ccc2cc2252e327ad2417a30b48ff4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089432, "uuid": "7b3bd64a-1047-4d92-afe0-6cec6c4711d1", "comment": "Malware payload", "value": "300951efc203d10e3eaa1c67c47b327a5d1d1678", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089432, "uuid": "548bce76-12e8-4fe2-985b-d985629f6642", "comment": "Malware payload", "value": "a43419bb4c9fd8edb0fae93dda7464a2b6ffd263b803ee5a39ce0899ec2ab9e662c01e5cff65ef42747ad800b23a472e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089432, "uuid": "de96c651-e19e-4eec-a2ad-5fe72796141e", "value": "T17105120766D88532EDF5777069F30BD30B393CA2AD71469B2349A88E1C727C1A97136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089432, "uuid": "0e4bd4bd-41dd-4182-985b-964a0615979d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089432, "uuid": "9827eb18-c287-4afa-8d7a-887513c519a1", "value": "24576:uyNK2PVTjME+xOTPanXW/MT3Fajl3v3voYh:9N7P5n5eT1Clf3voY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089432, "uuid": "c11012b9-39c7-45fc-a3b8-b4ad6aa7238a", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089432, "uuid": "5df21ae2-dd91-4717-9c6b-071aed492e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089432, "uuid": "f24b4e3d-8584-418d-8c1a-32915a262c3d", "value": "e56dda4ca0a4b76f6ff760867db4b55e644ccc2cc2252e327ad2417a30b48ff4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c6cbfb-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089434, "uuid": "a9d2965f-6c49-4066-b8cd-2f694c137688", "comment": "Malware payload", "value": "4448c43f5244317cc8222e31657f1cce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089434, "uuid": "4246c86b-9216-4b21-aee1-4431798b5eb0", "comment": "Malware payload", "value": "e5971f0dca1791214aa6b5f36120f735cef1108a9c3407390c9419eab90dc7dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089434, "uuid": "fd3e5144-cf59-4cd9-a4d8-6579aac9c86c", "comment": "Malware payload", "value": "29317f65914ad7212ce25f37fe2c007ba85425ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089434, "uuid": "5ee4c98c-76d2-4aae-923a-349841a4a44b", "comment": "Malware payload", "value": "219b268428c42db7ccf8b23026f4de163dfc3700929a534a165c659beb118b8fd46ffa1330ca204ddb1f1005e4878a60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089434, "uuid": "7d139d87-abd8-410c-8c6f-dc12a749e4f0", "value": "T1B3452313EAE98023EDB557B018F605E70936BCF29575D39B138AAD264CB25C4DB3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089434, "uuid": "68b063b1-a4de-43fc-986f-b59c669fd73d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089434, "uuid": "c8f09f16-0d49-49d7-a94c-05f0b60848e0", "value": "24576:qyYaeiDl7fCbizTk5y5T5JKUrRv/M3hvozzOA+fc+DfmkkAs3qUqqHFm:xZTzTk5ET5wiRvSszQtfHxsG+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089434, "uuid": "6e9bd789-74c1-4505-ae38-d69bd17d2350", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089434, "uuid": "d5320819-9c81-459b-8450-7fd9a46ecd19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089434, "uuid": "c5dd22ee-dd6b-476a-bd18-f000fbafb57a", "value": "e5971f0dca1791214aa6b5f36120f735cef1108a9c3407390c9419eab90dc7dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599843f6-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089436, "uuid": "566a8f22-d4a7-4e75-b324-124aab3a5a29", "comment": "Malware payload", "value": "1e934c49dc59b42cf1442d0bee50c34f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089436, "uuid": "b0241a5c-9ad1-412d-93d6-abc627571089", "comment": "Malware payload", "value": "e5ec815f3cc4e26c226de100b30c871cf3b1323a5afba970450180a99c72a340", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089436, "uuid": "a62403a7-3780-45e0-aff8-bb81f747625f", "comment": "Malware payload", "value": "ad9d36a9a5124df4d08a685c3305a0d8ed036df7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089436, "uuid": "b3c379f2-8aff-4c51-8a5d-6cb30e25e80b", "comment": "Malware payload", "value": "9973c9309abfc3de010c6354e99a0817464bb19306f62f44c4736d6ca6089b8382241f846878399f49dca79534da0866", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089436, "uuid": "1968fb0d-a722-4351-98df-5643bd4a145b", "value": "T11D4523132BD8A477D5F123B00DF203C31B39BCE65978C2772B45984A9D21AE0E97776A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089436, "uuid": "f75967c4-3b64-4063-96fe-fde8f9f40b39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089436, "uuid": "007a0408-3406-44ce-a2ce-a68cfbe04358", "value": "24576:vyiw8QNdSdj8is7YJPvvt9CdXtevWYW1EtPHlW9WMuixTbLdNG:6/SgvAH2dlYSEtPHlW4MuixTbLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089436, "uuid": "e0cd75f5-fbbb-4b00-98f3-a4f3e875a50b", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089436, "uuid": "bf34904d-a0c7-455f-98b8-1850e652d93b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089436, "uuid": "e824430d-23e2-46c4-8dba-85c09d95a0cf", "value": "e5ec815f3cc4e26c226de100b30c871cf3b1323a5afba970450180a99c72a340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a67b5a1-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089437, "uuid": "47dfcc11-b267-4389-8174-c6e78325d399", "comment": "Malware payload", "value": "de02bc4db3514ec3cce28ee2b9226eb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089437, "uuid": "4ea0c2b3-35d7-45f0-a3e5-0294fddf44b8", "comment": "Malware payload", "value": "e61cf44a66061151977ff95dca44b20d7d6d0059dea74c7adbb1b816b55d3036", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089437, "uuid": "f5f9bc60-caa2-44e8-ab1d-1ac030c588f1", "comment": "Malware payload", "value": "b1fbd13a7266be196ee18dfa944049380a45a61c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089437, "uuid": "1367bfb5-f274-4989-9cc9-5537898a3d66", "comment": "Malware payload", "value": "510b12da017d68d0208ce88a619a750cc065d1f845dab4361f2f3976953d77bd599f90487d485c4276ab2a5072937432", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089437, "uuid": "f4dea882-d30d-4197-b6ef-470dbeaf9b8c", "value": "T1EC152343A7D84066CCF91BB01CF702870637FEA464B8971B2A46595F18B3684E47B7BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089437, "uuid": "98d1b5ad-41b9-43d4-9fd8-c2e7082c543e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089437, "uuid": "cffbe02b-45ad-4f08-8151-b0b79c6f796f", "value": "12288:PMr/y90lqc480JcVzrj5YS2cDtcBKvOmwaAGhZcHMWB9QlTW1oaSv0Kv0a5X0M+U:gyIt4jJsz/51NEmwaAG5M9NaJZeMkax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089437, "uuid": "df220c47-5bd3-4724-b3f2-945e2e2a03d9", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089437, "uuid": "c9a91ada-8350-4972-a157-705706ca8e8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089437, "uuid": "f3986990-3224-43e0-b047-1667f2691013", "value": "e61cf44a66061151977ff95dca44b20d7d6d0059dea74c7adbb1b816b55d3036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5a8a5e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089439, "uuid": "4f5e274e-99b6-4ef4-945f-5ca86549e67c", "comment": "Malware payload", "value": "7836d7f365ae4f0035127fde164ebdc0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089439, "uuid": "54d8baac-8795-4909-a28c-237c5f7a332f", "comment": "Malware payload", "value": "e639a7424c34d2e8fdc5ee38b7fab303097c933188afcb97af1c60c39cb77202", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089439, "uuid": "ed98fbba-f489-40a6-97f5-9eea81f41e94", "comment": "Malware payload", "value": "e2e1d76a380171f489f3d6d40337c6c680427efb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089439, "uuid": "5fbbac48-9b7c-4b03-94d9-fbe55cf368b5", "comment": "Malware payload", "value": "8c13268c908ead7f6ec82d1bc25acc5421d1a346e5ce04b6f39c67cb241ec4773f41982d56c666feadbbee78cb5a2a67", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089439, "uuid": "74970b80-6eb4-4b82-984f-06026684b518", "value": "T14445231BF6D491A6DCF86BB01DF216830B323C418E78526A72999D8F5D72E84287173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089439, "uuid": "8daa53e5-fa8a-4fa0-a22b-491be9156177", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089439, "uuid": "200ea42d-cecd-4401-b6e3-110dd76f4502", "value": "24576:kyPdk+lC2FkfXv/OGfjJokUbgBQs6m8UKBY:z2+lJFkfXWbgB10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089439, "uuid": "373c96d2-5d57-4f24-a22b-ff1ee365506a", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089439, "uuid": "d990239d-7eeb-4465-83af-e8a599bcbc90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089439, "uuid": "b09587cc-d0fb-440c-bdea-7fe784af2537", "value": "e639a7424c34d2e8fdc5ee38b7fab303097c933188afcb97af1c60c39cb77202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0182c49f-f251-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684066524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066524, "uuid": "5badb16d-4dc8-4312-9261-079a9cc2dc25", "comment": "Malware payload (RedLineStealer)", "value": "4fbab5b2cb6d7fb30a7941c0f34cb57d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066524, "uuid": "013c4d9a-6dbd-484c-99ae-e0493d755018", "comment": "Malware payload (RedLineStealer)", "value": "e67ac9149f5f7fe255dab740cdcd4fa6bae5b71cf833420cabf23b69dac65822", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066524, "uuid": "51ff43db-318a-44ae-b724-90499a320fd1", "comment": "Malware payload (RedLineStealer)", "value": "47c102dc24e51264c54f8647ab49cfd719c4e9d5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684066524, "uuid": "699913a3-e322-4b49-bc73-e9ad7fdcb397", "comment": "Malware payload (RedLineStealer)", "value": "f1ab95e1d5e1b2096f2ed6bc2fc1901b3a07f4c294e7eb0e202be968e01f09fbbe4791f69681b9223a8ff69320d27a9b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066524, "uuid": "0f752f61-03f1-4bf8-82af-f70e0123c544", "value": "T154452383E2D14162C5B06B70E8F906C31B3D7D93AC78D767A6862C6E0D732D5AA31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066524, "uuid": "8bbb7ba2-161b-4a72-b48a-511ade32178c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066524, "uuid": "90f112a9-9b59-4728-96b5-f808a7cedc9f", "value": "24576:VypAjgDu1iZK/UDXfsjgdOzah+svy0JiFNH56IHCov:wijgC1iZOUDvsjgdN+G1QFT6+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684066524, "uuid": "3b591101-dd07-445b-b29e-b8c8dd5cc917", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684066524, "uuid": "248bbeb9-b3fb-4d82-bee0-84ef86db7e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684066524, "uuid": "654b6833-738b-4a1d-90b4-9b5a15ea0e51", "value": "e67ac9149f5f7fe255dab740cdcd4fa6bae5b71cf833420cabf23b69dac65822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a168a8-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ToxicEye)", "timestamp": 1684089811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089811, "uuid": "9a1894d3-2d65-473a-9048-e01374ce37f9", "comment": "Malware payload (ToxicEye)", "value": "835d21dc5baa96f1ce1bf6b66d92d637", "object_relation": "md5", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089811, "uuid": "34940bdb-af9f-46cb-b0ed-e40dda81cc2b", "comment": "Malware payload (ToxicEye)", "value": "e67f2b34ef647d59eb8ebd4a88f85dc072346ca5c275cba1ee2307b80a560319", "object_relation": "sha256", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089811, "uuid": "a1576979-400c-4b05-9c2f-2b7f03c91b2c", "comment": "Malware payload (ToxicEye)", "value": "e0fb2a01a9859f0d2c983b3850c76f8512817e2d", "object_relation": "sha1", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089811, "uuid": "ffd8bb1d-3704-48b5-b876-f537ca2493df", "comment": "Malware payload (ToxicEye)", "value": "379e27b941cd9e91682e986a749636b933993b94ff6d2c5710d7160e6468c76bfcd70796f1ce469aa9a6ef1f9aac60c0", "object_relation": "sha3-384", "Tag": [ { "name": "ToxicEye", "colour": "#A65E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089811, "uuid": "eb106693-cff0-44c1-8e3d-c3637bbec87c", "value": "T137058A2639FF202EF3F26AAD5FE4B46F891AF7731A0B60B91471034A87229419DC1775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089811, "uuid": "c8047a05-eacf-47e3-b6ca-b88598055aa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089811, "uuid": "c792df33-7d7b-4776-85d8-60b1fb533057", "value": "24576:rcHV1ApBOr1sU6uEgjhlOCDw8mEFAuYg2OWpTMqBx+fdTmG2Y4MT9ffD+CzKcbm+:oApBOr1sU6uEgjhlOCDw8mEFAuYg2OWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089811, "uuid": "638d12be-b6fc-4bc3-832d-1a77dfe46203", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089811, "uuid": "69686f4a-0bce-4736-9290-b4a14b565cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089811, "uuid": "82e767de-3e17-4022-8140-5f53098967a1", "value": "wsappx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cabcb79-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089441, "uuid": "590f1347-c8b0-4419-9937-6f0417b6b289", "comment": "Malware payload (RedLineStealer)", "value": "913cdfd16747cffbde289b950ffa3bee", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089441, "uuid": "9282080b-c8f5-4e93-9b4e-74352e2fa630", "comment": "Malware payload (RedLineStealer)", "value": "e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089441, "uuid": "888c03d0-4832-457b-a1b9-f713e2856ea5", "comment": "Malware payload (RedLineStealer)", "value": "f84057817f72ae8eeb4f940fc70bcf1e01010338", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089441, "uuid": "42f832e8-a063-41d3-a31b-e9ec983ff772", "comment": "Malware payload (RedLineStealer)", "value": "b1e87aeed6da0bbd1e414fbb6089e9d4b6792d9c2658385a83228026c95d98a19fdbf5ce1f12f114efb86e33915ffd32", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089441, "uuid": "67893e86-6dda-4b52-a512-c0cde72c359f", "value": "T1EC452327B7E21176E8F423B478F702D31839BD955C78876B6396281B18732C069727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089441, "uuid": "8114109b-cad5-4f39-8afb-501b464816f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089441, "uuid": "d4c8e515-2162-4689-91cf-e6b1d42025e6", "value": "24576:HyH/k8E6DW6O/2vVVXwOrbF21MsHm1a2vko6r7WzGdF/:SMJ6O/2vVVgOfOhf7WzGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089441, "uuid": "51b740c0-30de-4830-a162-2895f363d2e3", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089441, "uuid": "cf2a8b78-1dc6-4da3-91f0-9a9d0fe2deea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089441, "uuid": "e1d66985-2c7a-461a-97b2-c7520f4ac3fa", "value": "e6b20152b7a02fa4ecd807646a4977b1ccca9fbd59e3dee8c1cec8c05b4e6821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9e58b5-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089442, "uuid": "7ef1161e-be61-4668-8074-cdca2f1671a6", "comment": "Malware payload", "value": "6a7bf5ba827760438190c08503c6b812", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089442, "uuid": "96abdc6e-8958-42ea-ab23-e5dc5fe93a67", "comment": "Malware payload", "value": "e6b45bcf66086d495ccaa9b9cb48b42e590720da45fa32ef99f3631d1f8cd2ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089442, "uuid": "245a6169-18c4-41e0-a8c7-3d458ae9b274", "comment": "Malware payload", "value": "766d021114609a50a7e038f1d70067edf2976749", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089442, "uuid": "fc7f8ee4-003e-4b17-8c1f-7012515acf02", "comment": "Malware payload", "value": "db172bae1e0ff42901d56944dd3194469478f5c24454bdfb6a19c3eed9dd110b81cd96978aefba3a2eed2da0be70c044", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089442, "uuid": "8082a3f5-57d2-4e3d-940d-9aec4afa7389", "value": "T10A452312D5D48679E9B61BB018F643831A79FFB57C3C81661602A8462CF3AD0E63973F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089442, "uuid": "9816d02b-5a6b-40bd-b391-964016a96c9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089442, "uuid": "bf2bf6ad-0899-4a6a-97f1-a5e9f8057543", "value": "24576:PyTfsK/GPseA+dLQoHBjXaH+oow2Tfnx7vm5uhCUumFOVPp08Ty:aTHGUD+OeVXrSIfnx7mbikPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089442, "uuid": "017b5006-e72f-4359-8f98-3f827ae0bce7", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089442, "uuid": "88401e52-d634-497c-b266-655bf9d49f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089442, "uuid": "b2f025c9-1a4e-44ee-9d85-59765e0953be", "value": "e6b45bcf66086d495ccaa9b9cb48b42e590720da45fa32ef99f3631d1f8cd2ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e672a16-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089444, "uuid": "191ca658-e001-47d0-9d15-7cb7c7b6ae11", "comment": "Malware payload", "value": "2a79e4ae19e2997f5c76ed15c11ed28a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089444, "uuid": "11a5000c-001e-4434-843d-6c9c655852bc", "comment": "Malware payload", "value": "e723e61aa825f316a3a87469a288115a790b375169158e5398cf9a353e08af4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089444, "uuid": "cfb7fc63-62ff-464a-8f78-f7b20dbf9aeb", "comment": "Malware payload", "value": "38a8cb382a915e75c5dd6b9eba676a50d8fc1bac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089444, "uuid": "694d6a0d-8ca3-46e8-9569-61845ce0c2d1", "comment": "Malware payload", "value": "c04b69b524d7adad1c1e341384a03beced804b1aeaa400fa4acc663464623291685e38b360363c8e951f85fa32f815c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089444, "uuid": "094fbe11-65d5-44db-ad35-f6b8fb8bc843", "value": "T16245231667E89036E8F63BB009FB56C30F39BD624874862A17467D9B18731C0A5367BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089444, "uuid": "cbc0fd71-dcc7-4934-8efc-967b9b855602", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089444, "uuid": "877499ee-a408-482a-8f6a-1511baf1a686", "value": "24576:xyLuEWx4gqlzxmeynAen6hi/QIhL8wGOpJ4L4xB2Ixp:kqZ4rllmeUl6GhQlOpgABJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089444, "uuid": "011192d8-ea91-4771-8545-b9322741a130", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089444, "uuid": "d3d6061d-2261-49b4-9c80-b4cd3d3e0a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089444, "uuid": "8389e3f3-0e01-418f-8780-32b6af26cae4", "value": "e723e61aa825f316a3a87469a288115a790b375169158e5398cf9a353e08af4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f412619-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089445, "uuid": "3a4adb02-ca5e-461f-a920-359c0dfaf976", "comment": "Malware payload", "value": "fa3a9fafe32af96c9f3323c050e023f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089445, "uuid": "c9479fac-5ed6-42b8-a920-fba6f60d1658", "comment": "Malware payload", "value": "e72524b767d99a436abbea479aadcb7588c1e7e498955432aca2a54344f7093a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089445, "uuid": "afe1da49-972f-4a99-a9ed-b302f876ac53", "comment": "Malware payload", "value": "77f171ba85c5912ae322f1f7a325da7666a144b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089445, "uuid": "9310963b-049d-4603-8998-5c996b10be7e", "comment": "Malware payload", "value": "0591ffd9eea89d34c6c9b846117c797ee3a83081be43b03cff06c2f2c38d739936f9cecccf1b72ea0d01cf6b28a7d7e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089445, "uuid": "0efe4564-d7da-4ad6-9693-e7e4a241439f", "value": "T1DB452316FAD58032C1F66B7258F151D30E357EB059B883676306AA4B6DF37E0963232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089445, "uuid": "f659ba3d-50f1-44d5-80c4-a3a0537b2c6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089445, "uuid": "d8bcc835-854c-4a0b-88d3-61c40bfd322b", "value": "24576:iyVEZcUlxUe87T/1OD3XV7YvplG9Sum/F4NavGOEbj:JVEZ3lxUJTtODNYB1/FZvGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089445, "uuid": "ef520bf6-5a84-4669-a5ce-9d26fccb99d5", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089445, "uuid": "4876e205-b2d9-42f5-93e7-6a53d961f44b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089445, "uuid": "87c9fd4e-d9d7-47d7-91fa-329bd66cf252", "value": "e72524b767d99a436abbea479aadcb7588c1e7e498955432aca2a54344f7093a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffad9ca-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089446, "uuid": "819f55e7-e6c5-49ce-a4d4-ab89fce94229", "comment": "Malware payload", "value": "0a55f0e0361618de3d9d1ea30c4ac158", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089446, "uuid": "4ff83fe3-357e-4a71-a1ee-d414e0b94181", "comment": "Malware payload", "value": "e726ff9e72d719676d164018aa6dbd5a143fe01a74fbb9b2e0f161cdfecbda26", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089446, "uuid": "38b7cc39-e153-4cbf-9b8d-ad51bf91fc55", "comment": "Malware payload", "value": "2b674496937d086a1a3179597173b9479392b84f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089446, "uuid": "708fb342-a5ef-4822-ac26-f2b5d5dd9d87", "comment": "Malware payload", "value": "b2971019ef69ba6f2ae6c08be16cd6eb5b9d744b883e299ff507a490d76924b33be3b4d9235dd721ddf0cd427305acd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089446, "uuid": "95e1f121-237e-4295-8874-a73e54fb6151", "value": "T1EF452362F3FC6462D8B127B498F702A71F313D91A8B946A303959E1E5C326D8E43573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089446, "uuid": "f4efd76e-3a27-4c59-bc7c-561dbed4bf7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089446, "uuid": "ca153c09-42f1-4bfb-b021-ac550038761e", "value": "24576:7yRS6cM5wxjhdnNlOGx/O8KX9jqsOjQ5Xvz/vRGsDUe3gCEj9b0W+R:uDcMSjhLUQ/OHdSjQVvjvRme38b0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089446, "uuid": "ca70860e-55ea-4754-82da-42c0f2635ccf", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089446, "uuid": "20335d09-3e16-4ea9-9a6e-ce7b9edc373e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089446, "uuid": "c4becddc-ca45-4a21-b103-dfc6b33d88c3", "value": "e726ff9e72d719676d164018aa6dbd5a143fe01a74fbb9b2e0f161cdfecbda26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9923e1-f27a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1684084371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084371, "uuid": "93c49b0e-359b-4e8a-8002-fe651753d6f0", "comment": "Malware payload (RustyStealer)", "value": "26e9401754a0fe30f1e579b33132c78c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084371, "uuid": "b413913a-23c3-48bf-80b6-57e63afece4f", "comment": "Malware payload (RustyStealer)", "value": "e753d757d44da6574603ca2940623935afa225d8b8dc982ad2c00bd8f72bb44a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084371, "uuid": "bcb3bf8f-db5e-4984-9aab-7be9d7e653c5", "comment": "Malware payload (RustyStealer)", "value": "1dec5a8c868a157763651a606982b3e634416f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084371, "uuid": "4eb5caf0-81ce-439f-9411-082bb671a99b", "comment": "Malware payload (RustyStealer)", "value": "60122eee7e47d97ac1dde355f58702f89c58581e0017535b537de734487a7654ad2939cb3a945d71f156b788cccf6463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084371, "uuid": "d8913910-969b-4a08-af15-4cc16f6f8fb8", "value": "T12BF518703F499AAEC05AC074D2468B626A3174CA0F35BAFF45D466383E29AF51F3D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084371, "uuid": "9f015e42-85d4-450e-83b5-b19c3489a839", "value": "23485cf57ab2dcc3f15963e3cce18563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084371, "uuid": "c1b6c7d0-215f-4252-ba8c-df5e095c1ccf", "value": "49152:YnsOWmW4HxLq9f7Da3c9JUWDqEPFeH9GxN4A2af5Kq:oWjp9eH93A2Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684084371, "uuid": "8140ecac-e97e-4128-8e8d-41a13ef43827", "value": 3461120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684084371, "uuid": "4f8042d4-4f0d-404f-9404-d5b24dcfe219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084371, "uuid": "96509ad4-d13d-4096-bb36-5d46f319370a", "value": "Updaters.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6156bf61-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089449, "uuid": "6a2d1f09-e442-47b0-a69b-058b43f0422e", "comment": "Malware payload", "value": "b5ca679391ef65156a58a4dc7463d702", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089449, "uuid": "b5cfdef6-fef3-475f-8ee0-7de279c436bc", "comment": "Malware payload", "value": "e76bfd43c108eb024462105028513077974d17c7c13508c6c415c6b2b7d2504f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089449, "uuid": "3ed4a764-f210-432f-8f84-9b65200feabe", "comment": "Malware payload", "value": "b68b9a7fd030adfa70959806f609c9fd6312371f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089449, "uuid": "6f6f3d4f-1627-4ca4-870e-0c0a8180a441", "comment": "Malware payload", "value": "8c2ff1c2d17474ff07908c64f41132a530e8439f33ee23be9c218aef5b1ec6539da2ad4a69f8e43b3d085d05c31c531e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089449, "uuid": "1a189d90-363c-4f95-922f-cf99efce2dff", "value": "T13F452357B9F98072E8F75BB008F347830B72BDB29D78879B6245A56A0CB39E45130739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089449, "uuid": "fa31d08f-bc6c-4493-9ae6-96e3814f4e89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089449, "uuid": "14fb644d-59f6-4cbd-b075-f07e574c7fa8", "value": "24576:PywUTmp5O2v3UX8xv0BVpLkYwyXgWwmrjqynWG17wC:ahg5Fv3UyvOVpXwmrjqO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089449, "uuid": "d4b97043-7e82-4111-8938-ed7317b92505", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089449, "uuid": "ede4d2ea-85ed-4497-8a38-f379f48d551f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089449, "uuid": "d750337e-b1fb-4e3f-ad38-9f2213b1571a", "value": "e76bfd43c108eb024462105028513077974d17c7c13508c6c415c6b2b7d2504f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62342ccd-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089450, "uuid": "90da97f4-2230-4253-ac0f-d874d30ad1c2", "comment": "Malware payload (RedLineStealer)", "value": "3f8094765e945dcd38b39711b1600515", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089450, "uuid": "327187b6-69e5-4358-917b-5b341a5c86b3", "comment": "Malware payload (RedLineStealer)", "value": "e79c3c2582d41be5845b035eef89d88601aa1553fe5e6f1779644c987752c5d9", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089450, "uuid": "b68bc1bc-03a9-45d0-a334-08017ddc15cd", "comment": "Malware payload (RedLineStealer)", "value": "04f94d3124fe3038be25fcc5fbd1640de273bb3f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089450, "uuid": "3288ce19-c0be-49e5-939b-10a472ac45d8", "comment": "Malware payload (RedLineStealer)", "value": "f10f648823f852d4b35d0b1e5f999fe9adc33a8aab4390140d3e1ee22ded754103724f8ae40c71a6f191de9af9163bac", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089450, "uuid": "dc478b5e-60a2-4f06-afe4-d365a1624882", "value": "T14B452347B6D08573CDF11BB098FA13830E36BDF169385317674998892DB29C2E6B172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089450, "uuid": "7c0ddb48-3b78-45af-9a0a-f51d99829eb3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089450, "uuid": "b4d661c2-1d38-472a-9543-0cb6c6940bc5", "value": "24576:ByRWFUm8tJGyYCC/2kixr1p9iyRMpC5BQomOuVzpao0yOLVEy:0RWFULJ/YbQPLQv1zpaFyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089450, "uuid": "58b1300a-9728-453d-9cd2-2a3d83182095", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089450, "uuid": "cba5b7f6-4148-43c1-a17f-17361f5d886c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089450, "uuid": "3a400ebe-3e53-4ae2-bafd-8b2c6cbe575e", "value": "e79c3c2582d41be5845b035eef89d88601aa1553fe5e6f1779644c987752c5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce225e21-f1ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vjw0rm)", "timestamp": 1684023918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023918, "uuid": "8e93d4a2-6783-4c38-bb3f-59cf4e759a73", "comment": "Malware payload (Vjw0rm)", "value": "30260b612d994b6c7e5ff1febcb9a157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023918, "uuid": "2ae4b602-6b39-4ce1-b1c5-f5e3b83f4143", "comment": "Malware payload (Vjw0rm)", "value": "e7d462e5da40d278f0f004f291e44fde3af0d6a3b95551319c4a6555bcc2eea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023918, "uuid": "a7a4dac8-5ac4-4cc4-97ad-225c1c88fba0", "comment": "Malware payload (Vjw0rm)", "value": "64d927347d0c0786527532d86949919c076321c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684023918, "uuid": "85604ed0-1cb9-415f-a08f-f69b0f6a273d", "comment": "Malware payload (Vjw0rm)", "value": "5d870a94be468f37b69de38824bdc16e0c0c3ccb88a9ac47c2202b9feb8786ebb3c019523c908ab4b6569c625116c3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023918, "uuid": "9ad78787-e7f7-48d2-9c54-98ab912e20dd", "value": "T1A6C47D2928AF50ADA17BFF613EE87DDEDDDEE6632505641B1082030B4912F81EF4297D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023918, "uuid": "30e58769-9b43-4256-bd0d-812a178290f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023918, "uuid": "e0dd9543-f910-48bd-af7d-4633e1f0e075", "value": "12288:UfIub9KMhn1PtO9yD34A81qsEh67FplSb2N8AF+IxOSEEmQiv0df8s/RcSklTWkA:kIuYAJ4Ms/bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684023918, "uuid": "2ca98d42-0dcf-4f31-b884-d41c81c0660d", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684023918, "uuid": "7add9353-29d3-492e-9861-69c9de23fe6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684023918, "uuid": "c250a224-56a6-4290-b18f-45abbccf5180", "value": "30260b612d994b6c7e5ff1febcb9a157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3b07c5-f2a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684100820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684100820, "uuid": "909fd328-f415-4721-803a-f30b33322bc6", "comment": "Malware payload", "value": "f0016739c32ff1b375e9bf3008a56991", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684100820, "uuid": "7d2471f6-4baa-45e8-840c-f65e5e66ad8f", "comment": "Malware payload", "value": "e7ebc6c68a23bfb0d6f9d46c14b27b03f4aaeaafbcec81418f10f3bc190d523d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684100820, "uuid": "ce78efd8-8df4-470a-9652-5331a0f0d924", "comment": "Malware payload", "value": "c6f1ed811bdcd9c39f0fefbd53af0ee3b693a59b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684100820, "uuid": "621b59fe-f7f1-487f-80ae-14a62243c07e", "comment": "Malware payload", "value": "98996b8e6dbfdba9d624540124f2a8ccbb1cd70cc66bd396d1dd12ad380c020c74ad798d67f36dfb6861cf5631aa4a8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684100820, "uuid": "5bb2568e-75fd-492c-8340-44d29e0251c6", "value": "T1DB85D068B8CCAA07C85C49F4E6E0ACF5A2551AE51642DBBBC5C0A70F1F12794E2DDF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684100820, "uuid": "a69ceaf9-78cf-4cf5-b88b-37a9450ffdb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684100820, "uuid": "57dd91d3-589d-4483-a370-e9c1ff7756b6", "value": "49152:INyYP8XVYvxSb1efaWqHnLJECyjUqldcOR:INyI8FRndHn5QKOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684100820, "uuid": "2008f835-ad36-4102-b254-01d6550c121e", "value": 1843128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684100820, "uuid": "d1c69a4f-2b83-4ce2-be5f-98fc3590b8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684100820, "uuid": "2a46f729-f672-4a2c-8db7-45edca8adb91", "value": "f0016739c32ff1b375e9bf3008a56991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63213682-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089452, "uuid": "38074d75-0612-4cdc-b5d8-8a1d850e0389", "comment": "Malware payload", "value": "239912f28c90f9c21e6a2c50ee476308", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089452, "uuid": "4376ecab-d126-4aea-a7c3-2f806fd41d99", "comment": "Malware payload", "value": "e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089452, "uuid": "dc1e2471-6655-45f6-adda-b18451bb9f02", "comment": "Malware payload", "value": "a721c6aff9b6959c217575636f7dea282ca61dce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089452, "uuid": "d00c73eb-6cd5-42da-8e6a-201e7920d82f", "comment": "Malware payload", "value": "df9df849204f50cf4b74ef96dffa4412f92db077a85f5211d4a35b605e80297890a2e7dc56c87676be82c8dd540d43e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089452, "uuid": "ab94db45-145f-4527-8837-ad996de97c01", "value": "T129452303E2CC4061DDB92BB15CF256D31F35BEA219B4071B374AD96A0CB27C8A972797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089452, "uuid": "850013cd-77be-4dfb-8cb1-3c74f70268b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089452, "uuid": "f6fa3b74-e701-4f5c-9c03-c276ac671081", "value": "24576:nyGsjZoUAYSwffwo2kLI9+bkmdbTlkIsD1lf2HC/u6h+EAb7w:ynjZWYSw3woicbLdbRNsTfa6h+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089452, "uuid": "080dcab9-6d39-424a-9915-2f04d9c38a53", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089452, "uuid": "6cceeba5-fb05-4a12-ade9-74df3a725d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089452, "uuid": "f7277198-7317-42f1-8bf8-194836c544e3", "value": "e803bd0651356bfa4b71e63ffb2cd9d83c00ea2ef6d35ed84ad8783c162c955c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ef9acf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089453, "uuid": "a11b00b5-52ed-4835-aeb8-8d98920b448d", "comment": "Malware payload", "value": "524136e2377c536c2586c9971ccc5d9c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089453, "uuid": "15687a8c-98a9-46da-bd33-b9b2df634089", "comment": "Malware payload", "value": "e8746a37d1389b3c1d722c790501d9e5f9a8c94af218dccceb17eaae05975bde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089453, "uuid": "0069416f-fbdd-4b4a-8305-27bb535e153e", "comment": "Malware payload", "value": "8a23ed99e5680a68ff5b9a346dc895fc16dd2acc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089453, "uuid": "f705ca3d-5aa7-4e57-9efd-ff53c05a6f16", "comment": "Malware payload", "value": "ed54a664772eeb8ee1d0c93adba768a4e515e0c4e5caccf98cfdadc314b5939381e89c2fb76207ecd36a44c7ba7a6f5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089453, "uuid": "1dd764e1-80fe-4ba8-b79e-96a217ba563c", "value": "T155452353B2F81432ECF26BB49CEE03870E357C62917856672746651B1AB3BC16B72327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089453, "uuid": "cf074ede-44ca-4c6a-a276-1d5256e3130e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089453, "uuid": "1ffb3c20-6201-466c-8a50-380229571f8f", "value": "24576:FyIvtXvTuL03T9Py6plEClrbT3uvSkw1Fopzy7I6hc2JVoACngc0o:gIljjdbD3u67FSG7I622HCngR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089453, "uuid": "9289ffb6-de44-4bef-953a-2a83867e64da", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089453, "uuid": "bbf59592-bd81-46c4-aa3b-bc41caff71f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089453, "uuid": "fdd44a19-e489-4e26-8296-2ad25ecb827a", "value": "e8746a37d1389b3c1d722c790501d9e5f9a8c94af218dccceb17eaae05975bde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a17b81-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089454, "uuid": "8a9762b0-63f9-4755-a71c-b837317350bf", "comment": "Malware payload", "value": "957e5f9ec25eaca5838cf5d0f430e7a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089454, "uuid": "f3b9349f-38f4-4b92-a105-49b459999314", "comment": "Malware payload", "value": "e8a3af1da54986c5e46f63ea52de9fa9fd31123ff492e0442cadf0eb88b3daf7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089454, "uuid": "d0cdc40b-ad10-4d2c-bb7d-7e8279b3d6e8", "comment": "Malware payload", "value": "79e9be67770813fa7251a57f6ffe08efa0b2b601", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089454, "uuid": "f5176b06-1420-4371-ab49-40ce9a7a066b", "comment": "Malware payload", "value": "b0077052debe48377cb2d1947f5ca9823b761b9db70acf8756ffd849f1e3b563619812608a1ac451ff94a662484d90e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089454, "uuid": "9897b684-8f42-4d5e-b5e4-5beca5974794", "value": "T1EA452322ABDD9063C8785F744CF61B830736BEA54932D26F3B51B89A0C72884E578777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089454, "uuid": "a58575eb-19a2-4cdf-9131-1aa644935f55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089454, "uuid": "1ef9ea8f-6af6-435f-9689-fdd585cf0f41", "value": "24576:YytqVpTqNvTNJsDRArmp8sEh6m4kMieuXR4Ytzxol:ftqbTqNLNJscm4MHuBXtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089454, "uuid": "9e3b9215-af7c-465a-b065-8f2105a2fddf", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089454, "uuid": "9f88f9e8-6834-4246-9647-dd5e4469400d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089454, "uuid": "ac8375c3-d875-4fc6-88b3-25186fc228f5", "value": "e8a3af1da54986c5e46f63ea52de9fa9fd31123ff492e0442cadf0eb88b3daf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37e4c61-f2ae-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684106847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684106847, "uuid": "563942e1-213c-4103-a022-4e58a2999577", "comment": "Malware payload (AgentTesla)", "value": "fd156dede20b6185815f9a5a79444c54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684106847, "uuid": "70a50990-f0bd-417f-9c5c-f223bff2e575", "comment": "Malware payload (AgentTesla)", "value": "e8ccbb18209cd3444552c2d393b0203ad2fc85242ad4705c2f6106dac24dffd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684106847, "uuid": "a8e4e1c4-707f-4cd6-9792-f998c16055f8", "comment": "Malware payload (AgentTesla)", "value": "424b4967012b758622b49dbfe8471914e04dada5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684106847, "uuid": "3866c59f-1b14-4867-a438-e587bea45e0d", "comment": "Malware payload (AgentTesla)", "value": "00bc80c6b7687b3a6e76934a904d2edbe8e378f85a7c6d0cd0eec71d6c6e7a59b30dde6155f2133f8356611b017aeff7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684106847, "uuid": "012caf6b-1d72-42c6-ba55-d7179d6e9038", "value": "T1C805913905B82627C1B5D2BA5BC4F413FAC48BD236048D9E56C2478A16E3D0E6DCFDAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684106847, "uuid": "f0c17806-996c-46b3-b3bc-b88e3b577de1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684106847, "uuid": "5f402266-44d6-4e8b-9196-59ef76ff8bcf", "value": "12288:dKI1ZSljSudLF5i8P5HYtPtvBpJVFokQHB5CjnarM:dRwRD54tpBpiqDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684106847, "uuid": "2769e2d3-e5e9-4751-ad9d-e67df8082397", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684106847, "uuid": "96866e64-24e1-43fa-a514-c51cce5fa0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684106847, "uuid": "c8589664-02d2-49dd-812d-120a4f444248", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6568cb41-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089455, "uuid": "6fb47cbe-61ef-4e62-9742-a9e83775dc5f", "comment": "Malware payload", "value": "e535ac22499dbc6bffd4ccde9f8f703a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089455, "uuid": "23840fe5-6155-439a-bc1c-0786f233caec", "comment": "Malware payload", "value": "e8ccdbc650ce1885dc51c05798f1f51b957a0e36edacdfd5673c871ed7bc0794", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089455, "uuid": "83de8b80-8c40-4755-a561-c4e4418c7a14", "comment": "Malware payload", "value": "58c920ad49937be5781d86c8b8a7985494aa5950", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089455, "uuid": "8d1391f4-2412-458d-afed-4ea5df613387", "comment": "Malware payload", "value": "1032f1dd007a34c6ef120f521d6143e6ef961e53798e1dc92999a5493e642484909018b3099e048b74c32601e716b8a9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089455, "uuid": "6f25b8d0-379e-4f56-81ad-255286b3de6d", "value": "T1AC45234766E0D573D8F03BB0ADFA12C71A7A3CB094B897476316E84A1C72194B935B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089455, "uuid": "93525625-47ee-4aa8-90e5-1e9a0415b943", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089455, "uuid": "fcd9e781-270b-4143-b19b-0195ad8b527e", "value": "24576:fyTeJ/Grd82vW8/ZVcWp/xFW8VY7n7Y0Oh3M9i:qTAMbe8L/JNVUnqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089455, "uuid": "9d35ab51-5d03-4d23-9323-3fef543d125d", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089455, "uuid": "2bc533a8-26ec-40e3-8ab9-2d2d23f67e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089455, "uuid": "21ce50c7-ccee-44be-964f-1560f5d5ff91", "value": "e8ccdbc650ce1885dc51c05798f1f51b957a0e36edacdfd5673c871ed7bc0794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661927a9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089457, "uuid": "30f8c095-a34d-4942-8c43-08ee119c8996", "comment": "Malware payload", "value": "2bd74d976d0b8d94bb00ee41e2b2dc4b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089457, "uuid": "09a46fe4-d510-4428-97da-5e4ab4f33bae", "comment": "Malware payload", "value": "e8f3c5ce9d3252409d252b97744c27c41e2007fd1abd4d5945898f6e4a9d9476", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089457, "uuid": "ae62a439-4ce8-43cb-86b7-00a83012292a", "comment": "Malware payload", "value": "090814d3bbdc0c4f5319ec51ebb6026432745bf2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089457, "uuid": "765e38e9-7eae-41b1-bd9d-78cf9e1e3ce7", "comment": "Malware payload", "value": "b9486da760510e13d90cbce982f9adb38d726dc9651457ec81776fdc20276e380289553f51b5e311500b7a9c8cc23505", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089457, "uuid": "306998ae-8157-42b2-b8a8-d267c8bee463", "value": "T128452302F6D85172F9F51B70D4BA03D30A3ABDE14D75839B2285AD692C321D8D4B27BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089457, "uuid": "7ff29106-e7f7-4965-93ab-6218986e7aa3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089457, "uuid": "c7908cf9-13a4-43bb-899b-a18be0e3b61e", "value": "24576:MyRBTqzu6cmg9BPdOcWy/zY7MILx+vLhmu+/jOKG0IM:7RBTqTg9ayVILx0VNoSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089457, "uuid": "83643a06-4a2c-4ce1-83d0-840bcbab409d", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089457, "uuid": "c5596e2a-2e09-4765-b030-b174441c66f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089457, "uuid": "0bc2ab84-669b-48f0-9cea-c6b287903a1d", "value": "e8f3c5ce9d3252409d252b97744c27c41e2007fd1abd4d5945898f6e4a9d9476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bef85a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089458, "uuid": "6e0dd2b6-b773-4933-8266-f3d86c66d2d7", "comment": "Malware payload", "value": "4941cca85f766964734b3eb066d95b06", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089458, "uuid": "d057b416-85a1-4385-a37a-ff3a21ac3207", "comment": "Malware payload", "value": "e91cd6f3491d050a5583a85a8a9a661523f373a00251fa4dbccda2c865e7cef9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089458, "uuid": "daeb6350-2a8f-4624-98d2-7f38b5c49fd1", "comment": "Malware payload", "value": "7ffc2c769977d2e40fff07f44ad597df888689ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089458, "uuid": "8cab4d60-9b8d-40aa-a5fa-d795cabb499e", "comment": "Malware payload", "value": "8ae28366c6410912dbcd96b25fa19684fa21d0ab5045a6d9855296fc9a3e8b766e5030cbacf23f8b87a446414391c0c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089458, "uuid": "dbd47c21-8008-40da-9e2b-e35d538f6c6c", "value": "T1D6152223BAD40131E9F9577168FA1B670F307E91AE78A73B2740654B4C739C429B232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089458, "uuid": "b58a47dc-d8ab-4caa-ae55-ef6e45b5099e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089458, "uuid": "10af0f9d-b9bf-4c1f-813a-47861b862722", "value": "12288:OMrry90y7QTb8OW1w/u519GI+TNk81dgkEZCM05LN8Aa9V51XF9Wm3K3bszaEw4f:NyUWL1dCH1OkmPIR8AA1zjsoGh4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089458, "uuid": "dcf8103d-0be8-4a40-82ca-2329ef0ad24f", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089458, "uuid": "d0787994-5da9-4129-87e6-c2a2a411995f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089458, "uuid": "70ee23a0-3f63-40f9-a407-030648e0e90d", "value": "e91cd6f3491d050a5583a85a8a9a661523f373a00251fa4dbccda2c865e7cef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67daeb90-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089460, "uuid": "461baec7-65e7-462a-a8f4-34846eb74f94", "comment": "Malware payload", "value": "cccbd54850a0f081913e87bd59e0794a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089460, "uuid": "e1993c0d-4863-42f0-8542-e16ac2ede581", "comment": "Malware payload", "value": "e9298670fb17018dd8977f5dfda3537c63629c0a9ca5d02ab9a1289f710fc1ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089460, "uuid": "4b7a849b-f5fe-4b39-b049-8b893c0ca753", "comment": "Malware payload", "value": "7ff06739f59f6c51b73c9faf539de9837d103b0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089460, "uuid": "3675910b-6f28-4fee-b9c2-c0a2cbcfcbd2", "comment": "Malware payload", "value": "0062ba29a29b1d9fffd3a75bf912088b5c9c988a56b67854021931502989490261f59d56eb48f21c5a1097395de39e9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089460, "uuid": "5a907e3b-7e76-408a-bd4d-3c2a0fb6eff3", "value": "T113452302E6E90522ECF16F714CFA06930F3E7DD29EB9C36A478698492873694D57231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089460, "uuid": "c1c9f074-e0c1-4911-a825-1fe1a3521f34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089460, "uuid": "7f083604-6d4e-4cea-99de-f58eadc09b27", "value": "24576:nyRQZKeTo9b9ynq/0QoQPVVf3tmOvo/5mtIMOcS8uebpm:yRQIp9b0nq8BQPHf3525mBc8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089460, "uuid": "ab85cac9-5ac5-4f6d-ac0a-44cdf00e6f9b", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089460, "uuid": "5a977652-44fa-45f6-b26d-e8547b3f44d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089460, "uuid": "5dc400e7-6d41-45eb-9373-94c5ffac8ae3", "value": "e9298670fb17018dd8977f5dfda3537c63629c0a9ca5d02ab9a1289f710fc1ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a4d924-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089461, "uuid": "a09f5e94-b85e-4f11-8b33-32320a82e5e5", "comment": "Malware payload", "value": "fbe42346ebc30f710f58d21e937c95a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089461, "uuid": "21344075-dedd-4df9-ac1a-2eff6e30fec3", "comment": "Malware payload", "value": "e9637e302b77d31039018d9fe12c3a8c201a03348dd3440937764f9e6bee0292", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089461, "uuid": "f71f7d4d-2e41-4c8d-aad4-a8962973b8c7", "comment": "Malware payload", "value": "b65226597b6c6640fe388ede01b53adf7d762224", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089461, "uuid": "cbceacbb-d999-4963-a1ba-10efb37bd3a2", "comment": "Malware payload", "value": "85ac4683527bae808fa962b1eba8dbec8f40a195bd15bebeebe319c23e183ddf4e5cedc7376b377da6036fb8e1f54413", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089461, "uuid": "bc4ad6e8-be2e-4aa4-87bb-ba2bf3164f99", "value": "T104452316F6E481B5DDF53BB018FF02831A367CE69938932B2686594B5C722D1E4F132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089461, "uuid": "e37e0df7-1182-4fef-b361-2da95e5aba00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089461, "uuid": "87787c64-b3b0-4740-88b6-d1ca29252004", "value": "24576:Wyv92WuT2hcT83yxMF8OVY3fqg2RLkbBT2WtokvSyCCAUC:lvIucgixW893EeT2W6k6yCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089461, "uuid": "36fdfd5b-f39e-4bb7-89ad-740c756f14ab", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089461, "uuid": "839e1043-9a63-4743-926f-e0b4295f9bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089461, "uuid": "f5e034f4-7990-49cd-8d97-beefbe8ad61d", "value": "e9637e302b77d31039018d9fe12c3a8c201a03348dd3440937764f9e6bee0292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a8a5f0-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089463, "uuid": "5b0b9b59-648d-44a5-986f-9faf9c57227d", "comment": "Malware payload", "value": "05641b2e52eb2481c9dd17f4b9b1f09b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089463, "uuid": "9ac490c5-a445-4669-a172-3017d9437c68", "comment": "Malware payload", "value": "e96f031a5f4229dfa2c1d2401a512320934bbd76f1b27323ec049b171ae014db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089463, "uuid": "8d7e52da-527f-4d84-b211-e63cef0a886d", "comment": "Malware payload", "value": "9ebe53c441926a84004f07ab40ddedafef764078", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089463, "uuid": "c27182b4-22d7-495b-b3c8-d5d50a32a312", "comment": "Malware payload", "value": "b74f58498cd616dd17a4146fa370f07d18d79c9768feda83469aa067a80ca03e8542cdee445e6d59bdc0174cb6898c14", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089463, "uuid": "dd815a02-9382-4371-a917-b6c0a64d00d2", "value": "T196452332B3E85072E4B6177035FA01D30973FDA25D78421B2E4A66692CF3AD59478B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089463, "uuid": "68d82c08-df5e-40fe-b3cc-37fee099d7a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089463, "uuid": "85a314b8-56e8-4b36-b812-94a54e997b7c", "value": "24576:lyM5ce/b3Tv/DW9Uh8t8yHY+gthx0z15lsE2GuZPW76bMx:AkbbQUM8iY+kL0zTuEZuo76b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089463, "uuid": "ea5c1f13-109d-40e7-b9ee-5a000f05bf35", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089463, "uuid": "2f578c7a-16c3-4c0a-9b4c-e99700cfe3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089463, "uuid": "8f1779fa-78db-4f57-bf3c-d5252ffce7dc", "value": "e96f031a5f4229dfa2c1d2401a512320934bbd76f1b27323ec049b171ae014db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad3237a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089465, "uuid": "3294b21c-0b4f-4929-ba32-e63e4423c21b", "comment": "Malware payload", "value": "037d31d171adafea089817db0aaabdde", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089465, "uuid": "ea7a1459-2259-45c5-bae9-c8580bf0cf8d", "comment": "Malware payload", "value": "e9c838c3f25516edcf03174b2eb6a230069bdf565985efd27b76a5bbfb20a204", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089465, "uuid": "d18874bd-8862-48d3-87cc-2591f85c606b", "comment": "Malware payload", "value": "92ec8360ce5240fc7b80f59e7ecd4df122299018", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089465, "uuid": "4ecc77f6-139d-45b7-a474-043daab556db", "comment": "Malware payload", "value": "6c2912a28616125e55983a1bff367f55f6d2d9bbaa998e6e773912be32daa75a5f7f7f63936628e2d3e24ba9e86c2a5f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089465, "uuid": "b70c9aa0-a522-4eed-a0ec-250cfeb5a8df", "value": "T1D54523236BE8D576DDA5177069F303D30F767EA249A842AF23606C6F4DB27C04932726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089465, "uuid": "31444503-7f5f-464f-b428-9a4d1b1eeb75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089465, "uuid": "9755fdb8-10cb-4395-8cf2-3689a069750e", "value": "24576:rykGC19AQFkvRw/7G3cYQqFqSnN6cghCNBA:ekGCYQFkvRwzG3aqFxChCNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089465, "uuid": "76715a1b-ffdd-4e71-b051-dcd231625bdb", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089465, "uuid": "6c291b3d-f3cf-4da2-bf27-227241fdc4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089465, "uuid": "bcb2bd8c-08f7-49f0-8bd5-9c34782574dd", "value": "e9c838c3f25516edcf03174b2eb6a230069bdf565985efd27b76a5bbfb20a204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1c5f57-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058303, "uuid": "6083fcda-d58f-4195-9ecf-29db61ed94d6", "comment": "Malware payload (AgentTesla)", "value": "1941b2fc7a635aa5af7180d1b594ec22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058303, "uuid": "743517dd-fd5c-4145-a739-e9e197ed2fd3", "comment": "Malware payload (AgentTesla)", "value": "ea2032bcdf447d96fe235ac8273609bcffab76898e9e1d5520aeec8331863186", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058303, "uuid": "2279c738-7bd4-4a3d-83d6-f12c7a42dd4d", "comment": "Malware payload (AgentTesla)", "value": "750917e92aca538330e7f96b0b2e443617679f2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058303, "uuid": "35780b64-f40e-4abd-b766-856609690a51", "comment": "Malware payload (AgentTesla)", "value": "d924c8a8a40daaf45aa10ea89434825a04fde611d0151622a120889e1e424c4384be24959b1e26ec44da72b8697b8e01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058303, "uuid": "02d24759-a0ce-4f83-a978-f4ac07daf6c6", "value": "T13474121577A4C1A7C4A20A319D36D1FF1E90BD208C51466737D07FAFBE722B2960EB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058303, "uuid": "eda0a5ad-c152-461a-bc66-d5173bfa2772", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058303, "uuid": "ad50354e-c6f5-4929-83c3-aa5d9bf6db19", "value": "6144:gYa6oabGSZfroBzDlx7ujsTFU8HjwD7uk3l5nI9MYH6PrWVpP0q4/:gYmaC28dDL3vDwtAqUm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058303, "uuid": "c68b210d-83e7-4976-a567-2d6fcbf647a6", "value": 355554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058303, "uuid": "fa539322-5571-4be0-93a0-a3f3ff29ce5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058303, "uuid": "0d2c2f45-5ce0-460e-aaf6-27246eb4152b", "value": "ea2032bcdf447d96fe235ac8273609bcffab76898e9e1d5520aeec8331863186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1fa2c4-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089467, "uuid": "2807e95b-5aa6-46f8-af4c-35e2bb35671f", "comment": "Malware payload", "value": "0874e8c3bfe06df9cfaf50d646242106", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089467, "uuid": "cf204cc2-3dd1-4c3d-bc19-4ffdb26b5fae", "comment": "Malware payload", "value": "ea62d11cb52b0776a4bce94b3008416f9e6bc5065a5b1407dd1c6b09459a6d05", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089467, "uuid": "d8f43b18-fe79-4d18-96a8-b3f5ebb752f8", "comment": "Malware payload", "value": "cf37f936df93ca7c0d6468ce7e81cec377bf012a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089467, "uuid": "b0eb5334-2ca1-4227-afff-eaadc78aa67f", "comment": "Malware payload", "value": "8c5160b56a90ecd6cfc9203dbd697d6656aa427aa12fde2b9d5452cb6433a3417a0adc03bd8643d2a7f9db45c41f62cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089467, "uuid": "fa477e10-9cd2-403e-a517-5f65ea85aa4a", "value": "T13C452302BBC88131D5B51BB028F107C31F35BDE06D7557A72385BE9A2CB2E88A971767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089467, "uuid": "620d0491-cdf1-40e1-a33d-bc917c42bc63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089467, "uuid": "95cdd47c-8a3e-41e6-a23e-316ba6f4cf25", "value": "24576:MyVBHmrjD4Q+PALAQ51xTQVer4//TyoeQFQOVV3doViLS4P:7VBE4ZPCAQ5fYeoeQFBVJdoVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089467, "uuid": "4f669a68-2706-4992-b391-06d5212e9d3b", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089467, "uuid": "82172169-daf6-4458-873e-83eade7b6782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089467, "uuid": "b19f359f-62bb-4d5a-ac60-36a44ff4eb9b", "value": "ea62d11cb52b0776a4bce94b3008416f9e6bc5065a5b1407dd1c6b09459a6d05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce6e32a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089468, "uuid": "05abc688-513c-4760-b65d-66691c5d3335", "comment": "Malware payload", "value": "c35fe05a5a21c5a8445d83ed8e70f20a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089468, "uuid": "7a79251d-e6de-4472-9856-2ec63917f41b", "comment": "Malware payload", "value": "ea70b338c336a89a6f15d64945d4c1906a587c0b54656ebbc9952f66fff26d71", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089468, "uuid": "b937fc92-c32a-4fce-a0a2-cee57afd6f0a", "comment": "Malware payload", "value": "29c99622d6b0a146128e18ed9380f3f5abb9269d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089468, "uuid": "0edd661b-7cd6-4d52-abbb-520698f51efc", "comment": "Malware payload", "value": "121c69cb0e1844a9d7c6beb8f2e4361697e5fbaa1bb2b34b0c5dd0d36e73a78474060950412be494812c016f9495c4d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089468, "uuid": "c11836cb-a878-45de-9a90-bb2ae40d5e55", "value": "T13C452302FBDA4563EA3A2B30A8F142C30F3A7D643DB4625E32944D191C73DD669B177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089468, "uuid": "6d418023-04c1-4459-bff8-a99da4080f1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089468, "uuid": "9bae817a-7388-4787-a344-0ad149ad9a0a", "value": "24576:TyT97Z8PkBrQHYaHc+9zJ7NYHcTZ9FVEUfhsU5MB5rd:mTRuM8HYa8+/mHEEUfhsU52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089468, "uuid": "999d7579-4f94-451f-aa84-26b2b665e3f0", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089468, "uuid": "fc2bb885-dbad-4db4-a915-e0b2272ca8aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089468, "uuid": "24f48f96-1d5e-4c2a-8175-a0dfe45012aa", "value": "ea70b338c336a89a6f15d64945d4c1906a587c0b54656ebbc9952f66fff26d71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d978ce2-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089469, "uuid": "1fc6268c-4cae-469b-9402-756c9421c4c2", "comment": "Malware payload", "value": "e4cf6ecf6df908bcf7feaf23f9ee0bf0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089469, "uuid": "27ac2cda-5ac5-488e-a000-8531d749b7b3", "comment": "Malware payload", "value": "ea7ab7d36e5120a8a3f25e0a9a4b87c28f535c7ca3d1f34f05bc188d8a6c44df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089469, "uuid": "65d92635-b660-42dc-9676-aa29b90aaa80", "comment": "Malware payload", "value": "5da451888d514423e31da65c579d03d69288f391", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089469, "uuid": "aa71c5ea-175f-41a8-8628-f1d65dcf7bea", "comment": "Malware payload", "value": "7f9c0893dc2029f6fb0b632dbfb7f0bef6f293199b736cccc42bb00e7859e985d1f0455f3520a89e5ab4cedfd19f06c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089469, "uuid": "cadb24c9-cd4a-41f8-8a15-702ce679da2d", "value": "T1C5452313FBE49422FEF427308CB615430B36B9A16978834A3782987649B3385F679767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089469, "uuid": "b711d6a9-5339-4a3c-9a6b-89a1cd710cb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089469, "uuid": "461c7190-fd6b-4729-874b-723386bb192f", "value": "24576:hyBKM94FHU8P9xNTvMlerlFi3bi4q3iqJsDKWs:UBKM6RdZTv7raFq3iqkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089469, "uuid": "f343ab58-d3ca-4a0e-bb66-a85444ab197f", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089469, "uuid": "4f98759c-955d-4d5a-979c-140be5a75b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089469, "uuid": "df6e7eb5-e1f1-4320-9c04-b784911c1bbb", "value": "ea7ab7d36e5120a8a3f25e0a9a4b87c28f535c7ca3d1f34f05bc188d8a6c44df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc5fd12-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058304, "uuid": "af253ef6-63b7-4f85-8d96-b5f6a14c6b49", "comment": "Malware payload (AgentTesla)", "value": "3aa2f33526bd4c70b25ff2136582e97e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058304, "uuid": "179c4d4c-50b4-49fb-bd2b-1f74eeb29b3e", "comment": "Malware payload (AgentTesla)", "value": "eaa1c1137ba283f65d86337c1f60e7b943725526049ec7cf94444117fe9ffa3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058304, "uuid": "b61f4e3b-ed3e-414c-8d9d-e8fb8f34ca02", "comment": "Malware payload (AgentTesla)", "value": "6e138eeac755b378ef0701afc8e6ca1a65b6dca1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058304, "uuid": "2b77913c-5225-4571-8560-d031f620926e", "comment": "Malware payload (AgentTesla)", "value": "632c8c191181314b3f3559d5e9c6e61920ca276db4f3c63e6d2b0efb869f18cba973dbafbbc23007c6a1be3cd6d90482", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058304, "uuid": "bb9a3208-fb40-49b5-bcc6-a7645709309a", "value": "T1EAD4D0C567A5D792C2743EBD123670383FB05997EA26D925FE8950D93E32BCC0A4039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058304, "uuid": "f013ed74-4352-4329-9aa9-f4b98e5ca371", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058304, "uuid": "0f81bc5a-62a5-453a-8dd7-fed4aaa58c13", "value": "12288:dmRK95henzjWn/lPhi1oBEnK61OkHkREZUVdlJm3FJ5ShC5I:4RS5h7/LiGiQuiTz+ShC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058304, "uuid": "9a3ba4a3-4465-4a69-8c29-1e80b14f2e26", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058304, "uuid": "d4825d37-5175-470f-bdef-84c33da2f650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058304, "uuid": "9ec2e176-44bc-4d3e-ba99-62a7504bc916", "value": "eaa1c1137ba283f65d86337c1f60e7b943725526049ec7cf94444117fe9ffa3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed92c16-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089471, "uuid": "a6bb59b2-7292-4310-8a1f-969031bc1503", "comment": "Malware payload", "value": "8618a3e0dafa9cfe067cdba813132946", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089471, "uuid": "96058520-d91e-49ef-9b4b-82e11ec6d785", "comment": "Malware payload", "value": "eac32988f898a696ac62f88a474a51820d9229754fe20ce294935af3b47561b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089471, "uuid": "a56024d3-663b-44b3-a747-73ecee6186ae", "comment": "Malware payload", "value": "8127f448dc1b08557ebeac60252aa6f19f9d44e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089471, "uuid": "f159c423-d908-49f5-97d4-1071a5dd0388", "comment": "Malware payload", "value": "886ee16441f37e2cbab0a45b2ba0f3ac8e1decb2500ea74fe7fc4d8ffa6e51734d9e93f5184cfa7f6fc8299d816cb3aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089471, "uuid": "bc8c99da-03d5-47fb-9d96-0d21f47f5ff1", "value": "T18A4523436BEE8077E8F433716DF30693077A3CB168A892B7228556694C33AE16166377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089471, "uuid": "c4ccda67-5690-438b-bde5-8c40f39c58bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089471, "uuid": "e03cc6d9-d9cf-4937-8d6d-ca405f592f43", "value": "24576:8yWF1yZQ1sFkQgwkuMsC3gnMJ8+wCZnN:rWF16msFk7uMX648vCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089471, "uuid": "1c05d43a-34f7-4d6f-8706-85e8969ed360", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089471, "uuid": "6da96a49-2912-4250-82cf-89595e525575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089471, "uuid": "77a80d61-01a6-47dd-8c93-3885fc863adf", "value": "eac32988f898a696ac62f88a474a51820d9229754fe20ce294935af3b47561b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac08584-f230-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684052528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052528, "uuid": "0e723262-5c9f-4bad-a00f-fec0a3d8868d", "comment": "Malware payload (Mirai)", "value": "2b9cff4bd1c237cedd68998260fb4c3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052528, "uuid": "39e53fcb-8053-4eb9-9984-7494d12a224e", "comment": "Malware payload (Mirai)", "value": "eb47756f47856d9ab4a0b425e9e5781f9a8845592966ce2b67a776600f09c0f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052528, "uuid": "c376c3a2-6bc9-49fb-a954-fc4d5fd1a99f", "comment": "Malware payload (Mirai)", "value": "1c1c787395bbb90cba83e5f0c25efac1d7c56162", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684052528, "uuid": "e1aa835f-4f9f-4949-86f1-54ebb45afe5a", "comment": "Malware payload (Mirai)", "value": "b7c8506bc6d8768f845bae943d47d7d9977912a6af78ed89da4cdca4da53353fd3027c0f27defecb5134fdbd21d5d414", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052528, "uuid": "2d3a3d1a-21e6-4850-9ac8-b29ec7fd98db", "value": "T1FFD2D08876D393E6CCC9CA7EB35E003970DA74E9A7B29323B305D8534776180E655E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052528, "uuid": "04f07633-7707-432e-a456-6b0225f8b618", "value": "384:MSd/PxEDLd2TwULzm6lowYcEaqsp9qC450LQixBfE4jdlz0lewZ90BKdzNQKTsNA:llxKd2FLPxEnspd6IHE4RlY990czjTJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684052528, "uuid": "996fef9f-639d-47e8-a6b9-d1b5335cd751", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684052528, "uuid": "bb848b94-c520-43ad-a45b-3e45c99a6e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684052528, "uuid": "a290c3a4-a620-4138-b8ee-707e1798b825", "value": "2b9cff4bd1c237cedd68998260fb4c3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7004b3d9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089473, "uuid": "81c301d8-bc7e-4fbb-a362-de3b60f5510c", "comment": "Malware payload", "value": "1d6ae658f29d9b2e33131b42ed154810", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089473, "uuid": "d2634a75-5be4-4f5a-aec0-05ae1b8c77b6", "comment": "Malware payload", "value": "eb7962ad0ed791b6d0ba29a595492896ccf82359d724e9c38ff42af4a3e8d6f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089473, "uuid": "aa5f8de5-a98c-40ae-b6e2-996f003b8548", "comment": "Malware payload", "value": "8a0d2cf80eef44f00354878143a3904e03364545", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089473, "uuid": "6a093a4c-369f-4f65-8d3a-4ad36d99fe82", "comment": "Malware payload", "value": "2c95882a6d5b94f74190bd99a62a85268d578b2b94fe0457b00aa1f827a1fa973d77c61262a01c0224203ed6f61885d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089473, "uuid": "dae87c33-f41c-4f61-b705-2e94e6b3a23b", "value": "T10545231BD3C61431D8B61BB4A4F512870B363DE17D68836A62467C5F1CE3298E6B13BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089473, "uuid": "e500c7ad-e0f1-4d7d-be91-685d4f64d956", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089473, "uuid": "25372fab-275d-43a4-ab39-6b7fa9acb61e", "value": "24576:qyACXG/1eYvSJOqVrqWzkAnhIsxzxR4K05b3uQCnX:xAC2NeYvSJOqVXnhPHR4K05L5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089473, "uuid": "43c5f9c0-aaff-4f48-9509-90f4a059d22b", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089473, "uuid": "f3bea1f4-c116-40f2-bf79-67f0b74c2c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089473, "uuid": "8d87cb60-5df6-4af3-a1e4-babba73e50ef", "value": "eb7962ad0ed791b6d0ba29a595492896ccf82359d724e9c38ff42af4a3e8d6f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fc3008-f1fe-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684031290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684031290, "uuid": "227fc3a1-df93-4106-9750-a03db6b05630", "comment": "Malware payload", "value": "e1aa70e7ef25fdadd52160e9b9f37b37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684031290, "uuid": "7053eaa0-fb16-47a1-8469-a6e2f0db9ad3", "comment": "Malware payload", "value": "eb9c9eb6572805d03da8b824b1d179301cded34e9c9a71dd1573daa0b2978953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684031290, "uuid": "79397139-6430-4614-b674-40a28eec1a31", "comment": "Malware payload", "value": "7b1538dbde2ad906db1a03dd62604c787adb6579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684031290, "uuid": "a82b9557-f7a4-4807-8e01-10ca4a1198d2", "comment": "Malware payload", "value": "dfa7710bf7828db6c80158d08319d8b024543cbad01aad1742bc0ea9b56094200b2bff43e48ce48ecd6556e20d54c391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684031290, "uuid": "ebad473f-8653-47e9-85dd-6b721eca9042", "value": "T18E559D4A77B505A9E2B7C17DCA464F0AE6B27805072197DF03E453A62F377C40ABB326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684031290, "uuid": "9334fac5-2a4a-4d82-b093-9e2aeb0f92bf", "value": "d3401a6af173fe335f418ac3c9b5c7cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684031290, "uuid": "b02ddfa9-a045-405d-8ecd-8965bb4b9ec1", "value": "24576:VKgZ9oIV1lNRSNv59kxgHegLOfLcW4q9wFuoqRHb:oYO6lbSNvLHe134q9tRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684031290, "uuid": "a075c4f8-2dfe-48dc-8a65-563213736d2b", "value": 1382400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684031290, "uuid": "78adcdb3-96cb-463e-bec8-4eb3c8e19e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684031290, "uuid": "4cead68d-94ed-4a8e-a157-39934850248d", "value": "SecuriteInfo.com.Win64.Trojan-gen.31951.26059", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cfb478-f2a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684103418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103418, "uuid": "2d284249-e45e-4251-be7f-59230099fe44", "comment": "Malware payload", "value": "223aa102f85299887ec8a38b69088220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103418, "uuid": "42379224-187e-4704-aaf6-15fbf2563f0a", "comment": "Malware payload", "value": "ec07daae2945fb0e875b2e2e477eeb6a12d1e35b78762636fd944ac738402717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103418, "uuid": "15588300-f7eb-4b16-97e0-ad808ea428b2", "comment": "Malware payload", "value": "0592a21349e36564c82001e2b76bd5b1a29c7b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684103418, "uuid": "8e83a5a0-ab9c-413a-86b5-ae38fed7333f", "comment": "Malware payload", "value": "f4685c1f0b8678dfd82ce95fcfa61d69560f8a155ae3cffea284b39bf919397aaf616e803e331ec7b989f29c8b93b471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103418, "uuid": "8b999195-58b7-47b9-b580-30ebcbfed5f9", "value": "T16CF2E139BEDD4831C448B27D0DA2816B356CBD244C978BA3B155C79FFF46AE16C04AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103418, "uuid": "21ae97e4-7d02-4060-8752-3a5c02ba8192", "value": "3688d9995e71346de3896af2c0fbc27d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103418, "uuid": "6fa0260e-02b3-4f06-aae4-39bbd03dc55b", "value": "768:2U7iUeI7hMjIshnzxD6DA9vmUFroFsVW1lUv+3qZBrVJ:/iUx7heI2nzZ6DilxUEW12G3qZBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684103418, "uuid": "6e8c5467-ec9c-47a9-830e-b32b42f790a2", "value": 36029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684103418, "uuid": "0c3e3ef2-d054-4bec-84af-9d220675d81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684103418, "uuid": "fd0e9977-17ac-4936-9f80-7daf7a2d9ab2", "value": "SecuriteInfo.com.Trojan.Siggen8.20659.5546.11089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c055d1-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089474, "uuid": "4850bd33-2a4e-4612-b3aa-17a829c923b1", "comment": "Malware payload", "value": "447a338423d960598c962bc2357462be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089474, "uuid": "1fcbbb92-e75c-44a8-959f-f4354166fba5", "comment": "Malware payload", "value": "ec2d066e99962a25f3db7a6f839c5bab2b090889be6f30406bad596e0eddbff3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089474, "uuid": "0db42e04-a7b8-4bf1-9249-45eb80dcce9f", "comment": "Malware payload", "value": "c560a6d6a1219eb2a564f511b9f94f10bfe9680e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089474, "uuid": "468551c2-4603-45e6-a5d9-19154fe4bee8", "comment": "Malware payload", "value": "1c9252ee888afd63d93eef8b31121c668c86b5428b3fb07e6efa739acc2fe215d4d19ad631cb29d8a9a2fa898b0111bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089474, "uuid": "a5b77f59-81c2-4959-8397-ab7db0aebac6", "value": "T1A9452342F9F48072DCE16770ACF616C30D7A7CF9AA345657138999E70DB3A80A930B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089474, "uuid": "247aaa5c-1f2e-48f1-9aca-b90665c547f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089474, "uuid": "c2dc6a8d-a12b-4e54-bf14-7aa4cb545754", "value": "24576:fyk2+ZmJUs8Bg3Bn42XAQLrvkVxVBlRRw0:qfumJUBgx8QPsVxVBlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089474, "uuid": "b4b0590b-2d49-4346-9b21-8304eb4cecb0", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089474, "uuid": "04b48cab-2a33-4413-b8f6-42b743a05aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089474, "uuid": "7b7ee6f1-353b-4c41-9580-d4e0a7c915ee", "value": "ec2d066e99962a25f3db7a6f839c5bab2b090889be6f30406bad596e0eddbff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71835be9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089476, "uuid": "5bd83cfc-6342-476d-8dca-971dc2b9a825", "comment": "Malware payload", "value": "8232bae03ec604d4bef00296e2159945", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089476, "uuid": "4b2dacd3-fb5e-4fa1-9336-4cb8df103b95", "comment": "Malware payload", "value": "ec5e496a96609c27c8adc62ca27fa259c308c366ff3a662e7135103324db67c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089476, "uuid": "9d543d6a-9158-4a71-8f15-7e7b596f899b", "comment": "Malware payload", "value": "70a15a766cf8ba69a747949f7eae9d5b479e37d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089476, "uuid": "18214bab-ba53-49d1-9f8e-293f93d25aef", "comment": "Malware payload", "value": "8bbb237485daeb71a6991d8f8d01787abf9102f1a68acc6c0bb4183ef657a0a089c5c69fdd83317ab49baee4b5b0a6dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089476, "uuid": "1858f08b-1a22-4c2b-9ca2-0cc7ded785f6", "value": "T10545230AB6D86076E8E1677829F602C30B39BCE199B922BF374359570CB35845079B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089476, "uuid": "f1459591-8096-4f90-8e15-2d9af9bb7c58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089476, "uuid": "20dec27f-7ec2-453a-ba2e-1b6fed882cc7", "value": "24576:syUzNoSxFbkcZmUMXCvfwcbZF5BOONqqOBCeLfKTiul7:bUJPKcMUMSvfwctF5IWqqmdLiTZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089476, "uuid": "d7bf6711-3e7c-4e5d-8d61-4dbdf2e7c59d", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089476, "uuid": "543ee180-74ee-4e47-bf48-8afdc98b9bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089476, "uuid": "585f52e3-e827-4eec-b4d1-a415d5128464", "value": "ec5e496a96609c27c8adc62ca27fa259c308c366ff3a662e7135103324db67c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728b76ea-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089477, "uuid": "a3c45048-bc0e-4b6c-a3e2-50db069b4ff6", "comment": "Malware payload", "value": "680970ed0195e02f50cf8a349210218f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089477, "uuid": "bb56a198-12a7-4e60-8904-c8d0fa0f2cd8", "comment": "Malware payload", "value": "eca9b94dedeac84fa594bc441da231d795e2bbe961909200cb200aae89857bb1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089477, "uuid": "58033b20-bd4d-4852-9b2d-2494dffe583d", "comment": "Malware payload", "value": "8fd8490e7f12931d2f654e5b7d4035d829352e80", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089477, "uuid": "03ecfdb7-a0e5-48b7-9f5a-16b594c36af3", "comment": "Malware payload", "value": "5803fb2b3ea53db8868896916af27d06a0e9cd835ccf103d63346b689358d4edcb15c598b734c9a4e4cd323935734d60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089477, "uuid": "4002a4eb-1f1d-4610-8e00-2a23072aeb78", "value": "T10B152306FFE88072D8B71B7018F213D35A36BCB56938566B3386A9090DA2DD1D4367B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089477, "uuid": "791fc1c1-4502-4020-8915-46c71fa7b661", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089477, "uuid": "9dcb6cc6-8b65-419a-bc15-9fe07e5fc064", "value": "24576:byHwzASpaDoLUenDX6d/QIxiBiaXLwHTHuILeD:OxkaDqnDXpqzUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089477, "uuid": "e8bada3f-968b-4cd8-bc13-8de042edf07f", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089477, "uuid": "43851333-e455-4b72-a317-1a36932aec92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089477, "uuid": "819a3163-cdfa-4c0a-8965-7b933b2e2789", "value": "eca9b94dedeac84fa594bc441da231d795e2bbe961909200cb200aae89857bb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e3ec2c-f1f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684026421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026421, "uuid": "bd5bec21-caa5-4f26-acec-a6ae5bc21a12", "comment": "Malware payload (njrat)", "value": "df7fc50c25fae590d5874b01042e1ac3", "object_relation": "md5", "Tag": [ { "name": "badabindi", "colour": "#FA35D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026421, "uuid": "fdab95f7-30e6-44d3-813e-60ce852867f8", "comment": "Malware payload (njrat)", "value": "ecae6a842a9d1e85254965536628840d2dd28145db57e32d821b10ec9744ba8f", "object_relation": "sha256", "Tag": [ { "name": "badabindi", "colour": "#FA35D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026421, "uuid": "18b36c3d-d629-4c5e-a7d3-55a2a272df10", "comment": "Malware payload (njrat)", "value": "5e9c01fbd1f61b3af994d84721f6a7c8ad9d8980", "object_relation": "sha1", "Tag": [ { "name": "badabindi", "colour": "#FA35D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684026421, "uuid": "48a39afc-51fa-44ba-9668-9740aee8f084", "comment": "Malware payload (njrat)", "value": "83da8a4dd722340124ee3b8fa5dc1ca9bf6c228efa90760ba9ec2b9f4cf05610800ee4d06bca7633210b1e920e7c78a2", "object_relation": "sha3-384", "Tag": [ { "name": "badabindi", "colour": "#FA35D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026421, "uuid": "584f021a-8509-4597-9320-60625f881d06", "value": "T1EFA2F94A3FB88855C5BD1774C9759A1003B0E1870512EF2A8CC954DBAFB3BD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026421, "uuid": "52d6f613-fe87-41c8-b4f4-26ac64cd6447", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026421, "uuid": "7e90dd19-5e13-47d3-be95-1aab04d3bbd2", "value": "384:/QeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZ+Fp0:g5yBVd7Rpcnuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684026421, "uuid": "12c73c9f-4741-4dd0-972c-79904daae142", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684026421, "uuid": "7bab184e-0978-408d-94da-26bf29189bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684026421, "uuid": "79dff5cd-8414-4ab0-9cad-c564c21912da", "value": "download2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734e8092-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089479, "uuid": "23dc47cf-6765-491d-95a6-18292da03ef0", "comment": "Malware payload", "value": "263fee2452649fc576f3dba8c6c48854", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089479, "uuid": "d04c01a3-8792-45c5-8046-1b1b935406cf", "comment": "Malware payload", "value": "ecb95cacddc6ea7ecbf214809b93394f8ca06663f401d12fcebb5c693baaec96", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089479, "uuid": "29a8c6e8-710f-43e5-9c51-5964c244079b", "comment": "Malware payload", "value": "0ea92c7d40cab19721ff60a96307de15bd048ef9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089479, "uuid": "a5fda797-2b79-40f5-b233-23372de3c768", "comment": "Malware payload", "value": "ccdfac0a8c310d0c674c10cc2bc9e3fba86bcef83074bbbc793741d6f3323ca36c8603e6117ebe33dfd82214e7167c34", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089479, "uuid": "4b98f150-55a7-457d-aeb5-e360fe440bf8", "value": "T1AA45230391D4AA33DBBF23702CF616C71B35BCA2AC74436B274A994A1CB2254F575727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089479, "uuid": "68e294f3-de49-48ed-bd79-2c9183448f81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089479, "uuid": "a69645ad-25c1-4d31-b6bb-5c478736c4a5", "value": "24576:yyMi/MudOgmbphqDmvCxItQTLnuGI62xo133zfJGc1zvD:ZeqzmeSvCxTfbwo13jfJfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089479, "uuid": "c4aa9ab1-39e0-4110-8873-03bee8f53970", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089479, "uuid": "41e8f016-1ba5-4c81-9164-1b4b85e361a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089479, "uuid": "a72e7d9e-9266-4913-b890-253de1990534", "value": "ecb95cacddc6ea7ecbf214809b93394f8ca06663f401d12fcebb5c693baaec96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73eef406-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089480, "uuid": "11ac2fae-9b7e-4f1d-a723-150f58911c4c", "comment": "Malware payload", "value": "629aa8dcd9d6819af3efb1c552c52446", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089480, "uuid": "60fb0f23-7f4c-4695-a6b0-2e0fd9348eb1", "comment": "Malware payload", "value": "ed045384cddc81667ea4f34f2cbb71bb62c3b4c1ac8a5e0e31e5914fcc2365b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089480, "uuid": "41b56cd5-abbd-4519-933a-26f73351d0fb", "comment": "Malware payload", "value": "cd49421c326329f8b0796fad1ba02e1f06fb9352", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089480, "uuid": "8fa0a2b1-f6fc-42f5-9d02-4555c563bf5b", "comment": "Malware payload", "value": "8a8ffafb33ae6c1f13460ce45753af6ec8eab6447583c5cb59f50761698c6f185c4222ecf0622835035d287a0103cefb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089480, "uuid": "f0419a14-0dfb-462b-8db6-195c14d3d67a", "value": "T122152343F3E544B3F9F92BB048F713A7063BBD715D74991A1362682B1CB2680A57472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089480, "uuid": "0c2d6d8d-4f2d-4be5-8239-ccfda2d5eecc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089480, "uuid": "8b655bba-6385-4732-b193-3b0fbe778047", "value": "24576:UynJ1iW4FYamYMLCu5wjQiILYxxmFO2F7LW7R:jzi7aamxOu5wsiIEcFOk7LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089480, "uuid": "61d880ce-afbc-4b49-a51e-2ff605403edd", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089480, "uuid": "0a127832-eb2d-45d3-85ee-fea2498d123d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089480, "uuid": "4ba8373f-6b1c-4908-9704-709c35623666", "value": "ed045384cddc81667ea4f34f2cbb71bb62c3b4c1ac8a5e0e31e5914fcc2365b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a719ad-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089481, "uuid": "f5bd727f-56a3-4f51-ab23-c4d04886e97d", "comment": "Malware payload", "value": "aec87a808ad2360da614309f25a7a442", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089481, "uuid": "73ce4402-a9bc-4d10-a1c8-bbeaf0950711", "comment": "Malware payload", "value": "ed0454285975ee5a3f3b96591d13c4e078437fee654bc489a80a1e162dd1d528", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089481, "uuid": "f5d7fb69-17af-47d7-96af-027d27c7c135", "comment": "Malware payload", "value": "28d9fb1a31c08d309c0a2bd06310b3751d583292", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089481, "uuid": "7b47f73f-0cf6-49ef-bc3e-3f69cc2999e4", "comment": "Malware payload", "value": "4290923c572d20b6653c088329bfc3297cc4e385b4b0bd56908efad08582986f01b27955bcc771c447c469a410b7ba21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089481, "uuid": "da247272-e8c2-4a52-a41a-ef93181e09da", "value": "T190452362D5E49133DEF52B7064FB03831A36BC924C78935A4394A5EB1AB27C0E435B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089481, "uuid": "b3d51585-e58f-4342-8f23-808d97e56599", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089481, "uuid": "42c844db-7387-4d22-8b28-8023de93a0e1", "value": "24576:Ny7oLEgbJC8PqTLg2Q5h8kT/w2KPQ3DMXiq5YrDdzQYOdiUvmMWBuT:o0HbJX08UeMX2N0diUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089481, "uuid": "5d98071e-a549-4f76-8380-a1341da8a641", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089481, "uuid": "6d2b2bbc-9e88-44f9-92d3-4161e2b3446c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089481, "uuid": "91094417-ad9e-4fdf-bbe2-9ededf4bb916", "value": "ed0454285975ee5a3f3b96591d13c4e078437fee654bc489a80a1e162dd1d528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7571945e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089482, "uuid": "5794b7c1-dcd9-4a9a-8fbb-454fa63ec9c0", "comment": "Malware payload", "value": "63db22b1761ba6301b813b8f96090132", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089482, "uuid": "31ca4037-676e-4ee3-8993-eb9ad9577448", "comment": "Malware payload", "value": "ed483b721e647a7c69948956c878ab495726454f1e8f10c1f73922ce358783b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089482, "uuid": "8d5dccbc-b44d-4560-a7b0-941ed660d20f", "comment": "Malware payload", "value": "9f75e64dced1a808abdf502cfdf08911b9ffb804", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089482, "uuid": "9524758f-b262-4888-9763-61671b69358c", "comment": "Malware payload", "value": "5f3fe54ecc65cd0a436f0c78740fccbcd50c6a9c91527f84521a8708c8cd162313f8b8a8a1c2531170c7dd6e3e8280d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089482, "uuid": "fcea3a12-f7f5-4f1e-ad04-494e41ef60b2", "value": "T166452311E3E90477E8B067B00AF702D30B39BEF19C7881677756996A28B26C1943677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089482, "uuid": "0e8fd7d4-bb43-4a91-9b69-cc5a2f06700c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089482, "uuid": "311d0799-80fb-4976-9723-a500b2a8c102", "value": "24576:LyR3YsXf3Fk1cthYOE8fLWsTXhX/XZkSrA72RqGXtQFhoK9s:+FYsP3Fk1ct6CfLnXhX/XZ1EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089482, "uuid": "bc304fed-fbf8-4c5f-83bb-06700cbb7bf0", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089482, "uuid": "8ed132cc-8202-4191-a741-82f3f2cd2dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089482, "uuid": "f4bad025-aac8-4bc8-8a66-7cc02a8efe33", "value": "ed483b721e647a7c69948956c878ab495726454f1e8f10c1f73922ce358783b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762cc6b7-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089484, "uuid": "45c8b6dd-2d08-4c45-ac67-2c6ffa69e10c", "comment": "Malware payload", "value": "386c3e6c81dbcc80ec9a0e390ccedf79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089484, "uuid": "0cdd1e6b-fe98-48ba-ba74-e6921f0dcb08", "comment": "Malware payload", "value": "ed571035b1c4cf8101e899022e35ded1ef5b84459d1f3c2be7f5d37a7b3781e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089484, "uuid": "ebf25f73-97ab-45a3-8071-8147c2352adb", "comment": "Malware payload", "value": "429036ce06c315dde498eacc49c8d563e400e0bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089484, "uuid": "7d2d894f-c53b-4f3c-930f-9ee5d654c07f", "comment": "Malware payload", "value": "ee28e585e4130608397f65e8f85eebc30f1ee6a92e71f4de9ea3af8a615018999687ed86d978ffa4b0ef4b2333032d75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089484, "uuid": "8b24ca56-cdef-48a8-b5ac-c289b05bf885", "value": "T14A4523432BE58921D5B56F7019F202D31E313E63AE71C3AF6266ED854DB24C4F97232A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089484, "uuid": "250f9806-0463-4373-8e28-5fcc14b78c08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089484, "uuid": "0b984549-ac92-43a1-850d-5f5f20e63944", "value": "24576:uyMJDdmefAdokW8BWSHHPx8OE1uJf5CKDmYjjm:987kJWMWSnp8tuXCKDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089484, "uuid": "f4c0d958-a81e-4f15-9523-1b49e3bbf679", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089484, "uuid": "aa639048-248f-4324-bf7a-b8318c15ce7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089484, "uuid": "d927949e-d5c5-4462-995f-5c675ccaa960", "value": "ed571035b1c4cf8101e899022e35ded1ef5b84459d1f3c2be7f5d37a7b3781e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696e656a-f211-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1684039211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039211, "uuid": "8474ba84-92e6-498a-b8cf-189e497e7811", "comment": "Malware payload (CobaltStrike)", "value": "f21615f433a0e25b5c635046c6196372", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039211, "uuid": "4f869ea0-6553-4f2f-98bc-12cf843636fb", "comment": "Malware payload (CobaltStrike)", "value": "ed61867a9878f644cdecf432805c8560bfa39b9191be013067eb875500a80f53", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039211, "uuid": "6bd9f4b9-4ea1-41c7-bcb4-ba0f27de722c", "comment": "Malware payload (CobaltStrike)", "value": "ff86a8471d4125d4367feeac88c2f9c4269bab24", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684039211, "uuid": "e2b33ec6-c259-496e-88e3-526b9fb94be2", "comment": "Malware payload (CobaltStrike)", "value": "fc4b4b2c210224121b0990ed2a679cae5f000ee78b2598c3a11935be92f7e481dec33e4118b0b02ee264064cfeb3b82b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684039211, "uuid": "a8012fc2-c504-4a45-b7e3-b1fe11ad69d1", "value": "T16C549E973FA80D4DEB06F0266562B0C66CD56B1E5560C8C2E6F1D2E5A4F42267CF83E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684039211, "uuid": "bc832336-ce86-4953-93cb-cd63fef0d9b1", "value": "6144:CvXopLp7+LE7hPxOmOSD11T/Z2CyVVxqes5bB6lzITyrD/:CScLq25c5fyVTcAjrD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684039211, "uuid": "4e678603-c875-47fc-95ae-714924094fd8", "value": 282410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684039211, "uuid": "0d781420-dda3-4194-a8f0-299d1767054a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684039211, "uuid": "454bbc98-2237-4cd0-ac57-dc59a1678ad4", "value": "f21615f433a0e25b5c635046c6196372.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77460497-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089485, "uuid": "01345531-0fe5-4a32-a35d-ae4c48650eb6", "comment": "Malware payload", "value": "c241d155c1711dce9cca3b57b50563bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089485, "uuid": "f289391c-2692-4725-9b62-088a946a9b22", "comment": "Malware payload", "value": "ee35421aaa3eeddd23f2d257de66453404296322b13200574e9edc903948dcc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089485, "uuid": "e421180d-d467-48bb-afa2-50a09ac8f6d7", "comment": "Malware payload", "value": "573504fe7a930872dfa705a3d42c26a87f26abe2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089485, "uuid": "0b9b24b9-0900-4be3-a0a4-fd362695df1f", "comment": "Malware payload", "value": "df0b01098572eed44c0325881fd9a56f2f3b1bbf78d58546ad0770b78677bf86961a0b54879db9873a4bc57b5862ca2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089485, "uuid": "2b785f6f-aaeb-4385-bb8c-e61d3580226e", "value": "T16D4523135AD9A632CDB127B41CF712D32B7A7DD08CB8C27B6394A64E0D7298494327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089485, "uuid": "d1c1d7bb-2990-4da7-85d1-7766848aac78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089485, "uuid": "29341a10-a20b-444e-9611-8c910f4e2429", "value": "24576:Qyz14NbitrcfoL/UdlhJNbaNEgw8XAHChlyltcvdtKqY:X56biGM+lhDcHmH8lzV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089485, "uuid": "0fbe416a-1b24-4ad3-bd3b-95da510cfabe", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089485, "uuid": "4b2daf6d-ecf5-4547-9584-06e513da09a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089485, "uuid": "b9707237-20ea-4836-8b2a-62c488ce1195", "value": "ee35421aaa3eeddd23f2d257de66453404296322b13200574e9edc903948dcc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035eefed-f271-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684080272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080272, "uuid": "d1dfa14b-6230-45bd-bd3b-0a55c05d971e", "comment": "Malware payload (Smoke Loader)", "value": "06535fd0e4b49c8db0d85ed7bbfc0db2", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080272, "uuid": "980bf1e7-5adc-46c6-95a4-766175cebd3d", "comment": "Malware payload (Smoke Loader)", "value": "ee53a8c4cfe71ea0a52327571a2d60877a4bd09fbd87ea6289b744897d9f2b6c", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080272, "uuid": "6c3a83b4-f709-40d4-9c79-479ca9a13bd6", "comment": "Malware payload (Smoke Loader)", "value": "feca2533071bd57d49f66a58236ee38c6e3f0852", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080272, "uuid": "932603dc-a36b-4815-afed-453a920db9ec", "comment": "Malware payload (Smoke Loader)", "value": "f824693e2d33ccf43eaf69dd1dfd461c8205267caceb0bbaae52e1f8b60f26860653a40518ba709d477047ab0656a19b", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080272, "uuid": "30a097aa-9c13-4b90-bf7a-ad5970812ebf", "value": "T194644B5366E0BD70E6624A329E2EC6F8F79EF5604F1977AB1219FA2F05701B2C172311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080272, "uuid": "aae49600-9f72-466e-a7be-dd53f600bdb7", "value": "605fea7870fdbb8fa25f9220a2a10773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080272, "uuid": "66e0ceb0-2ca0-4e06-9a7d-8b148377d26e", "value": "3072:i+z4YFx23pHm8v3VYnxiJ+EtpkrcCwUSjL+SEjKYB/9gbp7t:YKE5m8f6nLCaUbjaSEj5sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684080272, "uuid": "3f9f3cfe-1088-4097-b989-23e9c0b77229", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684080272, "uuid": "17f9de8f-5447-4306-a906-003db5d2e471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080272, "uuid": "d76bdfbe-a383-4c31-85c3-a02fb38620f1", "value": "NyanCatFriday.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7804cfe0-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089487, "uuid": "584ca307-9e29-402d-b44a-2829c8ea4a05", "comment": "Malware payload", "value": "8f1f8eaf0488cf2110f4bbff3766fc03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089487, "uuid": "916fc2aa-8a42-4a49-a6a7-891299cf0bf0", "comment": "Malware payload", "value": "eeb8aa6df6eda9ee6e2f1a0442fbbb6b57bf471d6c58eddcac00845ad5c24510", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089487, "uuid": "c0475457-4981-40c2-a12a-0f2c2288b682", "comment": "Malware payload", "value": "c750ba51489eca23c3515e88385cd0bc8d66660e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089487, "uuid": "401c1eb8-6590-4513-a917-56bc1e94ba8f", "comment": "Malware payload", "value": "1f4afc65b9c23051199c6b9de9ff641b3e96dbd3ec67c92cc75739968ecc05df3c4dd7bc7c7a1452f2908cfdb170f38f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089487, "uuid": "29267701-41af-44b4-a314-8916a25d7018", "value": "T19245232367D840B3FDF12BB0D8F606630639BFD57DB846663645A8156C62280F53A3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089487, "uuid": "691829ee-e694-46ad-89d4-072baeef96c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089487, "uuid": "b6a640dd-fc29-418d-8d08-0cbc10db5f5e", "value": "24576:0yW9TIlYc0KZ6IvYkGl/lSAL0eAB9LFCY:DW9TIlYNCYkGl/MU07xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089487, "uuid": "c1ce333e-6462-4f8f-a559-12bab82d34a5", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089487, "uuid": "4c6d216e-cd19-48d2-a4c2-6c08e7ec1e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089487, "uuid": "587bc388-dd2a-4046-9d08-f5219c37bc11", "value": "eeb8aa6df6eda9ee6e2f1a0442fbbb6b57bf471d6c58eddcac00845ad5c24510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4655def1-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032280, "uuid": "3cfd8ed9-358f-4b52-aaf8-b4776946e7ae", "comment": "Malware payload (Mirai)", "value": "63c40c2d03db50b02ccb98f8ba652b01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032280, "uuid": "0a2dd1bf-1aa7-4ea6-83f0-9cb8bbc2bd1f", "comment": "Malware payload (Mirai)", "value": "eec617ce6828ede6bad8631ddab6f44cb16685b5d5e673669d7b091db44f4801", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032280, "uuid": "b72896dd-44e7-4291-bb77-8eb86fffdb22", "comment": "Malware payload (Mirai)", "value": "906169d372f7d1ca7529686a94a119c1753cb157", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032280, "uuid": "be0388f1-d7ac-49d7-b1db-9db4b1e99944", "comment": "Malware payload (Mirai)", "value": "b66bcff3d41a9cd9e5ec6020d7ac6090067794e54f2e3df4f1eb5dfda93456249e7c286a52459d4adac3373ef92fbf00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032280, "uuid": "c7339e2e-27fb-4afe-9f67-6571e923b5bd", "value": "T122432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032280, "uuid": "fdf5b476-1d9f-4c47-b3e2-41778169e7b3", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwc:RqtmZPuutfbltZFBSJsBcfDSTFI+BEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032280, "uuid": "c699fb3f-22f3-453a-8474-a568e0d0ed41", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032280, "uuid": "8a00c727-6091-4077-8db3-ca878c44cc9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032280, "uuid": "ccf857f1-0f63-483c-a0a0-78e9b6da839b", "value": "63c40c2d03db50b02ccb98f8ba652b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7921d5ea-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089489, "uuid": "e51f54c9-20e2-427e-a7a2-fc2d97bd38da", "comment": "Malware payload", "value": "965df695f13f360fcca6514f58915cb7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089489, "uuid": "9ad45d20-ed8e-4e5c-ad62-a5256058ed1e", "comment": "Malware payload", "value": "eed2731eba02caafa76c07f5908d35d485f873f3a72cf1e0857664c35732872c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089489, "uuid": "013838dd-95fe-43d4-a948-7d66cbf82413", "comment": "Malware payload", "value": "1c330ca3185b6cab45e3f5fb34fb392780b95c31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089489, "uuid": "3e270c55-f92a-4a46-a553-2ee34ae22ace", "comment": "Malware payload", "value": "70cbf8bcbe7ef70193d3c991a78f16b88e8cbc38530aed87ceb31506954389a075daa5b7ff01c70b9153617bbdc6a161", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089489, "uuid": "2daa4e09-96b1-449c-a358-edb0417c1152", "value": "T194452323A5A49437ECF127708CF613831635FDE2AF60815AB746AB1F0CB26C4697176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089489, "uuid": "9e288e47-6486-47eb-b8d5-73ce801a306e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089489, "uuid": "643c014d-aa3f-4ab7-a0b6-d03adf140118", "value": "24576:iy8Q428QNVT36x8UabTcw6LqTVJ+0C/GHax8r73R1rt:J8R28QNp36xv+TcwDT7+02GHE8r9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089489, "uuid": "656f6753-f50f-4f0b-a073-c3b07881e118", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089489, "uuid": "789f70ce-f9d0-4f5f-afc4-cb3d313b3a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089489, "uuid": "8566ef33-0a3e-49ef-8cc5-0bfc5bd0fcc7", "value": "eed2731eba02caafa76c07f5908d35d485f873f3a72cf1e0857664c35732872c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e49316-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089490, "uuid": "79d6c76c-4d03-43d7-aee3-6b96e9016f6f", "comment": "Malware payload", "value": "6115e1e5c42a5c8f2090a08c2ccf6b68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089490, "uuid": "3d1f859d-d8c7-4c04-95f1-4f25ef9f8741", "comment": "Malware payload", "value": "eeeaa44fabd2e926585f81bc11496ea4988c23e254f8d50eee241540d020a6b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089490, "uuid": "7dd0eaf9-ac89-483b-9497-55248ada3b99", "comment": "Malware payload", "value": "c2cb9ba7a57f7302f76d808f9df2ec5a2741b965", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089490, "uuid": "9f173734-40e4-4648-b028-c696799fcf95", "comment": "Malware payload", "value": "7a10cc40459461545aba383cb859490e01e84c0e7ad2a44474280497fe7d8f94709dc582899678c870157ac37920cb1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089490, "uuid": "7223bf86-1e89-470c-9eaf-e14919d73ae5", "value": "T110452303B2E445B2ECE627B56AFA0BA30B387C966C79476B2B011E5E4E71110793537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089490, "uuid": "976b598b-c54e-438e-8ab3-2bfe3372aeb9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089490, "uuid": "c0a08c87-3121-435d-80bb-07759250f761", "value": "24576:3yJhbhpEtWrCNXAHbtYVfeIAwx3+Wy6xgRx:CJhbhXyubtwFxOL6xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089490, "uuid": "c8dbfa5f-1490-4716-ba28-14495447c8e3", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089490, "uuid": "2a2196ae-080a-4ee0-b030-87fc18310e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089490, "uuid": "53d38651-eb32-4e18-b8c5-9f5708a5c397", "value": "eeeaa44fabd2e926585f81bc11496ea4988c23e254f8d50eee241540d020a6b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa2d7c5-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089491, "uuid": "1c27e2b7-1318-4867-beb2-13dfd6f394b4", "comment": "Malware payload", "value": "4120f88f1743be14b0a93ceaa223c74d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089491, "uuid": "b2330af6-eec8-456f-bce0-fbcde6762b53", "comment": "Malware payload", "value": "eeed49d3b75a71792b11ed9e714e0d9dd0730336811ca26f8ac9c742d548a15e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089491, "uuid": "4174ce17-8046-41f7-b8a2-29f78f1a9716", "comment": "Malware payload", "value": "1c67fef200e05ffd16c2cdd86075533a3f9c6adb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089491, "uuid": "3a0d6548-4ee5-4f4d-9861-153407aed890", "comment": "Malware payload", "value": "35d54d6fdcc281d3afdcec5e5ac4adaa6f8719b6d6217af12bf4f0cd6ce76a099b480182d2216eed5548f3ce41328fb7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089491, "uuid": "683dc5ce-12e1-4e26-a864-124c1ce2714f", "value": "T1B4452386B7E98156E9FA6B7418FB07C30A7DBDA10D78430B768A5D081D73390B6713B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089491, "uuid": "790a8c65-5251-453b-8016-2f9594cfd3fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089491, "uuid": "1876f6c4-b1bf-4cce-bf3f-3f36827e7b08", "value": "24576:Xy7i1aK5L9mV+zy2ugrL4jfUVKTF919sbhpt+TH//cFfqAY:iu1hRE+zyJEUgKTF9pf/cFfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089491, "uuid": "59cb8b8f-2dbc-43d0-ac97-9a2ddf49431a", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089491, "uuid": "dba3792f-2d89-4d2d-9100-342ea81939f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089491, "uuid": "6cf64008-8418-4fbd-b948-f921848780dd", "value": "eeed49d3b75a71792b11ed9e714e0d9dd0730336811ca26f8ac9c742d548a15e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b58f19b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089492, "uuid": "ca75033f-d449-4727-a220-b9d0d4bf2efa", "comment": "Malware payload", "value": "4ed04d70366993fba35498b49054a028", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089492, "uuid": "725f6faf-427b-459c-8641-e21e1da0d223", "comment": "Malware payload", "value": "ef0ac9db32aa1366ae735a4ba9c95e9b457c46251574eb32a048eef7d03d3a79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089492, "uuid": "41185cb2-b9bc-4b2a-bff1-005b71bcc93f", "comment": "Malware payload", "value": "a5cc12c3fa52501748e63f360ff6ced11d4ddd82", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089492, "uuid": "98f5274d-93c0-4241-aafc-8a3a475a7b0f", "comment": "Malware payload", "value": "9df83d88da0f2ef812aa47bd717103a7828a5bda2ffc19bad46531c6b93f2fa682a061b194c3bc7d29d09042e1612cf2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089492, "uuid": "dff2db6d-c810-4535-895e-ff6ce5575378", "value": "T1E1452392AAE99163EDB917741CF903E31A30FD521D24533A2385DA8B4CE33C4E47976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089492, "uuid": "e7751ac7-4b42-4629-9da8-6ad22528c307", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089492, "uuid": "869e8286-b71d-4c0e-a90a-2354088ea146", "value": "24576:oyrzPkDaeg64MoEoqH1lA15fklKkQ0TokzrmK7/LMXv8c+YYJsFMju:vnM7oqmclKd0ToUp4/Qgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089492, "uuid": "338c3364-9640-4119-abc5-c7c55b3732fb", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089492, "uuid": "04a83cde-8768-4f24-bab9-10296fd30be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089492, "uuid": "28a4722a-5ad2-4dd4-87ac-288cbffbbbd8", "value": "ef0ac9db32aa1366ae735a4ba9c95e9b457c46251574eb32a048eef7d03d3a79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c296747-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089494, "uuid": "0ee254ca-d783-4f1c-898c-2e08ad74bdd8", "comment": "Malware payload", "value": "78bbec22b5b82c216be95ccb8a91a771", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089494, "uuid": "e3f22711-145c-4c59-993b-8f5e0a4af697", "comment": "Malware payload", "value": "ef193f0735293821d076bd2dc78c2260320d8a3d61b094b1e6494495cd77a990", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089494, "uuid": "1c3b8d0d-7c98-4d2d-881b-8a2a49a496c5", "comment": "Malware payload", "value": "99ba8a070d699ff437d35259dd5995cbefc8125c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089494, "uuid": "e27be002-53a9-4b89-97dd-632b305b57fb", "comment": "Malware payload", "value": "90d0129119f12422440b7ca08ddba04cfed70394170c929d179b36f04ee5236d4651b871dfd9d29c907c178aee648ba6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089494, "uuid": "602f5adb-9df0-4160-a4c9-bfef5435b08e", "value": "T17B45236333F581B2FCB1573015FE02831D36BCA188B9D7AFB64699581DB279A2870367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089494, "uuid": "a1597be1-a5ce-4d22-a457-7e818893e298", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089494, "uuid": "46ace0ba-48d8-4b83-a7ff-6edd614e9bb6", "value": "24576:6y8tCFqgLwa6qTPdRbp+fnBBKTw9X6+mnl+moKkpLq:B8tjoRDTPdYnx5snlcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089494, "uuid": "1c2748c5-0f14-4da6-9eef-3cad08c04b3b", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089494, "uuid": "c03bc295-125a-44cf-aada-416e786913a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089494, "uuid": "5bb13345-4268-4ffc-bbb1-95fbf00bddf1", "value": "ef193f0735293821d076bd2dc78c2260320d8a3d61b094b1e6494495cd77a990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ceca5ab-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089495, "uuid": "5454ed39-26b4-4d97-a613-f3ac0b42db4a", "comment": "Malware payload", "value": "cbdc87b2aececdc71b49131173d813e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089495, "uuid": "d28e27a7-e201-4d5a-a9b9-d88531632488", "comment": "Malware payload", "value": "ef228759f9b10a736e95b081efb9bfff544a99eac4ab59ba40b1d4ef435f95b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089495, "uuid": "348bdbc0-1f95-422f-b681-2f6c613c47ea", "comment": "Malware payload", "value": "b85c90e6af67ce42dbb1206e26adad0151823e65", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089495, "uuid": "0f719a21-5dff-4f76-95cf-37c7d9934749", "comment": "Malware payload", "value": "930ba1498dba3bb823c584336e0528546cf278d62245d2ef769d882cff081ac7989f701e02e6bb3d54c43f617c28ad4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089495, "uuid": "43e5792e-b9a7-4324-959a-e9d4043e85fc", "value": "T132452253BAE49432D8F52F752AE602970A32BCF4D87453676716A98B1D33BC4B07036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089495, "uuid": "4b912409-f243-4aaf-aeac-cc3cf92f76f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089495, "uuid": "050d6a25-4c14-445f-b6c3-5125498c97b5", "value": "24576:Sy9dxDcZ4i7NJZN6GRUmLt0sWHSfE7VWTBf8gbDeTZ/TlIdi4:5SZV7N7UGbtAlAhBm5RIdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089495, "uuid": "14234b96-d27d-4bcd-9cf8-a42300a7d1bd", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089495, "uuid": "2ad525c1-427c-4495-9132-19a21d128480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089495, "uuid": "be934841-c4d9-4892-b7a2-eeff80488d94", "value": "ef228759f9b10a736e95b081efb9bfff544a99eac4ab59ba40b1d4ef435f95b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9f2e71-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089496, "uuid": "808bbad8-1fd1-4e7d-90fe-3ec32fcabe62", "comment": "Malware payload", "value": "8647cf489772ee07ce5cf09158e72d53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089496, "uuid": "38c23861-72c9-4214-93dd-8cb585455091", "comment": "Malware payload", "value": "ef48c240d1a67e93969aba12340d03dfec37a2ba656e12cfd4951469ee23ed3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089496, "uuid": "f7d50225-04e5-46d0-9b22-352df96f3f42", "comment": "Malware payload", "value": "9dcb18f6bdd500dbc6c4523a1062f1bf15ca0503", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089496, "uuid": "896dc97f-12eb-45d3-a354-aaf5c89577e1", "comment": "Malware payload", "value": "89dae2d1258e5031dfc907517e57afdafe56c104d6b5be16d8f5e645d9dfed6204a0e6ea57bc7981611e485252d643ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089496, "uuid": "ef1b1eef-5184-4591-87d5-3615428c5f4a", "value": "T1FF452306A6E48875D8F52BB55CFB42470B3AFD91CC7443AB730598DF4CB26A0A5B1723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089496, "uuid": "4458d25b-b8cf-43ce-a36b-c1317384f2de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089496, "uuid": "884c9f15-17c1-4a58-bf40-3fa22a14d76b", "value": "24576:wyyUmkp2roJ885ttaG/oQdamG3n0ynyICg1VP4qIRw1Pw:3Zm5rgl8SdamGXbXzPzIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089496, "uuid": "9c23818d-5078-4479-8c4e-665e0ff2ff7a", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089496, "uuid": "faced8fc-985c-47c2-a9dc-75779d5c1586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089496, "uuid": "88db8402-edeb-4f22-9e45-0dafa4e65b70", "value": "ef48c240d1a67e93969aba12340d03dfec37a2ba656e12cfd4951469ee23ed3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4cc6fd-f23a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684056852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056852, "uuid": "eecb2050-3f08-428b-9ab3-867fe328def3", "comment": "Malware payload (Loki)", "value": "f5327ec3f2a409047f908e3b7cd0542d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056852, "uuid": "1c3a53a8-a3a1-4bfb-84ba-383dee81b711", "comment": "Malware payload (Loki)", "value": "ef5b1b236b415aa1d0c9b274ac2576ea0d9670b28ad93cfee6df4899d3d62b9e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056852, "uuid": "56ad722d-d486-466a-9d05-8776484cd25f", "comment": "Malware payload (Loki)", "value": "d1d25f35ca2135d9d63412fcbc6f48ce22875d53", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056852, "uuid": "bef6ee72-65a5-43f8-a01f-388647b59e12", "comment": "Malware payload (Loki)", "value": "1fec13623a7e93e069a0954fc06387ad88d6318fc9545fe1662e69d3dddd9f2bb03ec070733191643126bfd73ed9b6f2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056852, "uuid": "a8ddc443-236a-4cb8-ad9d-86d94a6229de", "value": "T1ECA412A1B2FACAE7F85E49F40428F544133171A7A1D5DAE48EB665C84EDBF001F04A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056852, "uuid": "2b0cbaa8-745e-4ce5-9522-ef9eabd8bbfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056852, "uuid": "cec51d2f-8344-4dfd-87ca-c3121f55c1b9", "value": "6144:QDuu9CiepX3QxqMPQ6xDPaEhQGq2Drm+/CQQjELo2MQTkbWKQCiH8+bqhDWyCPYW:lcKSd/xDPnhvPrViY5MXbOgxWvgSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056852, "uuid": "f73d7e2b-840a-451c-beea-227fb967484d", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056852, "uuid": "e98ea5cc-ad24-4e60-b5f1-2d4a7f20c675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056852, "uuid": "2fa8f1bd-ad40-45be-99b6-044265cc9997", "value": "ef5b1b236b415aa1d0c9b274ac2576ea0d9670b28ad93cfee6df4899d3d62b9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e591ae9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089497, "uuid": "37fcad95-3e5e-4588-8718-7232e8b6a784", "comment": "Malware payload", "value": "696f37430d297ff956096fda6291217f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089497, "uuid": "8c9d747c-aa5d-4401-b55b-9ad767ebee71", "comment": "Malware payload", "value": "ef881722687b1406044c9ad5ee909827acfee807053ccca2715436235339a67b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089497, "uuid": "bbd61d3c-0b79-405d-bfdd-21064c282c08", "comment": "Malware payload", "value": "a38235b707c0c608e286001381ac378ee3d93de4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089497, "uuid": "60f9f9b1-b39d-48cd-a20e-65f8044332be", "comment": "Malware payload", "value": "d1286b9d2b0c15739869b1b2a91202253a62e0d178f8dd468f3f5ef426604efe951700bcbac86ac0f97d69a9f6f1da2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089497, "uuid": "1aa38e0b-6c90-4b60-a20a-e7212ba0e2d0", "value": "T164452303AAE46866D9B16B30D8FA05C30F317CB05D79D1673312BD4A2CB3A84A1717BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089497, "uuid": "08b7f532-57bd-45ec-93ae-b9b42a5105f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089497, "uuid": "a407d588-6a6f-4d7c-bc11-3097a8b08225", "value": "24576:Jy8lxDMIHfcdPkX/HohD0doOFHi9bnkUHuad8E0MlFfYdDRM:88lCifceX/HNv89bxiMl6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089497, "uuid": "d8cd6bb4-24b2-4cdf-80c1-0249ac5309a3", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089497, "uuid": "1bcb1650-e272-46bd-9605-af50cff51ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089497, "uuid": "cfd7bfe9-1b53-467e-ac40-813d8cd10057", "value": "ef881722687b1406044c9ad5ee909827acfee807053ccca2715436235339a67b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800c88c5-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089500, "uuid": "42c57ddc-3eca-4bc9-a253-6f6c3b8175d1", "comment": "Malware payload", "value": "6b9aa9dd0245287bbd0998420529eeac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089500, "uuid": "b83dbb3b-87a5-4632-97df-f04cba005ce9", "comment": "Malware payload", "value": "f00cd3aff66b1999ab706c5dc67a1f22d402be0a5447c147167cb087c67dd0e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089500, "uuid": "bad58a40-ae11-43bc-8973-cee743f375f4", "comment": "Malware payload", "value": "cb21c6c32a451c30ebf57fbec8e4e972b650dba9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089500, "uuid": "2040485b-6cfc-4a85-b15b-a89b6fefdda5", "comment": "Malware payload", "value": "60b6fb7e97edde95122fd88ad9390344ff2bc34c92fdc2fbee336a4a46b2f6c7a03b846e05e94a41b82581d0780f1e21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089500, "uuid": "745ea261-810e-4971-9fa4-fd308ca32b7a", "value": "T176452343A7F44071D8F127B1A4F643830636BD519C3887A6634A6AAF2DF36C4B1B572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089500, "uuid": "5ab4c2db-e574-4caf-bd28-3e448acb6ca9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089500, "uuid": "ce865f21-76d3-4fd4-a69d-0c5873dd11da", "value": "24576:QyBqndfjUBk6rw48xJySLOgSn1RhKDHpPb+oLFHnELSDd+z:XBqduEPXjL3S1HKdj++VniG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089500, "uuid": "6e676465-0f86-47ec-b03d-9fdb59336f9e", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089500, "uuid": "a08ac9ee-f37f-4573-8c3e-ecb119f26325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089500, "uuid": "cb078be7-adfd-40e6-a18c-f85021788738", "value": "f00cd3aff66b1999ab706c5dc67a1f22d402be0a5447c147167cb087c67dd0e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bc012f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089501, "uuid": "56f7e664-5ed9-4912-8e82-1d19be46fa5c", "comment": "Malware payload", "value": "7351a6305b3afecd2305f1181aa0252f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089501, "uuid": "088c8b4c-b364-497e-8600-a6d84c5c234f", "comment": "Malware payload", "value": "f00ef46391f8c6228eac11439ab8020d8111bcde4944978eddc89952663125bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089501, "uuid": "3ce0845f-2d51-469f-b0db-d8f088247930", "comment": "Malware payload", "value": "0de84c97721129cd9d2d484c96e398c3a955aca5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089501, "uuid": "2c0f4a74-61aa-4695-b881-0946110965c8", "comment": "Malware payload", "value": "61f10259996850c1aaf7d6b0487b21dd23a50e67943fa8c16c0ca75807859a92b36374c810ce8e12c465d261c0213ee8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089501, "uuid": "fe5622cc-cbab-478f-9078-cbabd90f0ee1", "value": "T110452342F7D90023DAF657B018F317830E3FB9B26D7A825B67C899160EB26956132377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089501, "uuid": "6565caa2-3d9b-4d8c-9a05-ae2a5d9f7672", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089501, "uuid": "42f1fbf8-12cd-484d-809a-b60e7ba7415f", "value": "24576:hy0Dh6gG+v69UJI85QC9TGyc+WJQPPdEK2YNhaOHBZppP:UMA+iGI6Qok+1PlELWaeBZpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089501, "uuid": "979995d6-959a-448a-be2b-7545dd732bc9", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089501, "uuid": "b5cf4cb7-178d-430e-8025-85f33cb44b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089501, "uuid": "a265b6e1-64d5-404c-9e73-4a16d27368c1", "value": "f00ef46391f8c6228eac11439ab8020d8111bcde4944978eddc89952663125bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fd3d63-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089503, "uuid": "f5de18a4-1cc3-4bdf-a86c-94f870ccf670", "comment": "Malware payload", "value": "03b36c91d742d5fe3a1b2eecb98c580e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089503, "uuid": "adb3f296-228b-4dac-be9b-acd817f4064e", "comment": "Malware payload", "value": "f0caa5f0ebfec42a5dfcb413e807494783cba4ef35bc8497ba8aae25cc3dedcc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089503, "uuid": "43b1a138-8168-44c3-ab1c-1a3c33c939c2", "comment": "Malware payload", "value": "512eafd44d8d232b29740bdb4256147146247e12", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089503, "uuid": "b3d7ea88-ad36-4fca-95de-b37b09ae4b4c", "comment": "Malware payload", "value": "25909652318e3afeb6588dd7638c9744ce5c9d55c8ee52208fe93ddd8cad8c30dbfedf3d1ddadbf703794c72cac30d6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089503, "uuid": "e7e33981-e8cf-45a7-b2a1-cd89962b279e", "value": "T156452361E9D85472DCBA0BF09CF706C3163ABCA03974936B5743A98D0C73A99A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089503, "uuid": "06476f95-e820-4b81-a4a7-35d6abc11459", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089503, "uuid": "6f0c4162-02e9-4135-99ad-541c8b9c0521", "value": "24576:Dy1/z0shMMBH9pw540ruSp+V47S4hg7sVwQlQ0:W1b0Nsk1WMY7sVwaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089503, "uuid": "231d6b83-81c3-478b-95f6-5386bd43eba6", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089503, "uuid": "c6273bba-27c6-4aa1-bdce-0a28213e3c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089503, "uuid": "1c9e4a1c-9763-4197-9547-134faf0f4b41", "value": "f0caa5f0ebfec42a5dfcb413e807494783cba4ef35bc8497ba8aae25cc3dedcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a26e03-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089504, "uuid": "9b88e9cb-f245-4820-86be-8ad20901bae5", "comment": "Malware payload", "value": "67100b258e5aef5536ba532ba11eb244", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089504, "uuid": "36e4a529-e510-4b60-b567-92731f267024", "comment": "Malware payload", "value": "f0e194c2dc0bb9300aaf1f5db1d671ee425fe8900f822c3eae3a3cb5721fd2ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089504, "uuid": "e2cf5642-f034-476f-bb5e-284897114bd0", "comment": "Malware payload", "value": "76bdedf89a0b271c3df2c675a52d9fae04663c59", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089504, "uuid": "529a474f-4956-4816-bb39-1e3162f76ae4", "comment": "Malware payload", "value": "d20844b7f7a31e9c2a5f818ea9ee8a67f7ab9d63cdc99a4ae578d904c54d2c7d2a547833dc6bcf1dcaf252fc07a9fe41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089504, "uuid": "531b79d9-4511-40d9-8925-404d4bae4a56", "value": "T16F452301A7D15631FC761BB098FB07D30A317E930C79626A1A8A98879CB32C57B7173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089504, "uuid": "1095e3d2-1dad-4ce0-8f67-b78c0acbdb0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089504, "uuid": "50e18d0e-b4d4-4cdf-85d6-bf8e05025ae0", "value": "24576:pyDL9SEZ6Q5Uvo03lZwhbRcNQ/pqZ4r7HMtYmdezj8SvEZy8c:cDLYYFgD3lCh+6YZ4X8YmdeP8m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089504, "uuid": "66b03aff-713b-4839-8762-c12e29fc56ce", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089504, "uuid": "6957e931-7612-4adf-aaf8-3a157c9a727f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089504, "uuid": "da544227-776f-4b19-bcbe-014456010cde", "value": "f0e194c2dc0bb9300aaf1f5db1d671ee425fe8900f822c3eae3a3cb5721fd2ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83530ff4-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089506, "uuid": "0d547322-bdf4-4d04-a2cd-acc601ba20b0", "comment": "Malware payload", "value": "dc20e40b4bb633d94a688c9db185ec3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089506, "uuid": "8a090bd6-12c2-4e0e-8256-720948f17bf2", "comment": "Malware payload", "value": "f1631b0c9a90afbb49d809dd9790de0909ac68be2681f83fbe1fc97b19b7d6f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089506, "uuid": "342934b0-420c-4817-b232-754fe59689a9", "comment": "Malware payload", "value": "9fcffec90a0bdebca6f8f8cef20b6cb617b42faa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089506, "uuid": "76189315-2b2a-409d-aba0-ecca76471491", "comment": "Malware payload", "value": "1264962b06adf5cba3ef0d8e8059b43176b3daf4403f0a300eeacfbde9fda17a421ad77c014da3eb57b32f5119e3718b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089506, "uuid": "f176b9e9-7c75-4f6b-add1-ade5f41c354c", "value": "T167452311FBD851B2D9F01774A8FB13CB0D327D7259A6A29B63422C0D18B3296AC75B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089506, "uuid": "da08cfde-24cd-4be4-9ca3-e1ca9d88080a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089506, "uuid": "0cb0299d-d6b5-49ff-8e42-a3ec977360b7", "value": "24576:CySBmc+CjXo4p0qJIPypMpzoHSRvdBKvZc5ji1:pSMFCjXo4p0BPiMpCw/Kvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089506, "uuid": "d1f2b71c-78fc-44f6-b269-a6c4bb05df7a", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089506, "uuid": "bf29479b-355d-4390-9ee3-24a1fe6ff9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089506, "uuid": "1345ca01-c675-4270-b522-97e8c280988c", "value": "f1631b0c9a90afbb49d809dd9790de0909ac68be2681f83fbe1fc97b19b7d6f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb5889a-f257-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684069199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069199, "uuid": "5a274f4b-4843-4a46-b9ec-74c013fcf0c3", "comment": "Malware payload", "value": "92f954169c385e6e503a0ea9be64ddb6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069199, "uuid": "8f1e97ee-4945-4171-a1fa-9c07469f3459", "comment": "Malware payload", "value": "f1bc851839b4594f427c77340a1e388c651ff348ff1d08113cd45c4fcb4a6c38", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069199, "uuid": "f29cdfb7-68a1-49e0-926e-1264b9f33af0", "comment": "Malware payload", "value": "b4047a248aa27233c32bb06a7552072639055c15", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684069199, "uuid": "2818389b-0452-495e-a232-907e759b62b1", "comment": "Malware payload", "value": "4c386b671ae0e5f3c290064f7d486ccc21049001619fe820ca1d039db377ee80ef12522434978d98261038ed10fd61c0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684069199, "uuid": "a210c5a3-ec5e-450f-bf01-6548db27d921", "value": "T176C62325A387C622F15C037BF9E8FE0E1579BE63472001E7B6B4F9EE94B18C162B5542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684069199, "uuid": "916f53eb-6a9a-4ab8-9847-18bf583cc326", "value": "196608:MVlkttiDUZD0rBLaDoLirUoUG0zGEAP1LI5YC84ciHbqan8SooneY55f2Ad6T6OM:ykOYl0coGrUoUhCEAtuYSp8SoM5f2A8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684069199, "uuid": "131ed4c2-ba19-478f-94c3-87bcdccd6395", "value": 12503552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684069199, "uuid": "c9e50158-3ad9-4619-aaaf-c3688609fd52", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684069199, "uuid": "e02c4ca9-57dc-4d15-a4f2-b0a092e11639", "value": "ChatGPT4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8663223b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089511, "uuid": "0562af89-87db-46b2-96e4-a775e30b9728", "comment": "Malware payload", "value": "eb8bcf204f10a487255ebbfe15be7ba9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089511, "uuid": "3919d8cd-687c-4e65-8d94-11933a5f8359", "comment": "Malware payload", "value": "f1d089825a0eb3fa21a335c69d1e60c1a7338ae5cff7873c062d18c5a0d0d8f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089511, "uuid": "7e37c918-88bf-4654-ad88-6a367fde7cc5", "comment": "Malware payload", "value": "965ec0f345500c0ff5a816f5476a764d0f9c6ebb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089511, "uuid": "df26c199-792e-4636-a06f-6f07f4b8749d", "comment": "Malware payload", "value": "5f9aebaf62f2e4ddd8d6779c93d0a08f40b5c2546511a22f2bdd41fd18f5fecf7c5a919a036b9ba18b1a6db42183f097", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089511, "uuid": "0ddfb0cf-03ef-49dc-aac3-ca1685a914e4", "value": "T1EF16331393E36C11D62A8BB7DE1E86A4772FB1614F3A636A22489D1F19703B3C177718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089511, "uuid": "42530f8f-645f-436c-966f-cfab43f8eabb", "value": "ac4a5848781773145660cee839100e10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089511, "uuid": "c040e7e5-d5b8-4029-811a-795ad588ca5d", "value": "98304:Cv1HxGcWDZ1NwMxvIN1NPjkXH6TZQ96jrLtskahGrPiDp8:exxA1nvINzYatyISFwreC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089511, "uuid": "5c4d638c-98ec-4255-a7f7-1450328d0d97", "value": 4384120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089511, "uuid": "c0e66a83-319a-4e4e-9a79-8cd873ab7ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089511, "uuid": "b43cb76e-0bb6-43da-a09b-7fe58324aa40", "value": "f1d089825a0eb3fa21a335c69d1e60c1a7338ae5cff7873c062d18c5a0d0d8f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87227526-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089512, "uuid": "ff69fd2e-c47e-4cc8-979b-fd636ed57c5c", "comment": "Malware payload", "value": "4c21700cadf81f8350852d02fb96aacd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089512, "uuid": "194edb67-9458-4770-b77e-e306366e43ca", "comment": "Malware payload", "value": "f1e8b7dc7d3619e332d9fff0f8eb351296eca29e00b2d9f17b035f851fd26e6b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089512, "uuid": "13677388-cbd7-4cd8-9e12-bb06630d860a", "comment": "Malware payload", "value": "372f85f0dff8b41099503d827e14162cb2d96dc5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089512, "uuid": "2a074b00-afea-4da5-adef-d78554041f24", "comment": "Malware payload", "value": "48ff3fdba36ec8b25ceb5d6e4bc01fef530e72c09470813ae85164244d7729bbf5ebbfbb0214c887902183ee1a153cdc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089512, "uuid": "7c894690-3958-41f8-86c0-060c27b63c2f", "value": "T157452302A6E85172ECF513B068F703C30B39FCA29E7C835E2749551B9EB267865713A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089512, "uuid": "bd56b201-a1b8-45d7-b05c-5fdffc77cc50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089512, "uuid": "2b15fb42-6180-4c30-84c7-ef1764899f83", "value": "24576:NyGYo4e8I6DTUH89ivcEr3A7arK+lyPdZbaIvb/m0038aZZJQiz:oGqe8I6DTUiiEK4Q0SILm02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089512, "uuid": "04945c01-e6de-4ad2-8080-1644fa9cdcdc", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089512, "uuid": "84bc33c7-6d7d-444f-9d3b-b953873d5830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089512, "uuid": "6f4b79fa-9349-43fc-abf7-a36af22b08e9", "value": "f1e8b7dc7d3619e332d9fff0f8eb351296eca29e00b2d9f17b035f851fd26e6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88114e5f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089514, "uuid": "e7bb18cf-649f-4a58-be9c-2b5833cff6b9", "comment": "Malware payload (RedLineStealer)", "value": "02dc39fd6e9703f4f8517dedd91aee46", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089514, "uuid": "3e427511-3ae7-47eb-a616-e0e5636ea2c4", "comment": "Malware payload (RedLineStealer)", "value": "f1fadab2546031f3f602333352e6e12a44c9e41b156c2989ec6baec3a8fe0467", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089514, "uuid": "158f006a-b95f-48a7-b9de-c69545948eb4", "comment": "Malware payload (RedLineStealer)", "value": "39ad392e9ccaf4ec05e1e45fc666a276988fd684", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089514, "uuid": "5f2afd06-1db1-43b3-919d-ca8074531060", "comment": "Malware payload (RedLineStealer)", "value": "586b7b014e7d4385f19e13ab9c86c40ca64269528699647f84cab86c4bb4c7386a779ed3196494efb2ccedb14ee782ae", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089514, "uuid": "1f5686d8-d49a-4c06-b18d-de461f5404d3", "value": "T1C545231ADFDA6433E8E22B7428F747930B35BD624D34921F6A25995B0C732D1A13273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089514, "uuid": "3651734d-5920-49d1-b610-92e033a4b724", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089514, "uuid": "32f1f50f-21ae-4f90-a2df-ed34b1d749f1", "value": "24576:MyLw4j2Md2xAjKElg9O9Um/2FJ9I6dIEXOUoU/6Revs+GL:7Dj2CjKElg9O9U1F3DXOUyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089514, "uuid": "4f66488e-8fc8-442e-8ec6-36abd88b89fc", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089514, "uuid": "a4a45dfd-dc81-4b8c-9b3c-320bd810ad25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089514, "uuid": "bd8aabd0-0cd4-4af9-a468-23e87861a4e2", "value": "f1fadab2546031f3f602333352e6e12a44c9e41b156c2989ec6baec3a8fe0467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3557330f-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089804, "uuid": "76bf1d6a-3687-4804-8546-2109d6563713", "comment": "Malware payload", "value": "e918962c98d4d39ffe1632e29433c98f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089804, "uuid": "a0422fb5-0489-4cc7-8da8-1b16eb3afc9b", "comment": "Malware payload", "value": "f20a64541672d97ec70118b0c67818619dba66b6913c94b324507f5b801746f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089804, "uuid": "af6396b4-69a3-4483-9e4c-5c02eba51764", "comment": "Malware payload", "value": "d511aa3f823840e7ec903d810b133c22e717bc00", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089804, "uuid": "01b69aca-ee46-4fb7-838a-a5d94aa5ef14", "comment": "Malware payload", "value": "f4fb9adc6823c6e4b6bcc58cc227bfb484387357e6820c3f5aaf08d8b3e93fb722ca199909e553fa1c166272c4b3c58e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089804, "uuid": "1b9f3d4e-0371-4eb1-b79a-688fa0a6d9f2", "value": "T14B947E93A052CC30E16746FFA2445A678BB8FF2253467CF3839F8685DA57470962E372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089804, "uuid": "aedb3a91-f50b-46cf-8a21-3f9bb92ddb29", "value": "8a51c68b360795fa270153789c839dc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089804, "uuid": "81dd997c-7bfe-4432-b641-d5f8a5c9a704", "value": "6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8N:9/Cw6Z4nilhFX8mCXDckOPeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089804, "uuid": "f96d91b8-cd92-489f-a9c2-d62c185d6551", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089804, "uuid": "be49d001-0133-4404-ac5c-da2e718af84e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089804, "uuid": "fd94ec6d-e87b-40b0-ab04-1b43e151a00c", "value": "wekrjl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d95c2b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089515, "uuid": "b89d6af8-e498-4138-a9df-b52ec7e03c11", "comment": "Malware payload", "value": "b803b9878d0803beab03d9201fe07240", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089515, "uuid": "f6caae75-02a5-4f4e-b605-6c98f53ed8e4", "comment": "Malware payload", "value": "f20ffe6ad572ccb8c447086dc3971f6aac5532e084040eb135591189d2893623", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089515, "uuid": "fbf33036-6469-47ef-a65d-a27c59b08595", "comment": "Malware payload", "value": "9f061b89c7348c3889ee9bac04301ff764b448a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089515, "uuid": "d37bd3f6-2d88-41c6-85a9-d6819b5fe84d", "comment": "Malware payload", "value": "0caf95d42a56cc2b1129236f774cbe8d7e49585e62256a3d1397108edc22a526a81190f3676b39f476d40530a8c4e818", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089515, "uuid": "0bfdf8fc-a7d9-4381-ac81-2c31af658805", "value": "T1C5452313B9D98062F5B81BB4487346D31A3D3CA89CA9C39A2389D55728733C8E97573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089515, "uuid": "ddc63b69-61b7-4907-8e04-84e4c4f66caf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089515, "uuid": "9d4a8829-fba6-46af-9c40-f82dbf484a2c", "value": "24576:1yR73XBQQLEpoIIAuld3SXh39JX+dufboaycoOXunIvYeLjDGXX:QR73XYpoIIplWh39WujNcIvYeLWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089515, "uuid": "694e5172-0f12-4b4b-b4c0-886fac01ecdc", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089515, "uuid": "e4721abb-69c7-4eec-8bf0-3ddec6751919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089515, "uuid": "3ae1662a-5ae1-4038-a442-039788a07a53", "value": "f20ffe6ad572ccb8c447086dc3971f6aac5532e084040eb135591189d2893623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89970bf2-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089516, "uuid": "9a8e3660-71bf-43d6-954f-9462a4840139", "comment": "Malware payload", "value": "163983aa00cbc582b1c006fd6602e166", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089516, "uuid": "807ee648-90f8-428a-885f-fe50cf837d1e", "comment": "Malware payload", "value": "f2360d86438d486d292b61394b10ec6fb4859889a2a52a0f6648bf904415687c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089516, "uuid": "246c9777-a999-46db-ad5d-9734f64f71ae", "comment": "Malware payload", "value": "e89e261e22821bee05fcde2aaa4982888ad09e74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089516, "uuid": "14fb02b8-3347-41f3-b474-35b7366ce290", "comment": "Malware payload", "value": "63451345750a375eef60e5913dec1b0bbe898a93ed959a2d6ab20f26dbbb57c7c57528819d65e16ddabcf6168915f84c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089516, "uuid": "5a3b4717-b61a-4508-b3d0-be6640b5ecf8", "value": "T108452317F9F85633D8F66370A9F203830B367D9A69B4531F2B46A85A0CB2AD09135737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089516, "uuid": "d4071d0e-4433-4cfe-9e54-a742e93eb653", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089516, "uuid": "15871369-aa73-44ed-94b2-3ef56ff3c9f4", "value": "24576:By9cXkUOZUw8fk/1loN3ELeSz0074g3EC26s3I9I:0aTcUrkNloZE6b074pC2VI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089516, "uuid": "7d48fdd9-db61-4b6c-a421-9064389780e7", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089516, "uuid": "0c810c1a-8ed8-40b6-b424-436a1a96ff27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089516, "uuid": "bbf522e8-a1bf-4cfc-859e-4f048dd06392", "value": "f2360d86438d486d292b61394b10ec6fb4859889a2a52a0f6648bf904415687c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac1c2d5-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089518, "uuid": "1923b43d-a5fc-4cc8-8689-5cdeacd1351c", "comment": "Malware payload", "value": "f25435a51ec3b14d0b17dd3c16ed8443", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089518, "uuid": "9f6e4633-02e9-4fcf-a9cf-ce7acba70858", "comment": "Malware payload", "value": "f253afd3fe057085b30cb4cfd5c0a027a4bfebe58812279ac469a48fc57be139", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089518, "uuid": "6253edbf-ac07-4a46-9da2-10994e8fdc70", "comment": "Malware payload", "value": "a6c9920d1c8662c0dab591e4c976f5d2a6469103", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089518, "uuid": "5200e3c7-f59d-4f41-b066-f2370e626a59", "comment": "Malware payload", "value": "965384493c55dc8cdd1b85535aa0e00b7125071f2e805d5031774fbf8cfc888db537ba5d3b70bf1c9779d6b6cbbeffec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089518, "uuid": "3ff2e490-c816-4837-a4a9-7c8efbfb00cb", "value": "T1EC452313D3E80475DCF93B70A8FB424356397D609DE4C29A2787A65B4CB21E8B67231E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089518, "uuid": "45275c27-2bba-4d87-82c5-d4ba84c63c9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089518, "uuid": "148a4dfa-f5b0-4874-a11f-c9f63d023b2b", "value": "24576:kydmFcg6LjPAz4Oo8akUFOwexYn0OkkurEoMA38QVjSb+nFmRe0aG:zkFcg6LjPLrEUsrL/MApjoiie0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089518, "uuid": "409edd91-a96b-4a02-a0d7-6b71a30914ac", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089518, "uuid": "4a371a29-009d-4761-a993-3d35ed1fc24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089518, "uuid": "5a5fb624-9fa2-46da-a921-580f1f75e424", "value": "f253afd3fe057085b30cb4cfd5c0a027a4bfebe58812279ac469a48fc57be139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7e015e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089519, "uuid": "7229aa06-fb5c-4b69-8e7a-543d7567befe", "comment": "Malware payload", "value": "44b7f4e8b852d89c101a7d3e0606bb08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089519, "uuid": "447e2b62-5048-40f0-a981-e262e278bcbd", "comment": "Malware payload", "value": "f2a344483e0d55214184fa60ad1faf6d955e6b8b86fc030327fc0247b95c325c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089519, "uuid": "12a5cefc-faa5-4fdf-a9a1-2af8978c73e0", "comment": "Malware payload", "value": "77a718a672f7d1787048bf17c3ad031ece6cc098", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089519, "uuid": "f6b85fa6-045a-491e-9086-4900d98235f0", "comment": "Malware payload", "value": "e5e17e409ec7c28cbe208c8d8178eb243b0c07381a376a4ca6a65237f0e5be6b89360a438dff40d5d173ec7181f09d03", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089519, "uuid": "8f92b232-4fce-4c59-8194-fc7b3fa5ced2", "value": "T116452342F9D94153ED71177048F203C71E34BC92EA39D6B63B56B9097C726C9A8323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089519, "uuid": "636ba20c-45f9-4391-9b48-e262d9bac845", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089519, "uuid": "10ffa115-e913-4afe-876e-42b8f68b1a2e", "value": "24576:7y4BVAyBElkpv/3IAuBE5afICju2NyvJzBsPM4uSxAIWTRkt+9:u4TyWpv/YAaNfPZNyRzBsPzxaTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089519, "uuid": "34631b18-bc97-4a49-b895-753f3cabdad1", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089519, "uuid": "47755d87-5a8d-4f5c-8a62-25495047a18c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089519, "uuid": "be09abb4-1f77-4c6b-8e02-9b93364bbbce", "value": "f2a344483e0d55214184fa60ad1faf6d955e6b8b86fc030327fc0247b95c325c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4c110f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089521, "uuid": "8371bd57-8e98-4582-9f7f-5c228596a6ff", "comment": "Malware payload", "value": "501ea9669676ed72ed19f9fa79738e0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089521, "uuid": "b51cc72c-053a-4517-9f43-c2cf8bfddda7", "comment": "Malware payload", "value": "f2ce5991176a97cc5689dfb920c255b77de2e221d0f25ccecae5254a40a6d1fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089521, "uuid": "e7a7cfdb-931e-4ade-8c5e-d7640f0eef31", "comment": "Malware payload", "value": "5aea5bddb0fc0880a62d243e3d715b60fbe4e737", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089521, "uuid": "caca69f8-3647-4ac7-a314-4ad26d2e74f6", "comment": "Malware payload", "value": "be26f835d234ce3f87c771c9966820395baa8ce68754ba7ab0b05deba0c824e6228a4eb79cdd04e26b25fb13b0a639e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089521, "uuid": "7d9b1f43-2363-4046-a126-d3ad76514ad2", "value": "T1CC45235666E95033ECB62FB049FB02C3463DBDE24DB8856B2385284718768C5F9723B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089521, "uuid": "dcdfc39d-da41-4077-875c-b8622f62d743", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089521, "uuid": "a2e365a9-202e-423e-916c-4635b755a25e", "value": "24576:4yeivpfUpu0mqCS6JREqDYVVN4saG+F7G/F3Rn/vDAFZ:/ZpfUDvXy18VVTa7wLsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089521, "uuid": "b2ec1120-b701-4912-9b37-08e6b2cf5450", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089521, "uuid": "676218a9-5c9b-47ac-8b17-ccc5e79993bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089521, "uuid": "e7ee830f-2865-40de-9ddf-80ab2414b3f9", "value": "f2ce5991176a97cc5689dfb920c255b77de2e221d0f25ccecae5254a40a6d1fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d020f1d-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089522, "uuid": "f5b8bb43-a0fb-4518-a135-8df9740bb8f1", "comment": "Malware payload", "value": "489e00ba192a164afa8edf66be2d4e91", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089522, "uuid": "ac00c6d5-cf3a-4a07-aa80-184c280bed3f", "comment": "Malware payload", "value": "f2e921ff1657fbc43e5a88fbb99a8bc2dede1797f6421b825a82c1075ff00925", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089522, "uuid": "ac3d2971-e6c9-43ec-9ef2-0c963fa63301", "comment": "Malware payload", "value": "189b4d301d2f8259753283788b9e3cbf71ae4acc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089522, "uuid": "9f0da9e6-3bec-47b7-9d64-f58e84a3bdd7", "comment": "Malware payload", "value": "3349a0f29cfad1e229478dc4b410e23409daf3c4e6801d0cd1de10b31cd1aaf132aeecd081cbf167bc61d2c5c502e77a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089522, "uuid": "40224862-7178-4f90-96cb-55dc8596f83d", "value": "T108452312E6E99176DDF82B7098FA43930E39BC924C74829F334578661DB22C1A1747EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089522, "uuid": "85b6b120-1546-45cc-a237-34a70c53b957", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089522, "uuid": "e5624f6f-8b32-4f12-ab37-831774cceac6", "value": "24576:LySEEEvHAYIUm8bmS0T9cUyAUQHh7DBG884affSf:+JEEvHAtabG5y4HhDns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089522, "uuid": "847369da-7afb-4ce3-9582-43cd21c5cd17", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089522, "uuid": "5df4e6e5-6afa-4600-8b67-1944bbfb3f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089522, "uuid": "9d4a165e-3701-497e-ab5c-200f13a7af08", "value": "f2e921ff1657fbc43e5a88fbb99a8bc2dede1797f6421b825a82c1075ff00925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99983f9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089704, "uuid": "0950d33e-890a-47f8-a15a-194d500c40c5", "comment": "Malware payload", "value": "324f2892b6582135a4b775345587cc89", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089704, "uuid": "af9c8e12-fe4c-4f2e-9f74-c2a5419f1127", "comment": "Malware payload", "value": "f2e9466bd65d9460ac2344d8213d0c25afdbc228be7d357ecc115a8bd8201a22", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089704, "uuid": "3bf9468f-41cf-43a8-a3ed-29ef47419c04", "comment": "Malware payload", "value": "9b7f6daf918729d80f9171784cbdbbec0c03f755", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089704, "uuid": "fdac9214-3913-4867-ba18-a1550288079a", "comment": "Malware payload", "value": "abf632b23be4f4e21b6da765ceeb1e8a669c1416618553bde71011606909424615d05c246884b602593d9093d6620cfa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089704, "uuid": "42a06cbc-7817-47ae-a106-0f7d461f205c", "value": "T1FBF633B35E708372E4BA173E44418B32016DFD526726EA990394761F49B7AD0B83BF63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089704, "uuid": "ff2878f7-01f0-4bfe-b405-3d93ff513a53", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089704, "uuid": "b77d922d-86d3-4a14-bba2-2e45c4c7e20d", "value": "393216:SxAlnc1OAQIMgsiFiQa7SDDNW7jl7lZ/5auEE:Tlc1OAyiFiQaekJnQjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089704, "uuid": "08a65fc2-14eb-48b2-b14e-f9d3cbe2cc2e", "value": 16378215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089704, "uuid": "d244f905-b2cd-46fa-b891-07a79bb2e06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089704, "uuid": "69593ff8-23fb-43df-a2f5-9941e19bf2bd", "value": "StarryImageLogger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dba07dd-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089523, "uuid": "c2bce9d9-2c83-4cf3-a069-fde74b42fb10", "comment": "Malware payload", "value": "9745fd82760353ed7d3968a1d8455f0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089523, "uuid": "d9ea130e-c34a-4f6e-b383-4c3705001655", "comment": "Malware payload", "value": "f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089523, "uuid": "14265956-3496-41ca-9029-a7e837ffb993", "comment": "Malware payload", "value": "73bd45255c380fb5e8d3beb8542d326237cf74fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089523, "uuid": "eb733c24-1dd0-432f-95ae-9533bd28b3da", "comment": "Malware payload", "value": "b0e094d6212cf034e9d27e138c712a2ad47949a7873ea52a7fb7497c5be6cd3ef9d22ea5edf0341ba8714ce4f886488c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089523, "uuid": "68506e27-2470-49bd-8ad9-a9fb53b4303b", "value": "T1A0452302A3F5803AD5B9173054FB42C30B3BBCA18976837B264AA9475DE35C4B97277E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089523, "uuid": "34def2b2-5b5a-4afa-bc0b-b9492e95b936", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089523, "uuid": "506e5aa1-3069-43a4-8211-15c4e36991fb", "value": "24576:CydmUm5f/1zvdXD17l7rDRyIs5bgvZcX/QQ7TNF35Jpu:pdmUm5f/tFz1hnFhs5+WX/QQZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089523, "uuid": "416112e6-ae1a-4f42-b54f-d87d4aa1190b", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089523, "uuid": "148f5e6b-b0cf-44d5-9f5d-a51a2ba4f89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089523, "uuid": "d7dde817-44f1-4d67-a6bb-b84f6748034b", "value": "f300bcfb7c33e8650bc2aedf84c0a0749e08b20b8bf113b7df147b1b74e7b5a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5a2281-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089524, "uuid": "6feed59d-8988-4c4a-98e0-2a24e07b5771", "comment": "Malware payload", "value": "0661f018e533749e2000ed1b1ce7567e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089524, "uuid": "dd4d2209-5b97-4b35-aabc-70770d030953", "comment": "Malware payload", "value": "f3052d51a87302468969120c438441c758440d11e133cc84dd714c10eab3ba95", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089524, "uuid": "ce9acbc8-c862-4185-91f9-4d7ace481f44", "comment": "Malware payload", "value": "9802abda078b7571769c5b9af92a0b4973d8896d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089524, "uuid": "d9e3589b-457e-4f51-b78f-94c1de990b4d", "comment": "Malware payload", "value": "7cfa3c23ebbe07a6f1a0813f679b104bbd48c028773c38472dbde6b533724cc686ac9b58e590765af52906720d6194ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089524, "uuid": "034dc02a-d33b-4336-b1f7-4bfbb4df089a", "value": "T178152362C5D445B3DDB227B01AFB078B1F3ABCA48EB9835B365458254C32AD0AD3533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089524, "uuid": "7bcd0535-dcca-430d-880f-fad8c8f14304", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089524, "uuid": "c397b1f2-3e5a-4d8d-80ed-7580ca339136", "value": "12288:oMrqy90e1mQEqdnvZogZGmfYzndMP0Neh2AtnVEQJKQklqPxh94LEyxMHsM:iy11mQldbvYzdMcNoVryq7iLvCsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089524, "uuid": "ba6d0d06-80b6-457d-9fef-23b4cb8f9017", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089524, "uuid": "e5bcd775-386e-4d58-a73e-add1039ea36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089524, "uuid": "61e43b69-10a2-412d-ba20-a3e8815bfa8a", "value": "f3052d51a87302468969120c438441c758440d11e133cc84dd714c10eab3ba95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f011628-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089525, "uuid": "a109c149-ac66-419c-ba79-5ce313747aad", "comment": "Malware payload", "value": "dae72ae3e92d86b4aabc82c1591b6122", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089525, "uuid": "3ba0b193-5327-48cc-8c3d-b4c45e605de5", "comment": "Malware payload", "value": "f3233262acdb501e20a1febefd8a379d3a88b1c1ced7a1da36b56eef194c267a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089525, "uuid": "235f1602-2e24-4974-a4df-95cac06a5f29", "comment": "Malware payload", "value": "4c1345e442f1d62955d88935df07ce2602ae7294", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089525, "uuid": "4ee7fd8b-9413-4b23-94d3-f957d6957ee3", "comment": "Malware payload", "value": "7103140a9e15dca8f443205f6e2f53b0813948e0fbda9e22310ae465d857c9e938f97c94017d8dbfce460f8275f9ae32", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089525, "uuid": "1ebc239f-1f3b-4a2e-b628-3d3bd5720edf", "value": "T186452345F6F15533D8B013B0A8FA06D70B37BCB16D75C36F274AAD5E15B2180A86A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089525, "uuid": "589e4bed-9626-4e6e-b210-21b9b0a3e89b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089525, "uuid": "bc185202-841b-4682-bb01-5aa7be7fa6d2", "value": "24576:xyD52/jSS0DtbEyg9M/Sfg5CKM4Bis/PE5gUn0AA3pbsWPd:klNDdEyg9Peis/qg1lpbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089525, "uuid": "3c71ae17-a9fe-4116-bf0e-69dccc2c22b4", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089525, "uuid": "259efaf1-dc50-466c-afce-2b77ad72ab5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089525, "uuid": "23636f59-504b-4312-8e91-722e9c9ae274", "value": "f3233262acdb501e20a1febefd8a379d3a88b1c1ced7a1da36b56eef194c267a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8faed77f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089526, "uuid": "266da8c1-d4c2-4d7d-90a9-80720c878e34", "comment": "Malware payload", "value": "8b6c1849425085b0d306f6a9625126b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089526, "uuid": "db989926-c318-4999-b8f8-18fc5bc3918b", "comment": "Malware payload", "value": "f32ec25b32431ea3b1925883465f318e6c35803a81cbe7a7e1d7f351bdbfebfa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089526, "uuid": "34cc076b-2629-492b-80b2-529d7387575a", "comment": "Malware payload", "value": "e4c514946007457b67c59ba9e84230f380d59277", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089526, "uuid": "feac880c-3fb2-426e-98ca-7787094e9d59", "comment": "Malware payload", "value": "42b1879840237839214474b7c60efd059fa8759887ceb13e502b3da221353358e6da4fdf123a7d11be1507b463d85006", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089526, "uuid": "90b4bfdb-1823-4c7d-bf18-ee83eee6381e", "value": "T10445235372E4A0B3C8B0733614F6438306363DA25978876F37D9A96A0D736C1BA7136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089526, "uuid": "3ee2dc11-9331-4b3f-80bb-6bc71dcdff53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089526, "uuid": "c59346b9-c08d-471b-8c04-b0df9c574916", "value": "24576:TyH0i4JAIfALZgqU8KRi5rFjWjpbwpKC6e7yr85smQZXAtCfYbuoY6X:mH2aIfALZthdWjp0ECErmWZAQfYb7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089526, "uuid": "0179d06a-7709-4cc7-932a-50f9762a7248", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089526, "uuid": "d61ef416-d1a6-4234-8e60-cd975f9465e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089526, "uuid": "b539cc7e-082e-47bc-8a99-52e9741756de", "value": "f32ec25b32431ea3b1925883465f318e6c35803a81cbe7a7e1d7f351bdbfebfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905eb747-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089528, "uuid": "d9bcf05e-8d5c-4c85-80ba-6d42199c0e1c", "comment": "Malware payload", "value": "d660aeb2d972c8e854e9699fa5ce3c41", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089528, "uuid": "d4d65b3a-de9b-4f0d-8e84-78e784188fe8", "comment": "Malware payload", "value": "f34d4e905b825bc55b30979ac3b1e25645bd5b87fffba3760d869a55247aecb1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089528, "uuid": "d597ef7f-c3ea-483b-9de0-b797d9b01f85", "comment": "Malware payload", "value": "8e10b8a503de6ee01a59e22bc2a685a257c66c6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089528, "uuid": "bd8daaf2-a2be-47a0-a90a-7b7f313894ba", "comment": "Malware payload", "value": "ad7b3d40047a5c197d735db8ba1ef8f07b7a434bff1bf405a053711c56f4dca46a73f63a39bba7e6705a97b5c9cc5718", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089528, "uuid": "f9a0e001-6275-4a0e-8f7c-718574e17a06", "value": "T1DE452342E3D94132DCB67B7009F612832E39BDB1B67446A63356B84B1CB3684B57872F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089528, "uuid": "758e94db-b6dd-491d-a0aa-91344aa99b96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089528, "uuid": "97616065-295e-4313-b8b9-727ed4ba391b", "value": "24576:jysODbGQ5Nq2FfvHdu5Zy2qoXGA5zCrnJ9ljZr/AXYVJeq9WsM:27bfNq2FffTkyJh0SJ99p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089528, "uuid": "53dc63ba-8c2c-4a66-98a9-d3c4f162a591", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089528, "uuid": "3c779056-1e39-4a12-8071-444d003e8397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089528, "uuid": "cc6757ba-9b89-4929-8a82-6a2a6d8d2cbe", "value": "f34d4e905b825bc55b30979ac3b1e25645bd5b87fffba3760d869a55247aecb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91138191-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089529, "uuid": "6bcc8db2-67f8-41af-a917-33813d6715cf", "comment": "Malware payload", "value": "5bb28ab2c9ce275bce2c8185073a1201", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089529, "uuid": "347c63ff-bf61-4f6e-a8bf-ccc082cbcff5", "comment": "Malware payload", "value": "f35289be27eeb70e3ebd8346b268ee029c267d8578cfd8094e854f6aec904b62", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089529, "uuid": "4316b432-2c6c-4422-8061-03675762b348", "comment": "Malware payload", "value": "ee4fa76fc59b671d01969904df7ab11aa1a82b6c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089529, "uuid": "65b2fdfd-ca51-41fb-8468-d2ae0ffda1a6", "comment": "Malware payload", "value": "c9e4b7a0cb57c5bdb146d40200cb8e6a6117ab63b33176931ffb34558da7db7db3b0d8c2b2a1473f432af20353b4934c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089529, "uuid": "ddcd6ace-4515-4f0e-90f9-01852c5edf1a", "value": "T1CC452391E3CD9A32F4F81BB058F1038317797CA35C28512F2365685E1D62B99E079BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089529, "uuid": "164df9e4-253c-40e5-875e-250fb862f183", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089529, "uuid": "f5c9402e-db6a-453a-84c5-23a900982383", "value": "24576:MypbYFN2bOOWk5uPdWjruwBjtOMJsH9oaUotJg:7Z4NMOOW+UdWjrpZk9gob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089529, "uuid": "4ece6c3f-a2ea-4512-9910-2d338dd95762", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089529, "uuid": "86a2a5b7-6722-4b5f-b314-ee1ca2ab9981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089529, "uuid": "ba112d4a-9acb-4d49-b76e-287cf6a80668", "value": "f35289be27eeb70e3ebd8346b268ee029c267d8578cfd8094e854f6aec904b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4a81ae-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "d49a8bb4-e49f-473b-ab63-426fa47698ed", "comment": "Malware payload", "value": "bddedde7fb66a215bed784e26152e109", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "1778fff4-62e0-4588-ad99-861177d87b7b", "comment": "Malware payload", "value": "f3adf3aeae538a38bc31976f36ab143a4e578f5179bd77809e24b35481dd3ad1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "a5e2ec66-36cd-499c-a8ea-06258e40590a", "comment": "Malware payload", "value": "7f96a3d8f1dcea8767a642fd414931f7ea18dc4e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089819, "uuid": "a59ebb41-06f7-4f8f-bca9-e3212a045c81", "comment": "Malware payload", "value": "2aff2f0825b2575252504f8c8fb41c9e97be7e0b7e259510efb6e8a6b3710fde0de93c86d8dc8c108f6b81485e8c70ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089819, "uuid": "99e28100-b2bf-42da-a4bf-c02b1b21cedf", "value": "T1B924111E5CE0C16BC8D59AF11A319966DBFBB773C2A6207AC7B0A4683DF08C5D43944B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089819, "uuid": "f9d9dec0-8736-48fd-b4b5-342c276177b5", "value": "b66086d292264c93fc1688520e50a69a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089819, "uuid": "5eb88ac3-fc89-4c0f-8739-f7c91469f571", "value": "3072:wqgTxRat2QKlKzFnlbGiSvJFFxH2CA2bU+i+xz6FvXOYnjTu6sxUe5KcersugKC:wqKIVnSFZ9A2bUL4DqPRsxp5KcerHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089819, "uuid": "c23ac477-2e8c-46f7-9056-a66aad60dc13", "value": 226778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089819, "uuid": "06e9b1d5-7054-41cb-a57a-a2a59f26b7e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089819, "uuid": "9978f94e-5bfe-42d9-b612-4f0411b479b0", "value": "xor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d36e21-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089530, "uuid": "cd0606d3-af31-4719-be56-2a083ffca935", "comment": "Malware payload", "value": "76d8e9c06dba0e4ac1dd98c567e6f6d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089530, "uuid": "84e18dcd-8ce8-434b-8e3c-26b847fd29a7", "comment": "Malware payload", "value": "f3ce1ac2d2225fa12ebed9a46b1e8312f0d66f49ea140dbe96b22982ff3991c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089530, "uuid": "294b85b9-1a9d-4127-bd7a-29f1fc396ad7", "comment": "Malware payload", "value": "e8fa900d775e9b861cf8dfd1de55d2a403e8ef5a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089530, "uuid": "e4a780bb-c056-4085-8b01-1268b1f566b9", "comment": "Malware payload", "value": "543ef28d181df88312dd1ea784d4180cf2bb62d8a97ff2953d8871e0f9bd2d4b8a66645c7bdc422de14abc1950d00b0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089530, "uuid": "1dfc1255-94a7-456a-b789-dc5dd6245aab", "value": "T1AF452302EAD08035D8B46FF09CFA1383293ABC65A9356B17211BAD1B1DB32D5E531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089530, "uuid": "b97361dc-eed8-4d01-acda-562bad0ac713", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089530, "uuid": "ce9dbc8d-9da0-4179-8dd5-4af8cd2c35b7", "value": "24576:Dy9+3DFGJiBwNto8gEZ+UYQ3qwWUn0295WjW+SsWWsP8:WEhGhgEMRsmSsWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089530, "uuid": "5c434587-f6e3-41c6-b5be-f0dde7247f05", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089530, "uuid": "058960b2-045e-485e-b5b5-3ab87b0a4c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089530, "uuid": "c19026f2-f009-4f65-b221-78664fcb91c8", "value": "f3ce1ac2d2225fa12ebed9a46b1e8312f0d66f49ea140dbe96b22982ff3991c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9285155e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089531, "uuid": "130796fa-1bcc-4d4f-87b1-17526a378c78", "comment": "Malware payload", "value": "d786138d1e59523e4ecf6d165f51fed1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089531, "uuid": "1ab04095-2d98-49c3-89b9-33d081ef811d", "comment": "Malware payload", "value": "f3d6748b88f45598e4db85b3d2bd9c98532da20152703d50f74619354ab997ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089531, "uuid": "b2190795-1aef-481b-84da-8b7674642dbd", "comment": "Malware payload", "value": "58694c2ee18abee9c4787d8d555be5c59476f563", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089531, "uuid": "94e11296-e756-418e-95e9-1cd616a373dc", "comment": "Malware payload", "value": "0c16b6c82505c55cc81cdc15f88223c960aeb8e0abbec10289d5d044d4c7fd4f73b29f2ae98ff9dd12a2412293808464", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089531, "uuid": "345dcf2e-d912-4ac8-a640-8c0800adface", "value": "T128452316A2F55133E6BA1B706CF713D30E3EFC619578528E1348688A1C737D4A87A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089531, "uuid": "10d04c35-18ab-4ad4-bf01-91c0826f5af1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089531, "uuid": "fa66090f-83f7-4a88-acfe-7aa89ba18c77", "value": "24576:ny9uwJ8hp71Y4wL9yjQ4MRNI6OWT5+5Qo22bV8xOLhu1Ldn1kncvh:y9uS8DaLCQTRNov5oTx2uvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089531, "uuid": "5b9e0cae-f902-40db-a6ff-60f1cf414ff1", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089531, "uuid": "095b78ec-e450-47df-8ef6-a9b9f7e93072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089531, "uuid": "1896c808-57b4-42fe-a16c-2e9a2fc72ccd", "value": "f3d6748b88f45598e4db85b3d2bd9c98532da20152703d50f74619354ab997ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631817aa-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032758, "uuid": "bf9a9374-22ff-48a4-a3db-efc31f27d19c", "comment": "Malware payload (Mirai)", "value": "3605618380c12def2af7518dbc2f870c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032758, "uuid": "26c79902-ba90-4a87-9d7c-c321ecd23cca", "comment": "Malware payload (Mirai)", "value": "f41d06acb1b1df101001f37498efbfd4af532e40df38ce7bc3b3098a6e2946d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032758, "uuid": "8a0f96fd-cfed-4ed0-8d13-866706fa78f4", "comment": "Malware payload (Mirai)", "value": "5b241bd5e0f38edcefe6dbd8c6c1f797f0b2cb6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032758, "uuid": "510b62a3-ff45-4c69-87e3-b155ff1d3601", "comment": "Malware payload (Mirai)", "value": "712b2a6de2b830a75ae871134d29aa9360088564ac544f8cb3cb99b3634e552ca570669a71fdb85d8a1a9ff5a002104a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032758, "uuid": "c4855abe-f969-4e96-b3ed-d6d05856bff3", "value": "T1E582DF3061AB74E8DBE14030EAAE8EC6971A0BF9D0FC36D317596B78894610251FD3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032758, "uuid": "b3eb26d6-b04f-4195-990d-02c4586a49da", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMauhymdGUop5h5lJ:6/V0P6+kom0tVAoNvm+to1us3UoznlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032758, "uuid": "1bdface7-8274-4469-93f4-2081cfc0fceb", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032758, "uuid": "0d57140a-1f79-4866-9a9e-d04111b65bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032758, "uuid": "61a7e059-a572-4e24-8f4f-c7d419318428", "value": "3605618380c12def2af7518dbc2f870c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67354f15-f272-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684080869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080869, "uuid": "a8b568e1-26e8-49c9-9db9-e490da076cd1", "comment": "Malware payload (Amadey)", "value": "552743f735ce607724faa90aa4b5e226", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080869, "uuid": "ee13f964-a26b-4da4-8a8c-0fc33359ad52", "comment": "Malware payload (Amadey)", "value": "f42aac42d11a7e7b1cf7ad9da2f0bff821b601a116d460f8b826105cbb669750", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080869, "uuid": "8c5ce7b3-e149-4339-86c0-c9b93590415c", "comment": "Malware payload (Amadey)", "value": "16b98bf8dae18f9f844c0c0a6b854f2c378137ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684080869, "uuid": "aadb979f-e373-4639-aacc-a9c4289392f4", "comment": "Malware payload (Amadey)", "value": "2a8ac9a9956e553f1179c01e3bb43cd5cd1ca349ed71174810af45dfcd6a58cc215db8f08980c5d6333a2542f751ef6e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080869, "uuid": "0e62ae07-c20e-4c9d-9158-8d830b288e07", "value": "T1E0546D1392E27C95EA264B73BE2EC6E8362EF1504F5977AA12299E2F04701F1C573713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080869, "uuid": "c944835b-e023-47cb-8c25-6e5f95462dd9", "value": "ddc0830c620582399c875881de9a3455", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080869, "uuid": "aaa86a8c-cf6b-4ff6-a5bd-bdbb993d6485", "value": "6144:8H6FLIwhPP5kScVgGBUEyA1vBAXz4LCtckSI:8cMwhPBkDPBUEZRLhkSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684080869, "uuid": "7d9ab15a-f9ff-4b9b-a60d-e2f066ae15d0", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684080869, "uuid": "5f8392f5-f7db-4460-a7ee-b302abe37f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684080869, "uuid": "cfbd324c-21b3-4861-bd5d-f654238252dc", "value": "Unlock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93256745-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089532, "uuid": "227d0d87-72bf-4ec8-8521-58317c33efd4", "comment": "Malware payload", "value": "6671a8dcc1072a05a39baf2dcf1b43e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089532, "uuid": "f6415364-faa6-4287-adae-9112c42c43e3", "comment": "Malware payload", "value": "f4327bac27c659ef640dc68422aedc32211961aea2c6f700679bac0c1204b13b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089532, "uuid": "92986060-eadc-42cf-9d88-9b386b6554a2", "comment": "Malware payload", "value": "a6a001a5df84837c5dddbcffaaf747761b601033", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089532, "uuid": "35a18af9-988e-4910-8e00-118aab95f8e4", "comment": "Malware payload", "value": "772cf3ce9fed1dbe3b7aa46f142533547aec19c46f5e5aee18e11d46c14cdf5727be10cd651a38cf368e1dad51cceba3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089532, "uuid": "cee71683-ddd3-4201-a3f0-ef5191438fd5", "value": "T1EC152343ABC89062ECB66F7065F713A3063A7C52AD39439737554E6A0CF3690A931B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089532, "uuid": "34f6bee6-cfd2-4c71-95aa-9af3429d0e3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089532, "uuid": "78a5f42a-ec0e-4154-bc3c-06ec30dcc829", "value": "24576:9yghyFo7nw9TbdLXQQCbxcTMybTnKKlocm6K2C+17Eb:YJGM3dL4bxcTCKtm6KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089532, "uuid": "e5585804-b346-4024-b5d6-b2f8381d2618", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089532, "uuid": "d893de26-4db0-49b6-b9a2-f13c5df4672b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089532, "uuid": "4c38385a-0fec-44e1-81cd-7a70aecea2e4", "value": "f4327bac27c659ef640dc68422aedc32211961aea2c6f700679bac0c1204b13b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e093deb-f202-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032749, "uuid": "434e2fc2-47a4-44cb-af38-206d570c519c", "comment": "Malware payload (Mirai)", "value": "5c23d43e303b31eae11a14958d744297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032749, "uuid": "81e62d09-0deb-48bf-adf3-64808d845613", "comment": "Malware payload (Mirai)", "value": "f45d3b4ca237112526af4869ba7e621a646c9ca35b0fa53e8a2bdef5dbb01081", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032749, "uuid": "9eda7ff3-dccd-4704-8332-a14f5ee8f3cb", "comment": "Malware payload (Mirai)", "value": "50543a94cd73375f350d0251ecaf60d6f5af8df9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032749, "uuid": "881fe732-2d63-48b4-9e9c-158703b9b8c0", "comment": "Malware payload (Mirai)", "value": "0c4f6ca02cafb960853c70e414fa50d6139690feaefd528eccd08ffe8472b0139bfc3460a7f38617353eda2e1b839e1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032749, "uuid": "2a7145d6-a8c7-434a-adab-376a549b80c4", "value": "T14C336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032749, "uuid": "98e07878-a4bb-4f47-bd08-26ca4bd77153", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032749, "uuid": "c7ee8828-62a2-4c00-9b4c-5bb5ffb1d49e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032749, "uuid": "ac4c88a3-1fe4-4adb-8754-c3803d196c2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032749, "uuid": "47314c47-3255-4352-9566-071c6b49a8d7", "value": "5c23d43e303b31eae11a14958d744297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942874c6-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089534, "uuid": "b76e0931-4710-4064-b5fa-11b1fa27fc73", "comment": "Malware payload", "value": "e5f31174bbfa21397685093b997175db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089534, "uuid": "0a7e8549-4b3a-4bf9-b321-365f47bbefa9", "comment": "Malware payload", "value": "f46410bd3ec83b2ace4b1b04f009a3362263f546b5b37b428dcf5b59d9e22a53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089534, "uuid": "7db44ee0-8fe5-4485-bb6e-1ea62e7dc30c", "comment": "Malware payload", "value": "b18353304754b4a475ed6013dca811bb708e6eed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089534, "uuid": "49a8cc97-f809-47cc-889c-e2e257b29ae2", "comment": "Malware payload", "value": "428b5f5db2e1b272d9cea243dd32da2ca8186357d15f7471f0573910aad1d2b3701af2ff9caf09ad5a2de8afa7da474e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089534, "uuid": "6a1087b3-44f9-4605-9749-9fd95b570a54", "value": "T1034523139BD05872E5BA2B716CF607D70B3ABDA25D34922F52960D194D332E9E03337A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089534, "uuid": "157ce0fe-3dd0-44e8-86c6-75eee4090a31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089534, "uuid": "e8da8f66-3694-45d5-ae07-4e55cafe9bb4", "value": "24576:yyNdQi0c9iefWf/L8YmI6KIFDFLbrCwfFRjG0Y:Zz0c0Y8/L8YmfKoFGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089534, "uuid": "873987d2-217c-4e94-ac19-c1f5a324fe29", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089534, "uuid": "1af2c839-9281-47ca-8611-6befa39e26ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089534, "uuid": "b2b418b5-8231-4442-a6c3-d6f5e5ff056b", "value": "f46410bd3ec83b2ace4b1b04f009a3362263f546b5b37b428dcf5b59d9e22a53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d756c7-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089535, "uuid": "10bdf1d8-1aee-4042-a55f-cfe6d19d33bf", "comment": "Malware payload", "value": "8454f5d8b67bac2c3df0f41bce18b3f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089535, "uuid": "6bd5d742-4681-44bf-9342-3393761b99fc", "comment": "Malware payload", "value": "f4654ad71ec6e8a1cb7091beac169832d0d00599b9c036e884d831c2bb46f9b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089535, "uuid": "9514bdc2-18eb-421d-a6f4-3a33a8cc0248", "comment": "Malware payload", "value": "1b8ca3a02d93886b7fc24108f5a29bd7a0a9bb13", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089535, "uuid": "29737060-9f2a-4c25-9aca-f996d63a07ed", "comment": "Malware payload", "value": "263b5ee0fb6449639892109ab5ee518bbb1c8996aaf07c259d5863a7f022cb17c7d9a243aaf3f18753c2db292eaf608e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089535, "uuid": "8e6dcc18-0337-4e0f-b4bf-aed5af8f6fbc", "value": "T14145230399ED0172C8B227B419F793D706367CA1AD74977B570598AE49B33A2A03733B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089535, "uuid": "34730d6a-5211-4aea-9f85-77f2e3ddb23c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089535, "uuid": "1982a305-5379-441f-b2eb-9e743f675006", "value": "24576:MyDMRFhPg5/G64lMHtrkzuLjZXNSZmzj0/somZgS:7UiGnMNYUZXNbWiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089535, "uuid": "73da5cba-8bd6-44ad-a94f-2a785108db8f", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089535, "uuid": "ea0a9f72-ef05-44b9-88c2-b870fe23b6aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089535, "uuid": "0434161c-3eb8-4bd1-83f8-ec0a6c0fe994", "value": "f4654ad71ec6e8a1cb7091beac169832d0d00599b9c036e884d831c2bb46f9b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9588026a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089536, "uuid": "5a11c67f-d1b9-41d7-921d-c8012e3f6cf5", "comment": "Malware payload", "value": "49ec0d0a1eb33939b5beabd5f6160a59", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089536, "uuid": "382a6f23-ed69-4212-bda1-e77ca16768f1", "comment": "Malware payload", "value": "f4798c9414a0969c5105a32d5d09a2a76a45e9b4c883e0e04ed1bcfbff3aebea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089536, "uuid": "f653df6f-f901-482d-9ed1-2ac1d11b9209", "comment": "Malware payload", "value": "836837cfacb38afe1ca9673cad5d4ef974579c13", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089536, "uuid": "2d67ea3a-066c-450f-90a7-0488010a0e6d", "comment": "Malware payload", "value": "623f528a769b75917e75d2415f97426fd334464d6e7103af3c85019ccb72c0bf5fe062ace1c84d433452a473de1f8c0a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089536, "uuid": "641853dd-df35-468d-8165-9fdfb3732ef0", "value": "T14C452303AAD88133CCF107B458F653831F36FD9265B97267179199AF0AB36D09136B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089536, "uuid": "71f35aab-cefa-4773-b6c7-e9b9d821850c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089536, "uuid": "6f81abbf-f84c-4167-81fb-abb81c7ed97d", "value": "24576:mylWrdBKQZSz8z4aw7QjZtU8C8YrpFc9ZhRUJdZoUped3uh:1crOQzEuLUSYrpFENsroLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089536, "uuid": "dcda4f6c-4038-47fc-b6ae-dd14ed0650d3", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089536, "uuid": "d2909a4a-f588-4721-b261-89de41eea3f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089536, "uuid": "3da3e3c1-93d4-42ad-9310-58068975cfaa", "value": "f4798c9414a0969c5105a32d5d09a2a76a45e9b4c883e0e04ed1bcfbff3aebea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de751943-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684058305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058305, "uuid": "9f0a0790-2ad3-4ba9-ac39-7b50460e3ef0", "comment": "Malware payload (Formbook)", "value": "dae31008c7fe1c45abc590bdeb9ac151", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058305, "uuid": "07b8e2b0-0728-4fd7-8691-10156ac4e0f2", "comment": "Malware payload (Formbook)", "value": "f4afad610ada8c98e0e1bf3907d6ae1b3ffe56d2060df106d9336aac195a5e31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058305, "uuid": "e61240c5-beb0-4c49-b3cc-d58e44a989a4", "comment": "Malware payload (Formbook)", "value": "99d0ba7ea571144853eca2e5dfdb390ba4062e97", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058305, "uuid": "708c41e7-67a0-4d1d-a51c-daa89bfb51a9", "comment": "Malware payload (Formbook)", "value": "4c7235fac3c0a06be2ab157595edbadc9db22733dd7c2a3a9bbd42410ba7f9e435e22cf94504dafc4ed29d15c4df8677", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058305, "uuid": "19669b3a-d791-4dbb-b200-e40eee7401ea", "value": "T1A36412512269C0F3E8730A710E3C06A6D9E6D92508A5AA972FF07FAC3C35552D63E733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058305, "uuid": "ad7790cc-19b6-4a71-b20a-5ba023ffe250", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058305, "uuid": "56e1e991-064b-4a19-b06e-44a05100ec0a", "value": "6144:PYa6uY8OmDIIJ+5Zlietjh89ExSjF1FaJNHefy2a6gwSYdmN2Rwl1IUVJNJ5xkyC:PY4Y81KxjHVOGr+6pwSY0N2LkJnkyC9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058305, "uuid": "5be61987-fda2-44b6-a9ac-a04a3a5ea2f3", "value": 308905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058305, "uuid": "597324d3-af8e-4f59-9219-dd94a6830a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058305, "uuid": "cbbbd380-dcf7-49c8-bd3a-718ecfffc3a1", "value": "f4afad610ada8c98e0e1bf3907d6ae1b3ffe56d2060df106d9336aac195a5e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96afd45d-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089538, "uuid": "a2ab9f71-0448-46f0-b543-45ed24bf45c8", "comment": "Malware payload", "value": "5f10f8b0afc7fce2da8e6a533fdbe5db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089538, "uuid": "01083556-23dc-4711-b8c5-6b574d6ea8ef", "comment": "Malware payload", "value": "f4cb25e5fca0b35560779a70ac112d876732ba699d5a6b98d92597f949d08d8d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089538, "uuid": "ec52b3ae-a64a-40f0-a271-0d094fa4f53e", "comment": "Malware payload", "value": "f212bfe79718ba4a33326975b846bc23599cdd1b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089538, "uuid": "f18e6c96-13c1-479e-ab68-b0ab487826f0", "comment": "Malware payload", "value": "0640e3d2d0d6e256b0f2e394929b3ecb108f82ad58e9694077c9a2c8f6635d98aa6ecd71c25290d93d8d618ced9af1f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089538, "uuid": "453038de-32e9-4d32-bfce-ecc4f4ead159", "value": "T153452326F7D48470D8BA3BB058F652830939BC706D38532FB6426E5A5CB3BD06571B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089538, "uuid": "6420eb59-69e4-465c-ba32-f9e31f2dc3dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089538, "uuid": "de4e0e4f-988c-4d66-80a0-1cd980998755", "value": "24576:OynDd2ts7dRfZqswEME/0rizf1xbhPORiPKW0ZJ1h0Y:dn5VrxDJ/0rixxbdOY4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089538, "uuid": "52aae90f-1cf7-43a7-a7a8-49a9ca0b6e59", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089538, "uuid": "fb8c8793-120c-4683-8d83-362eb3ec6e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089538, "uuid": "40421c46-ebfe-4ee3-9c45-cd84519a149f", "value": "f4cb25e5fca0b35560779a70ac112d876732ba699d5a6b98d92597f949d08d8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98184526-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089540, "uuid": "2ba068d3-7fa0-4189-aef0-e9f6b34f6d43", "comment": "Malware payload", "value": "dd5aa94b932e61cb200bb6b2cb9d4d73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089540, "uuid": "485a9ef5-aacb-42ed-919d-db5730f9828b", "comment": "Malware payload", "value": "f51878167ae4cd958467b28db0abf66b2c021447bfd76a6ca629be87d0598040", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089540, "uuid": "682100fb-422c-4198-bb98-0c69e4562866", "comment": "Malware payload", "value": "b6eded9dcf794b5c68fefb1a751f0d9105a2460b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089540, "uuid": "e36d4b46-289f-44df-b9e8-d48a570f64c8", "comment": "Malware payload", "value": "a64394fb7da33b48d98e5b04ea7763bcd1bf98da427edf884de0ef2b11d1020383d6a46576a867422ae7128c61d1488b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089540, "uuid": "8af278ef-6200-46c8-9307-4e45e590240b", "value": "T12B452302B9E85172D4FA17B06DFB16930732B8626C79E31333DBAD4E08B22D5A47175E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089540, "uuid": "e5510dfc-137f-4f4e-8243-8351cb98da9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089540, "uuid": "7cad4979-4340-40ed-8db2-067f1a4b4984", "value": "24576:Py/12hW3rJ6OuRFRFiELVhF2eGAd0IJOty8QlIbN6g:a9uW3F6Ou7RgELkrbtynK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089540, "uuid": "7ca5a6d5-4613-4a2c-b942-d53da2b68fb7", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089540, "uuid": "69c52604-577c-4c80-8867-7d5511936c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089540, "uuid": "ec600357-e1ef-4eb7-9dc4-03c3b0d46928", "value": "f51878167ae4cd958467b28db0abf66b2c021447bfd76a6ca629be87d0598040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f3b3ba-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089544, "uuid": "ff8733c1-d335-46f4-90dd-9418e9f6f4c0", "comment": "Malware payload", "value": "9f806ea426470da5ee1082a9fdc61371", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089544, "uuid": "38b501df-fdb9-488a-9ce9-e68f575a5ed6", "comment": "Malware payload", "value": "f57308a3d0a09d0da95d9055ec76e3dced8292b47fcd41fef237ebf7c1ad5f03", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089544, "uuid": "21bef495-69f0-490a-8ef4-5748e9688f01", "comment": "Malware payload", "value": "7e025e21d445be9b6b12a9181ada4bab3db5819c", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089544, "uuid": "bb9864bf-bc51-468f-9c03-d39a9b394f11", "comment": "Malware payload", "value": "a7391f50ec9b9cc5e3e5580320c1b96d7c5113ca55eb9982acd0dd29f54dcef9f6a13b4acec6d88a2087875f39a85b45", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089544, "uuid": "ea799aa9-1e33-40e3-88d3-a3c4faff3bb2", "value": "T10345C081F7C8EC2FCD77803A4BB64BBA11464D6AC546DA938561B23C49BB9C05F85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089544, "uuid": "8da1192c-3c29-4fab-b2b7-ca052bc45fa5", "value": "24576:gDHNCpzZcoydWZolkSf4ekHmaRkiMJf4emfNGFnsgvYTohERacZJ:WGZZc3kSSfRjMJkU+gvYkhE0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089544, "uuid": "9333a497-b3ff-4c2e-8e00-481c4c5310b9", "value": 1244121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089544, "uuid": "fabb0fe5-368d-4a4e-8e9a-dc4b0acd20eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089544, "uuid": "0137c581-d8d7-4e32-9b45-c15fca45d571", "value": "f57308a3d0a09d0da95d9055ec76e3dced8292b47fcd41fef237ebf7c1ad5f03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9e96d9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089545, "uuid": "29de512f-161c-4a7d-87e7-17ce5e5514a8", "comment": "Malware payload (RedLineStealer)", "value": "ce0eab859ec8273d2f1d118656784422", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089545, "uuid": "e7f08158-d89c-4a38-ad81-24efd78edc0c", "comment": "Malware payload (RedLineStealer)", "value": "f57886bdb2d832b23b39faa314053baaae8e9f12cfc1e4b32a61173dfeda1149", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089545, "uuid": "95d98086-e33d-4136-9458-2701d08ab1e6", "comment": "Malware payload (RedLineStealer)", "value": "6678628116ca10109126ce00331d76cf4a9f676c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089545, "uuid": "38e73e76-e863-4e57-8fdf-69ca9e35550e", "comment": "Malware payload (RedLineStealer)", "value": "57f288fde43fd590d7a82cfe7ff9097498a7095e8a5f5b920184e70cf3b2f34f3a4e7a9c9a8054564ed7d2136050bbb3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089545, "uuid": "e8f6a0c6-8101-4f29-9f06-313c4e7e0686", "value": "T1C8152263A6E88173EC711B710CF3139717353DA20E7483A7270E9C990D73691A972BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089545, "uuid": "7658fbf3-e3f7-4eee-9b45-037de8fe66a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089545, "uuid": "0c07bd6a-eb42-43ee-ad53-c09bf17c1fdd", "value": "12288:nMrky90wa11JJmuNraXS6HG1yskS1PulUoRhPFMRqd1PbaIJubhrdiuBLMegZoFa:fyaJhVwsk4WxSu9aIM9rd3qegbgLvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089545, "uuid": "072a8ec3-ea3b-4c89-9515-1b5f5434fbbd", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089545, "uuid": "96e23474-0e1b-4aac-b20f-983023ccb0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089545, "uuid": "deb7f5c9-394c-42b1-b077-117fdd37acc2", "value": "f57886bdb2d832b23b39faa314053baaae8e9f12cfc1e4b32a61173dfeda1149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3565a9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089546, "uuid": "18de5a5a-5346-451d-84ab-5ae94da1ae05", "comment": "Malware payload", "value": "68fd48edc95e26bcad2915e3488e2dc1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089546, "uuid": "0d3a3fef-d862-477d-abd7-7f98627e75ea", "comment": "Malware payload", "value": "f58b8c83ce4e438d8b31f288aa5d1e4d67e6423b78923fc03702356958177203", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089546, "uuid": "a42240b6-e37d-44ea-9864-e68bf72aa7bd", "comment": "Malware payload", "value": "30630c48703b1c4253adb81b4bb7c9ed9fa680de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089546, "uuid": "256fa637-07ec-49ed-b06b-4590a6342063", "comment": "Malware payload", "value": "697884cb2f321bba85e10223807d516fa1e86b15239cef7ef5e89793cffd443c0ec8f9b5d7553d3d8cc8413496001196", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089546, "uuid": "d2b85156-07cf-43bf-8dba-9cddf5e90d37", "value": "T1B8F41202F7D885B3C9F9177019F607830A3BBCB26968465B3386AD5E4D72585B83733A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089546, "uuid": "833c9752-39e5-4cb2-9049-0554572a775b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089546, "uuid": "a072d034-325d-4a02-adc1-70178e15cc5f", "value": "12288:PMr5y90KfCUCL0/jXsjRZuc2FZZTo3KIP0KTO/eatpMNQ4QLKHuuRFvH3OdZoJgB:2yjfCUCA/j8dwdZ03pS/eat/4QwmgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089546, "uuid": "8bb3a538-a7d1-4aaf-a670-864d141139a4", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089546, "uuid": "fabaa09d-5c3e-4c4d-acb6-275a6c62506d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089546, "uuid": "37fd8938-3cfa-4f0e-9811-557ed4f126e4", "value": "f58b8c83ce4e438d8b31f288aa5d1e4d67e6423b78923fc03702356958177203.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10092af3-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089742, "uuid": "38244cab-eb90-4fdc-96f0-e519922a1f8b", "comment": "Malware payload", "value": "ca7adfa04989b2cd26442e1a06d9b02d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089742, "uuid": "940ac59d-5b16-44f6-a245-e03369e79d1f", "comment": "Malware payload", "value": "f5ae4307eef9f5b37d75daa82cf3fd6268efafbf957818b3168ce8cbf2e9fe70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089742, "uuid": "358eda2b-4135-47e0-8f07-dd9d465784cf", "comment": "Malware payload", "value": "2109caa89b58dbbf5c20aaac2d149868b0694271", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089742, "uuid": "340a8659-45d2-4f7e-a56d-e5eb33091457", "comment": "Malware payload", "value": "adb75521cbc63933df4b693483c6f172c5951cb6a4cffed0addc448ee7a03b4884e66cb984a04ad5cac07d2ab7d3b85e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089742, "uuid": "bba09cea-78b5-4a13-904d-c62a1b67bde1", "value": "T1AB1475C84F2169654B1B7D727720B4B9EBA90EB4C2D4869FE46B32B1F2CED4CD9D0910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089742, "uuid": "fb54dbc1-ca1c-469b-88a4-e7cca2db1c74", "value": "3072:v2rZgp0rAA6x0WN1xKPeWlkIbnzSMPHjOtb:u1M0rT6xnN1fWhzSMPHji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089742, "uuid": "3e8fc9fd-986c-433f-b1a6-3b57fa0871f2", "value": 201941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089742, "uuid": "4cadbae4-5494-427a-b7cc-f2f1917e6563", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089742, "uuid": "ebda8ad9-91c5-47d3-9fc7-01d86fd92ca3", "value": "Toefq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be36d08-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089547, "uuid": "7a9006e6-aa86-4c78-9e31-9459f45650d7", "comment": "Malware payload", "value": "6c169327fc7d25d4a7050f8a9a1da6af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089547, "uuid": "8d435b92-08be-43dd-8be8-365abfd5d7bc", "comment": "Malware payload", "value": "f5b29a0afd7e548d6b33c1432197a65fc1a5adf88a624a8359a045fdb864f272", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089547, "uuid": "aca2faf8-82b2-4ed9-b6ff-1a87c317df8f", "comment": "Malware payload", "value": "c4a4125f0479bd8956475d69fcb9a47fd7422cd7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089547, "uuid": "7201b716-b1e0-4d51-b933-4f0ae2401f5a", "comment": "Malware payload", "value": "70169084e84a58f5bc890e54b7e021933e0671dce7031a724f3696a83ad2210e0988771b407563c2b8ec9630bded0cd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089547, "uuid": "18636616-9466-446a-bb0e-87f237c74a60", "value": "T17F452302B6C44676ECB66B70A9F610CB4F3FBDE45C78031B2694E9291D73688A0717B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089547, "uuid": "4dfe9e43-cc3f-41c5-b3ca-a0d3419c69d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089547, "uuid": "076a0b53-ece8-4af5-a774-80d185f50323", "value": "24576:qyYm+wZU76Ls/DKwjmEXiId5Y3zatSf08wI5QkzQ:xiwC76Ls/DKWmyBmatI5Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089547, "uuid": "68dbb2d9-e761-4de6-9dce-7a429b1e3221", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089547, "uuid": "de96684a-65e4-4d00-b5da-c7730bc9b896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089547, "uuid": "1cb77a13-c9fe-4c98-96ae-380915ed8a42", "value": "f5b29a0afd7e548d6b33c1432197a65fc1a5adf88a624a8359a045fdb864f272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9dc584-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089548, "uuid": "e1e4317e-a9a9-4c2d-b891-3174c87979a1", "comment": "Malware payload", "value": "84601e32b1dab0f26be65dcbf77eb83f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089548, "uuid": "5a4a0304-c9e4-409f-9219-d0d56a430a2b", "comment": "Malware payload", "value": "f5f767b10bea1836a54b9874efe5069dd8bd004a4827246fc0c38e460d3eb89c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089548, "uuid": "22590bdc-2abb-436b-950d-5eaf2dabe6ac", "comment": "Malware payload", "value": "06b60e316d6408b9aeaa11f0ed8d2f7beaf854a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089548, "uuid": "28f86054-1e83-4deb-b7e1-6f0d07005b3f", "comment": "Malware payload", "value": "81099a4df52a54bb8be84c75192989409cf2feb1d76fa4c1ca12a8a100ecca8f3b281cd59115d77bdae09279a1af4d0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089548, "uuid": "c5332ea6-1c62-4e97-998d-5dc07bd64b95", "value": "T1AD45234BB7D64471D8F25BB098F644C71239FAE15EB4D35B73A6981D0CB28A0B43632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089548, "uuid": "43ba1687-ac18-4a81-bb0d-fd4071c35bcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089548, "uuid": "f9dc2215-708e-4cd4-a7ed-3c0088e45ff5", "value": "24576:sypSk/AI3b1ZfE27B3yKDDB9biiIEdEfPIYiP+Wjc5zOeRP:bpCILrfE27BCWDEXniSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089548, "uuid": "721f257f-0215-4f3e-8a71-234a15905bf8", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089548, "uuid": "a2e7c8fa-ba91-45ca-b60f-89a1658ee8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089548, "uuid": "ca03c607-2958-41f4-927b-a76dbf8e1ca3", "value": "f5f767b10bea1836a54b9874efe5069dd8bd004a4827246fc0c38e460d3eb89c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115744b9-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089744, "uuid": "7b2327c5-5109-4b09-91dc-1c5ddf1f6123", "comment": "Malware payload", "value": "ecbbce17053d6eaf9bf9cb7c71d0af8d", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089744, "uuid": "eec79242-4b11-4ccd-82b4-0451a2bd5212", "comment": "Malware payload", "value": "f6239ba0487ffcf4d09255dba781440d2600d3c509e66018e6a5724912df34a9", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089744, "uuid": "8cc570da-c0b8-4b06-b405-a56440aabfa2", "comment": "Malware payload", "value": "c9368c3edbcfa0bf443e060f093c300796b14673", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089744, "uuid": "ee577dfb-cd67-4f31-8428-6273c73a0ef7", "comment": "Malware payload", "value": "eff38bdd1e00eae16b6343b427ddd6d61594abdb3c7ee29e6d6f75fad159c2c7be0fde2874ca06b3b929c6eb9b06a793", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089744, "uuid": "c980b1a0-05df-486e-a40b-b91732581556", "value": "T1E1928F96A788A316F2AFD17587760440E919368714B1E26DD2E1093F1F232E44FBE17B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089744, "uuid": "e56883ed-d7e5-443a-b91d-6ef2c8a8d651", "value": "384:qlQz+brNJCFrNJCsrNJCqdVvvCLlxLsdCi:QQKbhIFhIshIqKHLsdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089744, "uuid": "ee4d49a4-40a9-491b-a63b-c20b1c08e5bb", "value": 19865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089744, "uuid": "a4de9295-fc2d-44eb-930a-2f3afad8398a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089744, "uuid": "760019ad-c89a-43eb-bb8b-75e3d4972d66", "value": "TrustMobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35b05c9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089586, "uuid": "71af4e33-3e7f-4483-8b73-79cda442576e", "comment": "Malware payload", "value": "264de68937b7ccd7db8eeaadc23f6433", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089586, "uuid": "794de254-e410-4998-80f8-a98c15bcb9b9", "comment": "Malware payload", "value": "f62815bf74f5782056c0f5e2e5c410cd272707cc86f76ee499774e7a634095d4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089586, "uuid": "a6b86b3e-0164-47b7-b253-5901fd43b841", "comment": "Malware payload", "value": "a75e011326a862298ca34943a47d597dbba8195a", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089586, "uuid": "dc2a2c2d-903f-4bdf-981f-a2574edbdf0c", "comment": "Malware payload", "value": "52fd01627b5d165702d4bd5c7b0208d936eb3f46a5a8fc6f7beca4f9a35c2c6fedab949d6764bce7366a64e499f5dc1c", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089586, "uuid": "81b778f1-9303-4d7f-867e-e1dbf69cab10", "value": "T1212423A77756C19EF55BB63782210402E62BC45EBF09DA29B85BDC6D0BCBFD0628D10C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089586, "uuid": "d290e9ef-5d6e-43a3-9a33-e3a02655f6ec", "value": "3072:BXvkVdcxlwlzukmxxM0HYiM/wKuIuGvOTnH+6UZMMf9IdjofXNdX507tucN+T:BcVdRzzKxMj/wUHOTne5hpBcNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089586, "uuid": "4ee4e205-fd5f-424b-affb-7b7f52aaa775", "value": 229818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089586, "uuid": "041506f1-98df-48b3-a82e-5e8cd40c3fd8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089586, "uuid": "409cb812-362d-4d1e-a535-f07768c829fa", "value": "FakeBank.B.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9daacfa9-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089550, "uuid": "ee83057d-bb90-4126-82c7-d5c48ffe6301", "comment": "Malware payload", "value": "27f6a420825eb778525b492c814b7f6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089550, "uuid": "6f117ec8-38a1-495f-8227-e4e45fb0534f", "comment": "Malware payload", "value": "f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089550, "uuid": "a12afa7b-25d5-46e8-97e2-e56a897250c9", "comment": "Malware payload", "value": "9d15cc44c47d68c49ad1034493992ed022cac6f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089550, "uuid": "e106db22-9f87-4600-a0d1-b3dddade7ae3", "comment": "Malware payload", "value": "c4f43effb8fe899afcea26b73ae3020425966995ff7c4a009f620c4a8be9bf818dcfcce6b90531b9f5d85aae6a329dad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089550, "uuid": "73162f68-6d73-48b4-b67f-9472349eefdb", "value": "T101452346FAE99432DCFA1BB078FA02C31FB2FDA15D658766230B595A5C723D0417232E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089550, "uuid": "c93ddd37-711e-4970-a1ce-514d3a9c1383", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089550, "uuid": "c767090c-df4c-460e-ae21-2ea827a48cf0", "value": "24576:tykAo3sHbKvmobmW8Cm/LpfBd3jUP7GMkGhxyrqEL:IkAosqmoKRCm/FfrjUSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089550, "uuid": "f8abe5e0-e43a-4a9a-bd53-34f27f74eb85", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089550, "uuid": "5010b1c0-e035-40a0-8f0b-d0894aae57c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089550, "uuid": "c9e7efbb-7e5c-48ab-ba19-9b39e56586e0", "value": "f67f0dbce979330570d7cd60dea97c59919c3496b09c4485a2ad2c1fe9f04ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e62c8e3-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089551, "uuid": "100570de-329e-4043-a0b7-e4469b3032b3", "comment": "Malware payload", "value": "a6dca7289a74b575025a6553e973491b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089551, "uuid": "b50e3e8e-28f6-4a82-bb4a-a50e9b06eaf4", "comment": "Malware payload", "value": "f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089551, "uuid": "0710b62c-4795-4e6e-b1d6-ee285cab7cf9", "comment": "Malware payload", "value": "fc690b2739bdcb4a78129eb5a47a69453cc686c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089551, "uuid": "1a8de6a1-1ba1-4888-82ea-ec33b3cf22f6", "comment": "Malware payload", "value": "1fae9de6de2d670ea05571b0ed780f794127f482c2d838660207c25951f3e93880ce22d4a1d4073348858eb987b41aef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089551, "uuid": "a07d8561-5122-4d5f-a778-fce1a414bb8e", "value": "T191452307AFC58073E9B50B7478F707470A3E7CD0A924872A33865E9B09F3694A5B3766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089551, "uuid": "2251e323-a360-43f7-b011-919b13552333", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089551, "uuid": "b82fa0f5-3581-40d7-8ad4-a504e6032330", "value": "24576:By/h4WsNjMGJ9qiL/apHrYvjF8WQCkjQtunsz+ozZI+:0yWs2EjL/axrcjF8W/k4bzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089551, "uuid": "1a7ba76c-82de-4b51-8a6a-b4ec43bf6fdc", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089551, "uuid": "70bebf3a-cbf8-469a-94b9-ce731467b58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089551, "uuid": "f70ea077-fa85-41eb-a2ff-de7db1f83cac", "value": "f6e43abf63a28725b10b89c1351e85ae417981d372b450fd81b05ec655c0a252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef4ef0c-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089552, "uuid": "f29e2e70-e7f8-47e6-84fb-f4a32920f048", "comment": "Malware payload", "value": "b08afcb9036a3cdbe855d1a62bfa7f44", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089552, "uuid": "76fa1400-66e8-4dce-9fb9-dba14975d560", "comment": "Malware payload", "value": "f6e5fa4eb466f960ae4c3452b1f66e7c132f750f658a3a4a0aeb842c5014352e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089552, "uuid": "8a0ef41f-e800-408b-abdc-cb814f084ae0", "comment": "Malware payload", "value": "a2237463185f5aeedeba292ad5f6e4c3ce99b844", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089552, "uuid": "a1e6abea-0b6f-4cac-8aa3-072057fdb315", "comment": "Malware payload", "value": "45bf0209f873a5580a6bfa040c7f25eeadec6c067b1946894c891642c888e25b525809e3cf3a6c979f6fea09869a3efa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089552, "uuid": "ba38ed26-60a1-41ee-896c-ee32fe4737e3", "value": "T1E7052243B2E5C073DCF06B7428F607931A397DE06E79476F338A64561932A98A531F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089552, "uuid": "24855d2e-7b5a-4a5e-b897-45fe842cfba2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089552, "uuid": "ae8d210b-3360-4a5c-a4e6-22ac5f45ba40", "value": "24576:Wy0EPNeuh6WYuHBMk9QN5kvZblWcBCCI:l0Es1zakAxXEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089552, "uuid": "9e4d7f5f-ab66-4c17-bc8e-3c8531979c57", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089552, "uuid": "4229b62f-ba0f-4fe8-b1e7-5edf2f0c6c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089552, "uuid": "e7b8483c-a9d1-43a3-9a30-9532274f0a8a", "value": "f6e5fa4eb466f960ae4c3452b1f66e7c132f750f658a3a4a0aeb842c5014352e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08ce360-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089581, "uuid": "50b05f49-b8ff-43bb-8dc0-343d587b3c63", "comment": "Malware payload", "value": "75b8f9dbb1cd79b7fc074f7f499150cf", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089581, "uuid": "184d10ca-377c-4622-a476-857038aafd88", "comment": "Malware payload", "value": "f6f948eed8bcaf7259531cb4f7a9318f6e0d571f402c4476fba518968bbd2d79", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089581, "uuid": "e0de0214-2ed2-4209-a55c-baea48a35ad1", "comment": "Malware payload", "value": "1e3f309488a6ed4a71b1ac5b65db13ed2f91a146", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089581, "uuid": "e8af4724-13eb-45d9-8f10-807e3546eb50", "comment": "Malware payload", "value": "45ef36a5c25fd723726b7cc5ff288e820a8587bf44b31c8106b9c2972c309cfc8c88a6f0a54b40928e7c0d8dbb70051f", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089581, "uuid": "5c8c704f-f603-4c22-a961-e9bb9390a487", "value": "T195B52383EB09D8A6D5E7CB3184260456AD781C505F67E3F66602B97C4EF6BE0CB04EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089581, "uuid": "19c82dd4-9b5c-443c-b74b-28483be0d5b9", "value": "49152:+5utsk9uOLo2LU3jXbqLGz49rcEuy8QFFIVtoRIjmGd6dnXy0F72hq5zweKHp0Zo:+A9uOLov3jmLGk8QFFIVto23d2nXy0Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089581, "uuid": "28f33926-a30e-4a19-886d-8af1d250b981", "value": 2481304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089581, "uuid": "43eb5969-a598-4395-8814-6d11fe8f252e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089581, "uuid": "b8568ba7-d40a-4ff1-9f5a-68437817a4d8", "value": "fakeAV75B8F9DBB1CD79B7FC074F7F499150CFLabelReader.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa13f890-f23b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684057358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057358, "uuid": "445b1f15-af36-4666-af40-4b748d902c6b", "comment": "Malware payload (AgentTesla)", "value": "89c36bdf74a2c15aef18f4725ad37a70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057358, "uuid": "91f8f7de-91e7-4707-8ea9-54aa69d69fec", "comment": "Malware payload (AgentTesla)", "value": "f72ee457b7e53954dc20479dc5ae8eb4f7ad0674235292a8c348772f875b52ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057358, "uuid": "b1e39a79-576e-4127-bc1f-f70f6f7785ae", "comment": "Malware payload (AgentTesla)", "value": "69fccaad6915755256b68f7f422c946dc1a69041", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684057358, "uuid": "1ce99518-8bc5-4470-9417-8a5935171559", "comment": "Malware payload (AgentTesla)", "value": "2e4b61c6369d813a12a6ccfdeed216ca2fa04ed28501cbd4532982ed991e6f7bb9304e9cc99853ac90746f08b23e390d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057358, "uuid": "41830f9e-38c8-42df-9446-9b4782282b66", "value": "T1E5C49D3C8DBD5232E7B0D2B58BAC8871F06CA42F3191FE6A18DBD19116C3956B9C316D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057358, "uuid": "7b4b0cb5-9679-4879-b632-0b0653c0b650", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057358, "uuid": "3bdf01d4-1728-4d96-8f25-82eac186e2dd", "value": "12288:F3fRnGP8BW77kzFOFIwY14UjSrN78/YEQ:zMK2NGh1TSrNw/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684057358, "uuid": "650214b0-d5e1-4391-8ddb-e12ee424e99c", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684057358, "uuid": "b5539c48-fe5d-4851-9a8a-384ada47c61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684057358, "uuid": "9388fc01-130b-48da-8f35-28887e0b7a86", "value": "f72ee457b7e53954dc20479dc5ae8eb4f7ad0674235292a8c348772f875b52ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a000226f-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089554, "uuid": "14075c6c-4b1c-4cbe-b9f0-c229e5ed7fa8", "comment": "Malware payload", "value": "f97843ce5d1e4dc01426c3136478afb1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089554, "uuid": "e5fa9156-5dad-4c5b-94fb-201ef9a792c3", "comment": "Malware payload", "value": "f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089554, "uuid": "3eb8517a-0e13-42fc-af9f-c3b6ed44f4d3", "comment": "Malware payload", "value": "a6f3d575ded22535672a5cfd3ea67e67adcc2fb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089554, "uuid": "f0b5e89c-15f6-4092-8ceb-25416ae2b274", "comment": "Malware payload", "value": "868923417c454082c55f5c0c30cf35a237503ec109052d551b6b790dd540376a859c343658a2963320bf2e7ce62fc959", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089554, "uuid": "c5d0977c-94e7-4f08-8213-abf1d0c40beb", "value": "T150152362EAE8A076D8F71BB594F743430B35BDB28CB5962B37929C8C1D72984353131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089554, "uuid": "5f9a07c8-4ccf-4266-a7f3-5bcda7a3b69a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089554, "uuid": "2e07a729-4139-4cc7-bcf3-71c9c771fadf", "value": "24576:pyytbfL1+8TRNIBJE5LaVoqE2RFnpr4Eo8jVz3Ua:cytbfLM8TfI7E5KoqE8FJPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089554, "uuid": "01dea3d3-0b4a-42f8-8cc0-96fd01d8d741", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089554, "uuid": "6f265146-f96b-49dd-b35d-508512277aaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089554, "uuid": "5d1136ba-6eb3-4045-9ac9-2c1ed70d3caa", "value": "f80b860277228e7b418a2d2bed4b4de229bc6ca7010075919b8ad7f299334022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d6fec3-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089555, "uuid": "c14450e7-aa73-4a08-9e0f-6b7e943de523", "comment": "Malware payload", "value": "8eb80a5e33b2255a56287792d19853e5", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089555, "uuid": "5f812d28-df10-4afe-9544-f9a3347c7ef2", "comment": "Malware payload", "value": "f847b80ab00228a2642c66373ad6c5053955c71796685400f2e07e99709421d5", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089555, "uuid": "e06e44e8-05cb-4e38-b674-8da78f064021", "comment": "Malware payload", "value": "bc87c9fffcdac4eea1b84c62842ce1138fd90ed6", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089555, "uuid": "78f5e967-830f-4642-9fb4-4d1dd3ee12a0", "comment": "Malware payload", "value": "e14865b9d81383d40d267d6e5dc7de24552e3348ca67fd05ddd8aec51db912c31e875d8a87f45bfeb4e689bf4ef1d12e", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089555, "uuid": "675448b4-3e6a-4e2a-8a64-ad53c4b76f61", "value": "T16555D081F3C9AC2FCDB384324BB64B6A55564C5AC646E35385B1B22C9DBBDC04E85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089555, "uuid": "30019e36-54cb-4169-92bc-8af2dca9708f", "value": "24576:pEkiQypPE7RF4EOH92B9/1JFiaRkiz5F7RpN/5OWGigvPit:pEhQypaOH92B9/1PjRjz/NnBjgvPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089555, "uuid": "f2422d9f-2657-4773-9776-b4b68a374741", "value": 1284913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089555, "uuid": "9225a6b8-177a-462a-a7aa-481bd22a1f32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089555, "uuid": "b5c6b1d1-4a89-48c2-a703-81568761cd24", "value": "f847b80ab00228a2642c66373ad6c5053955c71796685400f2e07e99709421d5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28d5f87-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089558, "uuid": "8845f7d7-9d22-49c6-a28e-351d0a631b14", "comment": "Malware payload", "value": "c11f273891402df088ad2e9834e1225d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089558, "uuid": "b32474ca-dac3-40da-a242-e3f794b99185", "comment": "Malware payload", "value": "f8a1204275b349adf0789613f79d9a8c775b28f37af77f383c25fa4ac03718bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089558, "uuid": "11745fdc-2f5d-4375-af7b-2ccffeef607b", "comment": "Malware payload", "value": "5595192ca4c0c32b8d67a34d8ae1b24b82e02b2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089558, "uuid": "a808df5b-deb2-419a-bdd7-26a2494ef905", "comment": "Malware payload", "value": "389bab8ac6f3dc8a014c0a502e0b98ead0a010b06c76e25ed2d4bebc21566e08db86e90bd14a1e708bd5737534923a4d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089558, "uuid": "27621a70-5924-4dcd-b4f5-64e0a27845f9", "value": "T159452392AAF19577DDB62BB01CF202530E36BDE2587D83AE1315981F18B25D1D83236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089558, "uuid": "e16b78fe-ccd5-48c8-a9a4-9ea4729cb8f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089558, "uuid": "cff5c6e0-ba2f-459f-8afc-3c7fa6d14064", "value": "24576:iy9idnFJCp/Y+KCr4gUQFvW3HGW/8EkprsHepG/pJ/0EFXZW:J90FJAY+KCr8QtWXGE8EgNpMpJ/0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089558, "uuid": "e55e0d04-91e8-465a-b73e-485260f8e59d", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089558, "uuid": "6c9132e8-812c-470b-b8e3-5443d01cfe89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089558, "uuid": "37c568db-59ed-4757-8a1a-a3e6cf22627f", "value": "f8a1204275b349adf0789613f79d9a8c775b28f37af77f383c25fa4ac03718bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a730c3fd-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089566, "uuid": "c0262a27-5608-4ff1-bce6-533bf705c690", "comment": "Malware payload", "value": "7c7d0215e8af48615d4d140de026e7b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089566, "uuid": "14c3a0cf-a592-4041-9a05-ead928fedadd", "comment": "Malware payload", "value": "f8b26daf077881b015df0ad94ff0c7ed949b0b7caae088eee222f0a87a6b6239", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089566, "uuid": "8be3a8eb-40ba-4cee-b4b0-04e58f00cbf0", "comment": "Malware payload", "value": "d3fe6f9c1810664afba39de02681aedc16deb983", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089566, "uuid": "863aa42b-f7e3-46e2-a42c-c445ccdfd18c", "comment": "Malware payload", "value": "f459bd42c5d51799b4274ba28d706a56aa8df83c8ed9ed23677c06eae8206334fc738154cf06b97fd9a1995be3308d7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089566, "uuid": "13bfa071-b20c-474f-98e8-6032e9c9522b", "value": "T1FC4523539BDAD833DDB81BB089F55287263ABDF29CA0133B174669071CB36C0A0B5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089566, "uuid": "05287a2a-1208-4f72-91a7-0597dcf97da9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089566, "uuid": "65edad24-def8-4495-9454-0f80a0dec9dc", "value": "24576:fycCa7GGI0ao+Zz3j4T9pLQtRO3SMG6P3/MkMcbFHj:qHayL0ao6zTE9pLviMrv/17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089566, "uuid": "0a9fa828-3206-415d-a78a-7fd199383bab", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089566, "uuid": "56c60134-5ae3-41bf-af95-4244e93efa3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089566, "uuid": "6e0e047c-4440-4a33-b2ed-6fe1d0818ad6", "value": "f8b26daf077881b015df0ad94ff0c7ed949b0b7caae088eee222f0a87a6b6239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb7bd56-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089634, "uuid": "ddd5f8c2-6ded-4ed8-9b4d-cd36eec82a45", "comment": "Malware payload", "value": "f4f15914b040f4911e9fa5a7a50eee6f", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089634, "uuid": "a95197cf-7962-4962-9124-70b78d7ecda6", "comment": "Malware payload", "value": "f8bb242808a15ea0d89b3f58654f59906ff91d94dea8d82e99513f8910733762", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089634, "uuid": "aa548ce1-bfd1-4afd-ac1d-0a0a38f86996", "comment": "Malware payload", "value": "4fc6016dfd2aa7bc90ef9465029a4b612d73f86d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089634, "uuid": "4fd4aa21-f884-4303-8320-e7c9e7b8dedf", "comment": "Malware payload", "value": "af624633026703aee573d98075a5a3e89f6a44ed40595405c477f1d074a4efe55748a36e045084c95255ae3e21c09fbb", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089634, "uuid": "557d5704-5eca-4d21-8087-7b4ce6628742", "value": "T12EC5D03FB2DA6D7EC47A0A3945729298583B6E70641A8CDA07FC250DCF27460BE3B715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089634, "uuid": "180c97bc-2cf6-48ed-94fc-00486ca449ed", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089634, "uuid": "445b19de-12ae-4b77-ac4a-a9af24d617ab", "value": "49152:yqe3f6apzD7+H98AHaCfu6UHCL+WuTmuKwEJ:LSioD7E9vBujHCK5NKXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089634, "uuid": "bf3dd4f7-aea4-454a-8803-77ecbc1218f5", "value": 2711424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089634, "uuid": "995f90b8-6d3d-489b-8d38-f3a5e1cecddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089634, "uuid": "1531c09a-fe1d-4134-8bab-e45854bec2ed", "value": "ReadyOrNotLinkvertiseDownloaderuF5Br1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e5ada2-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089567, "uuid": "2b5262a6-f38a-499f-ac72-0b83213e4dbc", "comment": "Malware payload", "value": "ca4d9dcfd84400a97ce826298dfd5f84", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089567, "uuid": "c05d49cd-88d8-49e9-ab1c-4f5f9b58b891", "comment": "Malware payload", "value": "f8c6d11cbb589827f97c9a7f57b1b7f514f9ad7746fe89fa69b8f3c4d3868210", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089567, "uuid": "2603f7a7-169e-41ad-bddd-3d9672229d84", "comment": "Malware payload", "value": "e5d20a8a1a2e130f86b0a4e92c811e3c0ddb5125", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089567, "uuid": "9e447ce6-3d89-41d8-bbae-f925e1da20a5", "comment": "Malware payload", "value": "95c3179d935859d991a6031dc73c513cee69b277e02ec5a7d39edaed525d1c5956ee25759ac24232addcd739b14083c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089567, "uuid": "cb670443-212e-4c5f-b879-4f132a5f08ba", "value": "T1D84523532AD581B6DCF2077154F622530B3BBCE1A924C69B2306A46E98B36D4FD7133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089567, "uuid": "36102a31-187a-4e69-8847-22aeebec1e93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089567, "uuid": "bc36f308-014e-4f52-a75d-fc3654320ada", "value": "24576:DyzzA9MXA1HW1TmiftOpw0EBA2KvWH/4cEG8p:WkMQVWzMngA2KOHwcB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089567, "uuid": "5db2af5d-ffd3-41aa-bfdf-42518b75c397", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089567, "uuid": "bb575f29-99e0-4c2f-8891-8934039004e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089567, "uuid": "f9629853-00aa-47cd-8a6a-aa12ca3e1b56", "value": "f8c6d11cbb589827f97c9a7f57b1b7f514f9ad7746fe89fa69b8f3c4d3868210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9554f1d-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089569, "uuid": "532944df-237e-4eaa-a8cf-052a2cde097d", "comment": "Malware payload", "value": "ee226e2470768421db2ccbf528ee7fb1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089569, "uuid": "27a51e90-adcf-4797-af0b-86b971a19c71", "comment": "Malware payload", "value": "f9027131df4bfad2a39345395d572cc478531e927585962723ffa78e59295703", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089569, "uuid": "b9ce180f-da49-416f-9cc5-70970dba70b4", "comment": "Malware payload", "value": "1ad91f7c7cd46e76bf6b0d526d84a27bf2f9b951", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089569, "uuid": "2ba9f967-a64b-4ca9-9cf4-a430181794f1", "comment": "Malware payload", "value": "b5e0abb807fff4ba51e9b4d03e7b323d09549177c0303e110f33830f4a3de4d5aa32f1f907d6b67f2513fdf3393b0995", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089569, "uuid": "e57499ab-5bda-4d8f-aa2d-e59ca6088af6", "value": "T194452342A7F98431E4F62B7068FB47D31A7ABC92D8BC595A13096C5B1CF15D068B0B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089569, "uuid": "5f63c57d-130e-43f1-a6d6-c09eefb3ed52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089569, "uuid": "6238a9a9-7f82-42c6-8341-c32c7a8c1a68", "value": "24576:HyotzwNw0eFUq8DPjdqVR4Q0Dz0p/ak0n5e3zLN6XZmzIckbD:SosqURPRjUqaN6JmHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089569, "uuid": "cf9791b0-2480-485c-bc97-19d149efab18", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089569, "uuid": "b2a93fd3-3170-49f8-8639-41a4b5509707", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089569, "uuid": "3c7f8441-f767-4f25-a136-306e24439a7d", "value": "f9027131df4bfad2a39345395d572cc478531e927585962723ffa78e59295703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa04e9ab-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089571, "uuid": "4e10148f-e684-49de-8294-7547fcfc3a5f", "comment": "Malware payload", "value": "221d2fc2fb3a0bc2296adf1f124ebb60", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089571, "uuid": "6b954f58-aa38-4c76-aac0-45f1cd5a384f", "comment": "Malware payload", "value": "f95c748c962febaf400470f53efb46b97d6e70101832eb79a115ebbefa10cfcc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089571, "uuid": "7141fb13-8ad3-43c3-88e2-e54221ff2fa2", "comment": "Malware payload", "value": "750960a6749389e5e15f9a420608ec02e4fc7849", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089571, "uuid": "7e5ce1e7-b861-499f-84e7-7874c9c7ef09", "comment": "Malware payload", "value": "12357bf69cdd705e53f1338e1d51dc3e10b30a6888490bbf05ee5580bb00e11547a95983462b33da764e42a69ca572f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089571, "uuid": "0a3de52e-5f1c-4f5d-9b33-d0e52527d309", "value": "T1FC452312EBE46532EAB1677029F703D34B35BC61597813AB33686C413CB3681AA78777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089571, "uuid": "46975ed2-f8b4-4516-85ab-19f2a760463c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089571, "uuid": "e1118a77-a967-4f3f-bac9-0e44051a3da5", "value": "24576:1yhRtZ71NTkbqUfYi5eJqpFAJrGWzfgxTnWsn:QhR371CbP5vFAJrGQ8zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089571, "uuid": "a760babe-90e9-4942-a2f3-7bf7cfaa415c", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089571, "uuid": "f7854c14-a6ac-459c-a097-0e749c255bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089571, "uuid": "beafb590-0a8b-403f-9017-389a42d18e65", "value": "f95c748c962febaf400470f53efb46b97d6e70101832eb79a115ebbefa10cfcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa0e414-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089572, "uuid": "3ba760e4-44cd-4ec0-a767-3af0adc91a48", "comment": "Malware payload", "value": "7e12996fe3be641fe52928d97d09df3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089572, "uuid": "6ba407d7-b48e-4df2-96b4-50cad076e3c5", "comment": "Malware payload", "value": "f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089572, "uuid": "981ec3fc-9623-40e0-8ef2-a395a4185bc6", "comment": "Malware payload", "value": "ce5106ae7b616cda58eac1115757a6b47ce6175a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089572, "uuid": "26868d5d-5932-4096-aa38-fb0c43aefe07", "comment": "Malware payload", "value": "84413c6b272b93e5247317f05686a9365aa9b60353495f86a7508425dc012274abca6caaca56184dd6eeecdab1a12fac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089572, "uuid": "6e31d2e0-8729-4152-b18f-c9b62fc7ddf0", "value": "T1AF152313FADC4073D9B867712CF603831B35FCA2997893AF1B415E5A8873698697132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089572, "uuid": "45f683a2-e32a-4071-aca5-af443ec5dc80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089572, "uuid": "8181aac4-1b6f-4f8c-adc7-7f3f4877c9da", "value": "24576:ey/d2qysvtAhzHJAMdVUkhq1IPbKTz8TQoIWy1:ttVODJ3Gkh1PbKX8UoIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089572, "uuid": "359296cc-3e7a-46f8-be53-7715188cc003", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089572, "uuid": "6b6689d7-9b2d-451c-9b08-eb7bb07ff7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089572, "uuid": "bdb6eec8-446c-42c1-8b69-993e680d7f14", "value": "f969a04f7d3e1da3f6ff1c61c5de21357e12d01b2e7a48c26f3edd6b9040035e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66727758-f253-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684067553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067553, "uuid": "e55cebc7-f86c-4672-8e6b-e309f1ecca40", "comment": "Malware payload", "value": "9e4bfb61149590a2de492b2ab2425c8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067553, "uuid": "59235d65-ef45-4316-b590-c8d501dc87e3", "comment": "Malware payload", "value": "f96bad97cc5722df56b5824ff6ff39d63ef2af720daf46c7f8a91dffab611b37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067553, "uuid": "83a4eeec-5670-4d1d-ab22-9b89eabb6d98", "comment": "Malware payload", "value": "b20b5886a24d2a21ed8eee5b7dc027959cda1d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684067553, "uuid": "693c988d-7fe8-44aa-9acd-909ae991d465", "comment": "Malware payload", "value": "a1bbbdac241f6a8e2ceaeb24341a0c846e08450eceb38eeb749f78c53373cb0e9bfe77b499cecb511d22aedc0923b5df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067553, "uuid": "c9b5dfda-b4ad-4121-b0f2-5805c9d0379d", "value": "T1BF065CA2E604FE84C8A4AB79F5ED50C07BC4174CD6C72526E823E07867D8CC796E758B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067553, "uuid": "326cb6e5-9e96-40d8-8f12-287e6e1a203f", "value": "24576:XKb1vAldKP5mdAoxAh+ZEUcKh7XYsNNoYqJg6f+DNYp/upxYtsw9tkHiu2XG3s1C:XO4dAoxi8EUcy7XY4TqJkJDkP0cYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684067553, "uuid": "a08acc4a-9d10-4780-a5f4-f6968613497c", "value": 3981904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684067553, "uuid": "f95bfe21-7a05-4c2d-9443-bc4f5040efd1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684067553, "uuid": "5943629f-0f97-4d15-8bc6-a6ff977dd8e5", "value": "SecuriteInfo.com.HEUR.Trojan-Spy.AndroidOS.SmsThief.ug.14222.9410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df27b214-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058306, "uuid": "f9ea04dc-3fe9-4591-aea4-9ddcc9553c0d", "comment": "Malware payload (AgentTesla)", "value": "5c8dad2aeb67f86573778ea34b8518de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058306, "uuid": "2626d3ea-35b1-4dec-a487-d60e5af149b1", "comment": "Malware payload (AgentTesla)", "value": "f9921aced0a80217b1587281cb425a8778d5a4227ddc55b092cdf071c5b2ad8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058306, "uuid": "23545888-c0dd-4399-b884-a451db333f07", "comment": "Malware payload (AgentTesla)", "value": "2057f3f80998e1326d9f5147d8e6a24a6eaa60d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058306, "uuid": "e255dbee-5531-4e2b-b1a0-3fd90f69b5f5", "comment": "Malware payload (AgentTesla)", "value": "f6d27718946a49a006c94a966f2d7a29119cf3c4e63de118c5eaac788f8e968432350c0f8a03f1e9da7db7bbd1a1d08d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058306, "uuid": "6f97904d-f189-4dbe-8431-c47e72e744ba", "value": "T1DDF48DD42ADA8BC4D037B130F059C7F2C3D2152AF099DBE0389B5989E1D2E551CFA9B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058306, "uuid": "ccd5fbbd-ba25-4f98-9bc8-135d129a14d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058306, "uuid": "787a17e8-2b2a-40b1-baa4-31ddbe19105f", "value": "12288:t2iN1pS/b37nw5zTOWQ3GYqA8HTDLKfTXZb4WDcsyVgh2eVn:t1DU/bLncXgwAuD6jZb4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058306, "uuid": "50477e98-afe4-442b-9786-22bbf8011ec0", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058306, "uuid": "995b7ddc-0f79-4e12-9b86-622d9016b4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058306, "uuid": "3e29bf6a-819d-45bf-8d11-eea6015e0cd5", "value": "f9921aced0a80217b1587281cb425a8778d5a4227ddc55b092cdf071c5b2ad8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab364fe4-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089573, "uuid": "c1c7d3e1-fa55-4b9c-ace1-aa95278a24cd", "comment": "Malware payload", "value": "8dff4496d70deacae93314e726a8b2b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089573, "uuid": "6d320ce5-6070-42c1-a4bb-8019cc9ef58e", "comment": "Malware payload", "value": "f9bb4c6448066e17d4a580b3adc299dc72b07c2b8366a4bb029742d35047081c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089573, "uuid": "266592fe-f5c4-4f46-b961-ce3acd783e96", "comment": "Malware payload", "value": "868785dd33ee0d70352a570414694c0bf7cb1cbb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089573, "uuid": "271c1611-01ff-4a63-8511-d92a0a0f68f3", "comment": "Malware payload", "value": "5eaa5539c091881f12d53aac85c2714fca11a453c7342f6b74353b4745f8a45e1c4139a402bd3138fa75741212c15880", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089573, "uuid": "6f6d8cbc-135c-4c27-9de7-ee4bd2d3f4f7", "value": "T137F41215E6C94433EEB967B05CF707830B2A7D6195384B5F2A81B85F2C722E0AC7573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089573, "uuid": "8011d283-ecb4-4374-920d-17d968f747ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089573, "uuid": "b6f1ba06-0236-428a-aa38-4ca8d016bea3", "value": "24576:+ylTEyz7XZvRKhZcW68arwZ6Nk9wlhNLHH:NlPJRG1agb+lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089573, "uuid": "b47087d7-7be0-4c37-af7f-fce400952475", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089573, "uuid": "fdba6140-17b8-4986-80a3-99bda28e2fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089573, "uuid": "c3c75eef-6a35-4245-a294-3c73aafcfc77", "value": "f9bb4c6448066e17d4a580b3adc299dc72b07c2b8366a4bb029742d35047081c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4a408c-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089574, "uuid": "eab74e71-1cba-4b90-90a5-82b6c6d6054f", "comment": "Malware payload", "value": "91eab4f592328ee8a1f6a12566493b5a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089574, "uuid": "f2515763-9605-46c5-b87a-210edf146ea7", "comment": "Malware payload", "value": "f9ff5bd2bfce7ec2c5ebe08357cec0ac76beb10037f77ceed4ceb766a15388be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089574, "uuid": "5029e65f-0682-4ac6-ae15-80078433639c", "comment": "Malware payload", "value": "6b2880ea027de24bb825eb2055c509406fbdffd9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089574, "uuid": "a62d0bd5-14c4-49e0-9e76-9599781604dd", "comment": "Malware payload", "value": "d3a5b870bd22692d7ea363babaa14285c928ea270b3ebd86526438a0d3fc6c107d8fed670d0d8ca6e85ee9b9f75a598e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089574, "uuid": "8c3b6a81-eda8-4caa-8d01-bcd63fd83ee8", "value": "T1D9452341DAE59023C6A667B10DF712C30739BD924C78D7BB2349A89D1E33395A6313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089574, "uuid": "a63111cc-5005-4a3b-a987-5bfaa5870545", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089574, "uuid": "fdc8524f-12df-4439-8349-496ea457f46e", "value": "24576:DyythO81zDLJYOTADvqZZ8Qb0la9AobKVPLsAtIcs:WyvO81zDLJYOTGqf8Qb0UZQLPtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089574, "uuid": "e05e6a1a-df96-4a08-a53d-d08af4f21a84", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089574, "uuid": "70d0b9c5-250f-4160-b497-9d0b79888651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089574, "uuid": "31c0eb4e-5a25-49d1-8762-b792c16e9d62", "value": "f9ff5bd2bfce7ec2c5ebe08357cec0ac76beb10037f77ceed4ceb766a15388be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad028450-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684089576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089576, "uuid": "4e02c5db-24bf-44d8-93e8-8954c84c35b5", "comment": "Malware payload (RedLineStealer)", "value": "758fad11fecdc3551039bcd2027c0a9d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089576, "uuid": "779c8b20-6d43-4392-9edd-3f5d48ff1519", "comment": "Malware payload (RedLineStealer)", "value": "fa0063d69ed365b1c1bf922f10544528a713d2dea3e5106344fc7646a75abd5a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089576, "uuid": "61131fc4-94b4-4d43-8180-c3542c8d6bd6", "comment": "Malware payload (RedLineStealer)", "value": "390a19176fcb7fd72fc9574c8d1b9287ded9480c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089576, "uuid": "efbc2d83-ec20-46e3-941c-059da258a253", "comment": "Malware payload (RedLineStealer)", "value": "9f3fe3b146aec5666b092ea804c7ef4dd3e17bb9355442f28a4fcd12ab51f857e4d5a852bac39219a00437ae5eab8800", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089576, "uuid": "582257c3-bb8f-4e74-8fce-8cdf30282e3a", "value": "T10F452306DFC99032E4F657701CFB22C32A357CD29E74933B6326996A1CF25A9097871B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089576, "uuid": "c24ceada-1b52-46ca-8988-03d1ae911164", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089576, "uuid": "68da3fbc-da3e-4a9f-9af4-3f08d6bcf668", "value": "24576:yyg0zhbMgpEag9voDbHiXlUlgd9tYBkrneSmtse6:Zg0VbMgpEag9veiV+CYarn7m+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089576, "uuid": "25f9b7fa-ac84-4180-9fa5-ef6195393860", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089576, "uuid": "ac001c3d-d49e-4ec4-a708-71f9b2a56f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089576, "uuid": "01819342-e17d-4d23-bfcb-c483e6dc550a", "value": "fa0063d69ed365b1c1bf922f10544528a713d2dea3e5106344fc7646a75abd5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e517acd7-f26c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684078503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078503, "uuid": "8a502d00-0450-436b-b7ef-d5c6d37adfc3", "comment": "Malware payload (RedLineStealer)", "value": "cde8cb31dc51e8fcd995d6d2f8352087", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078503, "uuid": "af229f51-ca83-481e-939e-d5dcfc66d458", "comment": "Malware payload (RedLineStealer)", "value": "fa5e9f1a26489c0ac13b5adab734574f1ac3ffafd274741030646dac3626b10a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078503, "uuid": "6d57a9f4-98f0-4ef8-bc56-bad35c94678d", "comment": "Malware payload (RedLineStealer)", "value": "23281521fa5a657d8d2333f8ec6bdf82e34b0f8f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684078503, "uuid": "84f7d716-8c1d-4a68-b793-d6a0c60fc353", "comment": "Malware payload (RedLineStealer)", "value": "37274beb1c60df83d2e6dbdd35456ae6ff5d61b7d09a48eac221c28efc0102d9194d429fb3ea4f0cba6b2164499c1ddd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078503, "uuid": "20add0ce-17e4-4543-960e-7a6c80eb4249", "value": "T1E645231236DD9163DDB517709EF302930B3A7CA219709B6B6B86D90E09B39C9E474B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078503, "uuid": "a30794d7-de56-4f06-a664-343600df345e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078503, "uuid": "f3c761fc-6409-45f2-a917-94c61eb2828a", "value": "24576:yygjHeFigQlzCwhqXuAQvq8xIN2GNacoMpBHGOc:ZgaFiLlzhqhQNIIcoMpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684078503, "uuid": "3dba467d-e618-471c-a77f-8f31a5821624", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684078503, "uuid": "24a6e22f-5b00-45f3-8593-a4e215d59ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684078503, "uuid": "c7a870a1-ad7f-4921-9ff6-65514f7a5016", "value": "fa5e9f1a26489c0ac13b5adab734574f1ac3ffafd274741030646dac3626b10a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f40192-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089725, "uuid": "1aac420a-47eb-40af-bce3-e5108831a8f0", "comment": "Malware payload", "value": "c112804c496ff5809c92d7e641ab1fd6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089725, "uuid": "3906cf2f-66e4-44a4-8c23-a08a140bd9c5", "comment": "Malware payload", "value": "fa76399ee63b8579dcfb51ede098fbe6a09ed34d149dcbc4bee353fdd15aeddd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089725, "uuid": "0124abda-a851-4f39-a7d3-e5229c59b4b4", "comment": "Malware payload", "value": "93f8886636850212871bf18e73d414a938d79bca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089725, "uuid": "f4a46464-66b8-4b02-afda-faddd25c7959", "comment": "Malware payload", "value": "d0509fd18a6328d300415c6849a0ee94a9d6ad856429e2b32e164300d29376547384dabdcd901f4f08f7f56b4efa96c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089725, "uuid": "b04f719e-3807-49cd-8b82-3c76dd5ce953", "value": "T1A97388B613804BB6E3C54BD04218B11B0DF2E16B3464299DDBE259DFBC29EA37938572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089725, "uuid": "031d238e-61e3-4e19-b315-4accc25ca05b", "value": "768:kjBC1/U8SEpqGy9LznrWHtf1ILDE0K1N9HMWagGPkFsDZieQK4PsMHy8+:kjBCZEznqtPHb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089725, "uuid": "e5f68253-0d4b-4726-90aa-d4d48673d584", "value": 80525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089725, "uuid": "9600b040-a40f-484a-82f7-e1df63ff71bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089725, "uuid": "6a9f3661-6777-4996-9831-a1f3f6b020c8", "value": "test.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada97e78-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089577, "uuid": "c7d97cb8-f750-477b-914d-2c4100ea7155", "comment": "Malware payload", "value": "f06883f1ccfd008fd75c52f6e372720e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089577, "uuid": "2974c9b2-3c2e-4a45-9447-c6056882e617", "comment": "Malware payload", "value": "fab7e5c90e2dd8d44fc261d63cb90f4a58edd3fb6f8b65331c1fc74c53b93508", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089577, "uuid": "689c62a1-11d4-47b7-8a02-305558213477", "comment": "Malware payload", "value": "5c317a6dbf1593a46ccdfad46e857c034b135f74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089577, "uuid": "6bb849ac-4283-4b8e-971b-bc3d7aa56922", "comment": "Malware payload", "value": "2653cc674e6473ec1032a49a43277c76c29540594ffc25e12290e0684f32c92d9a268022d40d88b281ff7aad6ed03205", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089577, "uuid": "ce3508da-f846-4651-9a2b-dd8c954543d2", "value": "T1714523726BF54862C8F12370ECF2008B1A3ABEA16DB4E63F7B45A56508735D5693073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089577, "uuid": "a147da72-9cd7-46d5-89c3-67da001b0cd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089577, "uuid": "b785c3ae-47ce-4762-9e9e-10bf593cfaf3", "value": "24576:vyXwwNEWX9zmDV44JVJ8pWCuKlDxVlZgVHbT17HBO/zPmp:6Xwodyn/unlZSH1kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089577, "uuid": "176944fa-f796-4b7c-9a22-8cd8d67532c7", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089577, "uuid": "b562ab6d-a2b8-4af9-bce4-bea4c4082f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089577, "uuid": "aa30f7bd-4fcd-4ed5-9cc9-ff1e1e3179e2", "value": "fab7e5c90e2dd8d44fc261d63cb90f4a58edd3fb6f8b65331c1fc74c53b93508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cb86a0-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089785, "uuid": "f5955dcf-09c9-4300-bb9a-3555ab099ec6", "comment": "Malware payload", "value": "e6501f64e84b18fbce64b19abf836815", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089785, "uuid": "806ccbd2-6320-4584-b657-6d23229e5fa4", "comment": "Malware payload", "value": "fb10ccbd5a9541a0a46ce62b9079a5aa1da73e7216ee3d7664a4682a52a867a1", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089785, "uuid": "6aaa3deb-ac2c-4f83-9988-5c8307e0031b", "comment": "Malware payload", "value": "deba746e4240fdad3bd2c6a5fb85a8a3f674da4d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089785, "uuid": "30d29945-7efe-4f31-a685-7d4af27cde05", "comment": "Malware payload", "value": "ba926c41247cfd8c1c75cb91f52eb4d814aa3db8c8c72386aec584dab2223028027bd0d026c4be51aca38b7e1b3f3c60", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089785, "uuid": "aeaf40da-d752-4f88-b4a3-bba665cf4ff9", "value": "T1D0463373D38CAA19E26BD673C77564D3AC40AD147276B0350981B1BCCCBB972C69CE26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089785, "uuid": "26d6d67e-cf61-4b9b-b38a-ac02e0a3e585", "value": "98304:FqAo6dmLR7Wmj6Y/9GQxd7Z3oQtTK3UZHpwyv8kBIvEr/RLG1ZlQbl:FqaI97W/Y/9GaxtTDwk8ki6pL8zel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089785, "uuid": "1f9cb337-1664-4486-a85b-12729dfede94", "value": 5649201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089785, "uuid": "f26b0d6e-bf49-4331-8c3f-4e833bf08a66", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089785, "uuid": "569e46d9-52e9-4a0e-a4a1-f24d41a1e555", "value": "Vietcon.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ff2abc-f27a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1684084378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084378, "uuid": "c3c124d0-5f96-4978-a796-e241083fff02", "comment": "Malware payload (RustyStealer)", "value": "d85d45c8a8ba36bf1386b02acd48bfb2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084378, "uuid": "02ce5b91-6718-47ec-83ba-415fa6665aea", "comment": "Malware payload (RustyStealer)", "value": "fb14cb7c3bb9b645df3a6829b268c8b6c7b3e416b089dc8e6127f0a2d898c0d0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084378, "uuid": "45d3f558-c2eb-4a7e-bca5-173b4be0dc7f", "comment": "Malware payload (RustyStealer)", "value": "e5e6083e0488696905b9486ef1a868f6a1c8eb93", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684084378, "uuid": "ec39950e-c0e3-4c77-b342-2d8f294021cf", "comment": "Malware payload (RustyStealer)", "value": "7dc0cdcd18865879b50e88912d02cb10784be2bfc95c690383c239e9b00a96a2a3492299cc8897d2dc365cfb2d8a5ff6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084378, "uuid": "d081037f-381f-4b28-aa5f-1402323b9d5a", "value": "T1982533B1052928F5C41560A3E30453EEB656767EB2A9CE8B079C3D3C6826CE5EDEC0B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084378, "uuid": "4d3eabb6-2d9d-462d-878b-8bb641f6b3f7", "value": "24576:uJPpra/c1iGwZlR747ZQ1DtYw8ry3BZVvZOid997tOITM:Sda/cwGQlNSZQ1DmXoTVxldbtOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684084378, "uuid": "2f96c30b-ca0c-4df1-b3f5-fee27655de9b", "value": 968927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684084378, "uuid": "e6ff280e-7ecf-458b-ae83-d0873f5ac389", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684084378, "uuid": "fcf0bad3-d27e-421d-b83b-80cd4f3107d1", "value": "Updaters.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51bae3a-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089589, "uuid": "d1261392-7cdc-44e3-8558-a02822fd40ee", "comment": "Malware payload", "value": "86d1dc94a82221d8b0802062521d3125", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089589, "uuid": "0edb4ad8-82e5-4c0c-9480-4b5f126ba4f7", "comment": "Malware payload", "value": "fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089589, "uuid": "c92ad093-3914-4b9b-a97f-40661ce5cb68", "comment": "Malware payload", "value": "4afff6cd4991a6f2021446faea7ebb99430c583a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089589, "uuid": "ef1da29e-429b-4586-88ca-4d8e188e7cb1", "comment": "Malware payload", "value": "f992a93778db23bd6f0c8ec67f8b5844a218b478007ee1d4fdad603ce2ced94a503061481edce38954b66e85dfa1d622", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089589, "uuid": "366caac8-fc58-4c6e-827a-2243a78a6375", "value": "T1AB452347A7DE5473E8B227B144FB02830E367C514D70876A239AA94E5D73AD0E6313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089589, "uuid": "34807329-d664-467d-b8e5-e567fe8ce18e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089589, "uuid": "18084141-d822-416f-b218-f02998f0ca8e", "value": "24576:ey49H07MNUT49cmA++bYJlZjYlqyr34eJTgpR0b3rLo2Iu:tcUKDHAfbRqysokpC73k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089589, "uuid": "bc29344b-85fc-4ace-b751-53c20b803808", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089589, "uuid": "a207b4d1-6e31-45d9-bc59-3856f587ad0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089589, "uuid": "19b31ab7-c8f1-4b3a-b0dd-fc56e9740d71", "value": "fb22147ec9bdac2010950c88bb5253729eab2fccaea5761c290aac89aefc3893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b49b68-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089590, "uuid": "239858b7-089a-4799-ad2e-f172787db528", "comment": "Malware payload", "value": "026dc9640b86ab83c7755df504c6f7a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089590, "uuid": "f06b6907-29a2-4cb0-b26f-f67911cc2310", "comment": "Malware payload", "value": "fb93aacafc22e23ad44942febdc2a762132cec40f124872a0f4c6943896a2dbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089590, "uuid": "3201c22d-7935-4a83-9554-9f0b3cca37f9", "comment": "Malware payload", "value": "a2367b67b699fd3b9f60c84a1911134077aa6670", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089590, "uuid": "4525c508-35bb-4fc3-bcef-f6daede8d94d", "comment": "Malware payload", "value": "c0e3b141134a7bbbd7749f6bd7013f8cf8963e5f6bad9ebdfc5fc3bbcc39c689854cdb09482c27fc8446967cb49ac2b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089590, "uuid": "47014996-2155-42fc-a5fb-866367e7cf4b", "value": "T13BF42257B3E45532E8B6273018F61B830B3BBD616D6082A76B827D1B5CB16D0A43377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089590, "uuid": "709f0343-4f8a-4230-88a9-b6a5a9c050de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089590, "uuid": "739f38b2-0e9d-4fa1-aac6-96abf93d5055", "value": "12288:IMr2y90CvdUmCDmLMCnKG0dL1OpSFEbGP5aML+oinS7fXOK0kYjfD3qi:+yfjKVLuioQRj+K0f/ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089590, "uuid": "65db05f3-9852-4d86-8f5d-a51e75932fbb", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089590, "uuid": "cec71a5e-2450-4e58-892e-20f352f75136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089590, "uuid": "321db349-7690-496b-99a2-66698578607a", "value": "fb93aacafc22e23ad44942febdc2a762132cec40f124872a0f4c6943896a2dbc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6711969-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089591, "uuid": "0b7d86dd-403c-45c2-81a9-80b315dd7051", "comment": "Malware payload", "value": "4180278788d82853ef98af91dc5ca464", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089591, "uuid": "39c24a04-f136-4b65-ab78-aa18199fa681", "comment": "Malware payload", "value": "fbc43b4a5a843a22e8880a6f6ba070b24a99a8bb58cfa03b419a0537b47dbe92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089591, "uuid": "88103de2-f636-4549-85ee-277391839276", "comment": "Malware payload", "value": "56bb610e0db25e61475cd89986fe8c378cb73312", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089591, "uuid": "15ae2395-28e7-4d52-87eb-af7f765c2f6d", "comment": "Malware payload", "value": "ae1c4078ac334c15e995b235b49f65da70d1f4607d4397a7250f1e529acce2d6c4e0c8b20fe265232021378ec1a3fa54", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089591, "uuid": "b33a49de-267c-4454-82ac-a66daef1bf2f", "value": "T1E345230367E89571DDF61B74A8F85303093ABD65A838864B27CAED461C732C0A5F5B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089591, "uuid": "7e404263-3614-43a5-9650-11e87ffd1a92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089591, "uuid": "b7bbbcf5-4daf-4def-b86a-ff2301df6287", "value": "24576:Uygorr5vfdhmj0ZlUBNdsZanfuvc/z9xGzvpS/9ot22/cvWqn:jL5vF4jLtBGvc/z9xG7pS/9otjcvWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089591, "uuid": "2bf860dd-7d0c-45df-9568-c5f100cbddd4", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089591, "uuid": "cee45a0c-c2fd-49ed-876d-9cf601ddcd0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089591, "uuid": "119848f0-cc43-4021-bc47-b96de7f2dde8", "value": "fbc43b4a5a843a22e8880a6f6ba070b24a99a8bb58cfa03b419a0537b47dbe92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b745a9cf-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089593, "uuid": "aa999224-0304-4a1e-aa95-5251ffa9df5d", "comment": "Malware payload", "value": "5b2a1300ea6656eb44cb58b35ee8788d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089593, "uuid": "40aa16d1-40dc-40e4-a7af-369a4cbced46", "comment": "Malware payload", "value": "fbf6819b7141122eddcf91fb48733c3d5487e0fdc2d647202812f7d019d5b3d8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089593, "uuid": "ef5f37b5-7526-4cc5-88a2-54c2cee22e6f", "comment": "Malware payload", "value": "0012c9c2223f6ad02e1e7591f31b2c4ad0ccea92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089593, "uuid": "006e27ac-58ed-4da9-8569-137dacbcc1f8", "comment": "Malware payload", "value": "66e8b217f37054406b3132d02f8dd76493153a4c4052de91b37d6f1bbca22d73fc48aa46ea558858b1ad97beccda9756", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089593, "uuid": "ea73b4dd-621f-450f-9a76-36ec88876cc8", "value": "T126452302A3E85532D5B823B099FE0BD31735BEB165BC417B679B7D4A0DB2AC4B470352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089593, "uuid": "2cc688ac-2d38-46b4-83bc-bae6f0d0e262", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089593, "uuid": "47343b75-55ce-4ea4-9ea7-8e9c6fa996d6", "value": "24576:dyaBgEGGauBbrj3kVnYoDsIZWf3h+RLGY:4ZEGMBbrQRsoy+VG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089593, "uuid": "a79f1d91-62b8-49c1-8872-1c9bc16cb1b5", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089593, "uuid": "5e5442e5-5049-4494-b1cd-1e50f9e76f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089593, "uuid": "46c9a777-830c-472d-ac77-436a08937584", "value": "fbf6819b7141122eddcf91fb48733c3d5487e0fdc2d647202812f7d019d5b3d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e5f6fc-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089594, "uuid": "68548f02-d876-4e4c-9bbe-93bddccc33dc", "comment": "Malware payload", "value": "48f101acbad2dbeba824fb6b378c5b98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089594, "uuid": "ee2e1386-f3de-483c-8920-a910766cc7c6", "comment": "Malware payload", "value": "fc0b222de370ef4c55c6697cd222205073e5abd8e26b28ad5ab149e60937a6a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089594, "uuid": "c2d5e411-1bed-4eb5-8c99-594b7ed35a3f", "comment": "Malware payload", "value": "e7b71ee13befe3490e5b87ea1b42d356efd45590", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089594, "uuid": "deaffbb7-1322-4d2f-bfc9-5e39d4702f29", "comment": "Malware payload", "value": "cb8ea5b71eeba3a3175cd118c764faf7ec884410c4ebd10df18b2cf4b5674a2db2adcd5b2fc63399ce7cb904beba2bf3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089594, "uuid": "d8df0b93-5ffc-455d-a0df-30940df48aa7", "value": "T13D15228277EC4132EC751B7128F312970B3A7DA29DB8835B2796A94B1C723DC247572E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089594, "uuid": "9347dfa8-7e18-43b4-adb5-6ff56c6fe213", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089594, "uuid": "fb68b358-9983-48eb-b536-179f677c4a18", "value": "24576:by1crkAYKys3Xii5k/GIAtsEeSJI0NJs1UpeU:O1cY7Cyi5k/ppEeS0ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089594, "uuid": "4c9f433c-f6fa-45ae-a5f2-5fdf77b3895c", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089594, "uuid": "8c246b71-ab79-4529-9e78-7a6a77b8d44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089594, "uuid": "74375aff-e08d-4264-a1f9-aae6f72867e2", "value": "fc0b222de370ef4c55c6697cd222205073e5abd8e26b28ad5ab149e60937a6a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe58187-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1684058308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058308, "uuid": "9105d726-c878-4c62-9404-8535cc83d9df", "comment": "Malware payload (IcedID)", "value": "280b292fd7a0aeebeabff3bd9db8fe98", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058308, "uuid": "67416f36-ad49-4c90-8672-82fc0e08f600", "comment": "Malware payload (IcedID)", "value": "fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058308, "uuid": "8c1981f5-e570-46f0-9fb1-9a075d289134", "comment": "Malware payload (IcedID)", "value": "60d2ff91c4fd80ec83d36b3ee0c32b08684a943d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058308, "uuid": "a0fc98a9-ced6-4438-9189-faeda7d8beee", "comment": "Malware payload (IcedID)", "value": "ed79a70fc4a8c2c490d871dff2fdb089d637f0e0e0f5f799c2db70243688b276139c315c521c4b2514e4dece853952a7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058308, "uuid": "03b89ec7-7421-4fba-9141-3343e7f51293", "value": "T1EAD4BF06F3227C92E54BDB3785E45CA64F7EBD2D2726D74C0A4183323A4A6D89C6137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058308, "uuid": "fa8d17ba-96c5-4d8c-bf2a-7ebc31609f8b", "value": "af55d2516bf5abd8ba8dca4506ab009d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058308, "uuid": "e0d49287-9acd-4f03-b573-4cdf283da468", "value": "12288:hCkJqZecIyU6L7EvzjRObLni3ZSEGSxzltIZCdA5+KaG:hCkJQecG6L7EnKipsQltIL8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058308, "uuid": "b7c7c053-0486-4e76-8f69-f3d7e649dea4", "value": 619608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058308, "uuid": "6b78a1ae-d09c-4c23-9914-884363d6ed0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058308, "uuid": "08e08c02-67d1-4c11-9ba9-1e6e5e13becf", "value": "fc42f12b74a106b724ed9772b308f2ca310a0f415d63da3d19b5861e63ee252f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8993e7e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089595, "uuid": "8448472b-7aad-4f9e-8351-cbb96f685ccc", "comment": "Malware payload", "value": "c94a60e30469d34155cf908a67b98d94", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089595, "uuid": "e9e40ce5-815a-4c97-976f-71161b2a7db0", "comment": "Malware payload", "value": "fc75f34cb33f3cf84df83d157acc5c05076a9c5f2d01b82e629b02fe739ebc9f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089595, "uuid": "f7d1b7b6-e09d-444f-9834-92ff7e4d6a6b", "comment": "Malware payload", "value": "1db651598ef65fbf2676e021ef9de854a93015a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089595, "uuid": "48e47a45-2c29-4f19-9335-e0b06b501383", "comment": "Malware payload", "value": "12346868ace0fb76e2cfa78a8285cb0251628b66a02cec5c417eb13e3f257618a8fbccf1507b8f424b06d36fda2f4faf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089595, "uuid": "c8713552-901a-4666-8576-856be8e22d20", "value": "T19F452307B2D8447BE5B62F710DF613872736BCF66878834B268950AE0DB39C8A175727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089595, "uuid": "6c8ce195-2441-475d-8cb6-6b9d0e2cb4a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089595, "uuid": "9d720747-607a-4fef-ac1a-6482b4d64368", "value": "24576:AyMf83WN/oAlUCvYFOZjxOwg7yvP9SAnJfoCL/td4IGYXPXQvZ:Hi83o5wMjHvP9SAntV4IGY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089595, "uuid": "8b483e4f-8ae1-4908-b841-2a860265e0fb", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089595, "uuid": "42f57a6c-8804-4c85-97ad-dfeea3683fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089595, "uuid": "22992972-1167-49a0-84de-34c65883a66c", "value": "fc75f34cb33f3cf84df83d157acc5c05076a9c5f2d01b82e629b02fe739ebc9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9589a28-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089596, "uuid": "efb08fd3-7b30-42e3-9462-7a9dffbe5e01", "comment": "Malware payload", "value": "0418f969bc154dfbed626c654e59fbf4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089596, "uuid": "4165f369-b0cc-4ed3-890c-6201c9a02970", "comment": "Malware payload", "value": "fc8548dce5acdaf961147f321a92bc0abfde3f8f986850ac0236747d832e0f65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089596, "uuid": "ab73c58c-53b1-4176-9321-58973909bf94", "comment": "Malware payload", "value": "236b1b43e0244c8b4f33679b8b796a76d004d07e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089596, "uuid": "7758765c-0dce-4f13-ab6b-a61d60e8dd99", "comment": "Malware payload", "value": "075af2c9ed1e46ebb5562782f2e2058d8a288c479c63d05c8e027afafc9019d1365e6f3c65c20c68f385baaaa874c302", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089596, "uuid": "518b8561-c5e3-4c15-b616-bf94c111ca72", "value": "T18B452302A3D880A6E8792F3419FF01571E3ABD619E70C36B370DAD1E1973585B63672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089596, "uuid": "9f00ad45-f8b2-41dc-bbb0-7a11daf4e8d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089596, "uuid": "a3b95cc4-8e11-41bc-b275-fe8124f3be16", "value": "24576:LyYGXE2pg1BQUd4cK6IfmJ4WLYzx1lMjkXEzWDbI5N4VD7c:+YGPg1BQyK6IX70zW/Ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089596, "uuid": "d6f8dcde-c724-4710-bbcf-54b4bbe1571f", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089596, "uuid": "d6b4319e-d248-4ffd-8650-45e00b3e9483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089596, "uuid": "ed4e60ba-741d-4713-a3f5-58bf393b3385", "value": "fc8548dce5acdaf961147f321a92bc0abfde3f8f986850ac0236747d832e0f65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1130b5a5-f2a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1684101340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101340, "uuid": "e2696469-0b52-4c7d-9e62-2b181db60759", "comment": "Malware payload (Cobalt Strike)", "value": "708831126114de4b5e8084c339a2baaf", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101340, "uuid": "22eb4e80-5eea-4664-9580-27cc7df19b7f", "comment": "Malware payload (Cobalt Strike)", "value": "fcdf4497184a11dda48b59d3e558b6a429b204cc80669f00920291f2b467a12d", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101340, "uuid": "00fec00e-94a0-4da5-9763-0fa3d08e4add", "comment": "Malware payload (Cobalt Strike)", "value": "8ca717a8ee422ff0690f7cb0c3ea9d9ac7dcb288", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684101340, "uuid": "44949cea-807f-4df1-bcb1-aa8cd5bf52c4", "comment": "Malware payload (Cobalt Strike)", "value": "8be4219af898e899fce75d8b2486afa0550b55760fd03760916a75fc503b8e10e09cf616b397f01943c3831b267b1f59", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101340, "uuid": "2bbbbd36-d5a9-4884-806d-3d0ecc4d4ce2", "value": "T1B3557D42F3B482B9D47FD279C6928B4AEAB1385087718ACB4541D71A3F332F19D3E625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101340, "uuid": "68a781e2-e9bc-47ae-b513-7e9f0201ad35", "value": "516caab079c572ca44442c1e48a4efd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101340, "uuid": "899c29f3-3e4c-4f1a-8c97-a12f4df6efdc", "value": "24576:UyyKuj5NbJ51OG65IGC6V8u9gA3lob9Ov/U6mTRcaT2Cm:Uyy/NlOGYCT39O0vBSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684101340, "uuid": "f9bc270c-a11a-4385-a8dd-e7a75b562617", "value": 1321984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684101340, "uuid": "57d5cd31-8168-4b23-b058-91d77a682301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684101340, "uuid": "54da62bd-b803-418e-929f-b20c36f5f2a9", "value": "30.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c42a88-f23d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684058309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058309, "uuid": "a938ab0e-2b56-4807-8c79-5b72f00a7f70", "comment": "Malware payload (AgentTesla)", "value": "4c0a127de143c39b7a6fdf5eed1ecff9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058309, "uuid": "026eb35a-02d2-4947-bc99-85814f3650f4", "comment": "Malware payload (AgentTesla)", "value": "fd0d5e94af637a6270fb09d1b157119c4e5b339cbd9f7f971ed08733985739f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058309, "uuid": "b7c1b800-46f3-4a70-be6a-d5b8c602eaa2", "comment": "Malware payload (AgentTesla)", "value": "06d71a12b59daec6de94ed79abf4c4896f9a751f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684058309, "uuid": "065b60a5-a307-437f-a2a3-c81783af6f3f", "comment": "Malware payload (AgentTesla)", "value": "19031ede7090e15679e258b520f4e8b53217a46a7fdba7d73cd7c5d0f0d44edc0615f2e7529dd43fdff2c13472a9564b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058309, "uuid": "07cad5c4-e806-400f-a5f9-2a9e95fa2f1f", "value": "T1F805483C19BD263BC179D7A6CFE0C427B114A8AF3121AD65A8D757A64346F2235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058309, "uuid": "a40bdfd9-bce3-4ad5-a484-508b76d062d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058309, "uuid": "5f9ce59b-97fb-484e-84a7-285ab26ae1f6", "value": "12288:QG7/9WflU/9FDhwFsI4ooI05IySyA2Eb/ajJ0xO2RBFTGgFYmdeka/Vtv6y:dylUVwFs75IySxRLaJ0xOOBFyjmHanl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684058309, "uuid": "ab34a3b1-9edc-4c7a-ae12-d40ed9cb7321", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684058309, "uuid": "fc0abf6a-d13d-479a-880c-8649e2374f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684058309, "uuid": "b0dd5ea7-7c27-4985-9aa7-f96d75029271", "value": "fd0d5e94af637a6270fb09d1b157119c4e5b339cbd9f7f971ed08733985739f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6335fb-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089598, "uuid": "3050372a-c8cb-4d79-bf10-bd8e2bcb5eb5", "comment": "Malware payload", "value": "75b644e2f47823965505f3791db7046d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089598, "uuid": "73b70392-6432-498f-922f-dc55e4a7035a", "comment": "Malware payload", "value": "fd23e97ad2b792a26e1e7c5a48a098b2ba00c12e8e6e662722be794feeedd3be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089598, "uuid": "d538a68f-f694-4702-9df1-27b7eff17e66", "comment": "Malware payload", "value": "aa10b6cae76ad49689aee6b331a5b431e2019a58", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089598, "uuid": "2b00ba82-7ffa-4aae-a0f1-334164caa83a", "comment": "Malware payload", "value": "213257a5e770e17c888fd59fd01b9c4440838b80ad2d12d58145979a126c491a4f81eb25615bc6fd3cbca778d416fbae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089598, "uuid": "88479512-0973-4b95-b241-f49b33fdc271", "value": "T1E3452346AEF95072ECF51B304CF207D30B797CE62C38C39B65A6A85718736A0A471B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089598, "uuid": "4c19bd21-9c51-4537-881d-4983b06ca0ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089598, "uuid": "2ba9ff6c-6f2a-42b1-a57c-d8a0a3f166c7", "value": "24576:Ky15QghUQSn0y++gPEp2yyAK+/wXYoutnuFsQmGTjt:R15ZUQSn0Ms9yyH+KKuuQzTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089598, "uuid": "9f56b171-606c-4578-9860-e69ffa34a9e2", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089598, "uuid": "a7d062b1-cc54-437f-aeb5-47a66dbc4750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089598, "uuid": "a1fc3bcd-6f64-4584-89e6-c24fe3f28f81", "value": "fd23e97ad2b792a26e1e7c5a48a098b2ba00c12e8e6e662722be794feeedd3be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb126380-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089599, "uuid": "369e6228-59c2-4776-966a-39eb53037dc1", "comment": "Malware payload", "value": "34393d22f966076da3498d5917ea09d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089599, "uuid": "54dc2102-f855-47ee-aecf-e46d2a1b9227", "comment": "Malware payload", "value": "fd338c4a832fe55a3a38647a53ec775e58d8f2b8a4ccc12ad85e0c7884381811", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089599, "uuid": "90229ce3-ef75-48f1-a84f-e9fcb1f8f571", "comment": "Malware payload", "value": "07cdfca7f90d84d7f067c2673a5057ba2acaa5ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089599, "uuid": "2e9eb64b-9861-45de-adaa-47a39ec58488", "comment": "Malware payload", "value": "5042244681b09e78351efc18528ebf5b8b1979c0588a73c78b371fd5c4a8908c948ee18b0215a45bc06423e513414f19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089599, "uuid": "118712e0-f654-48ef-805d-8c901d4534eb", "value": "T14C452342F5E92026DD79237064FA46C30A3B7E7148A9827B27457C8F59737E092F236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089599, "uuid": "b0464dd6-7ede-485d-8a80-d2cafb8a6062", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089599, "uuid": "2adefb5d-f3cf-4484-a862-2d6ad63ec224", "value": "24576:byecw9JB1tkJlppN43ox5hPXcLKZ1GvUVP9/:Oej1cb+VKZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089599, "uuid": "887c54b7-dbcc-4eb1-ba87-b6b2eaa63323", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089599, "uuid": "bd0d1605-b7d7-4ddd-a1a4-35c0a3ec98fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089599, "uuid": "4a189737-ec42-454b-93e2-c86c7e8546c2", "value": "fd338c4a832fe55a3a38647a53ec775e58d8f2b8a4ccc12ad85e0c7884381811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba6e81b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089600, "uuid": "5b1f93c7-6413-4786-8deb-26ecdb82219e", "comment": "Malware payload", "value": "5367360bcfa107945e4c5b739295a058", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089600, "uuid": "b75a59cb-3d6a-4e3c-9f8d-0797a2ebed3b", "comment": "Malware payload", "value": "fd3b6f58aa99b2ada2408494530baafd67d68da86796ea46570a01b55f7bb3b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089600, "uuid": "c095437f-ccff-45ca-983b-101d0fd49107", "comment": "Malware payload", "value": "7ec7f043fdd13af7284044f33247ac600a799a41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089600, "uuid": "092b4f5d-0892-41e8-bfaf-e468b95faa86", "comment": "Malware payload", "value": "a52696920c5aa046c849d5ba2d9a880ed073a20563481b28ee4b834247f1640ad70ccdb9dc58950cbda93db2a774dabd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089600, "uuid": "80ef2ffa-b01d-4cbe-b6fd-a5ff681d5252", "value": "T145052295ABD85133E8F837752DF61BD31E387EA24C7486AB336254060CB36D0A175B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089600, "uuid": "fff52d2f-28c1-428c-a24c-91ff1d2b59a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089600, "uuid": "cac6b13f-353d-40e9-860f-2933bc9d732a", "value": "24576:zy7CIpUcLxsZvqBMheHAEotox5jnSbySP:G7CIpRLxsI2e3oax1nSbyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089600, "uuid": "3d261cb2-46c0-4497-a09e-b9acd3c5e7db", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089600, "uuid": "8b2dbaaf-5b81-45ed-8bd1-04d7e315d8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089600, "uuid": "ab3bd661-2d3e-4cea-9bb8-dc9c23f11aae", "value": "fd3b6f58aa99b2ada2408494530baafd67d68da86796ea46570a01b55f7bb3b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3ed35b-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089601, "uuid": "24df81d9-b310-460f-a730-a15b71a793ee", "comment": "Malware payload", "value": "c55e72f80e1b0bbea3b7dcd612b6a12b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089601, "uuid": "b29c92e7-c992-4668-9622-c8f671ecd8dc", "comment": "Malware payload", "value": "fd933feb821f06d3f71361d1846ba2aeadda35ed1a68226acccbd37912db1380", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089601, "uuid": "f8b4f016-3c76-48e4-8bc1-d2257535d550", "comment": "Malware payload", "value": "ff7a90391679e6a56084f62fccf0bb6208d9e013", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089601, "uuid": "b134d285-de51-4f4c-be47-c87fbc980973", "comment": "Malware payload", "value": "a2e4e4bb14c9176ccbc3373812395e2ccb3f4b04793f0dd844f8fa888164127d3c4b3524df76390e646eaf46a98f58d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089601, "uuid": "be6ef8ec-7597-4e49-bae4-8f3251103b04", "value": "T1CC1523026BE88122ECA1277198F723930B727C715B76871E3791688A4D636C1E573B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089601, "uuid": "59d499f1-03fb-4017-a7ea-2cf4a8241339", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089601, "uuid": "5ccb6969-55d7-4b5a-9af0-f1d5f3a2d24f", "value": "24576:8yBeyKDPEq5FD0eR2UsjshZ9IHt2ae6ttg:rCwEYo2OZCHg7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089601, "uuid": "6dc39c3f-6622-4708-af39-ed12b1e14102", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089601, "uuid": "769f1f1c-351f-449f-be95-0e9bbe675814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089601, "uuid": "df434685-2cbd-47d5-9b16-dc5929f8e293", "value": "fd933feb821f06d3f71361d1846ba2aeadda35ed1a68226acccbd37912db1380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc65de6-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089602, "uuid": "e10738e5-a1cf-485f-9410-bd42d9de943f", "comment": "Malware payload", "value": "5b0ea09640c86c25dd2aee85515b8aa7", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089602, "uuid": "e9c9daef-d760-48d2-abe0-40716b3fcce0", "comment": "Malware payload", "value": "fd988b737500c564d143095972b20f6a0acd5a4f16a0e10fec8c4bb776469601", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089602, "uuid": "c7fcf211-951b-49ad-92a7-e5b7a426deef", "comment": "Malware payload", "value": "600fe876b6d78b6e7efc3e462abe0a4a5192dc3e", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089602, "uuid": "663585ad-a13a-4c88-8718-97529136e06a", "comment": "Malware payload", "value": "85009c0dd5b2e60d8070d04d23843f53bd582a8de88c2922112b1719737116bcb16fd6017241c1b69fd606e6a94fdb21", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089602, "uuid": "602d5a5b-2f6b-48a3-a31f-82061078fd1a", "value": "T1A3C4AE82E749A9A7CCF7CB3246BA07264286DC154747EB830D44733C49BF9D06B69EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089602, "uuid": "c6c5b9f8-47a1-4269-8a55-e14bdec7dcea", "value": "12288:W2PRSBpD41leMx4PsvRO33ncpQdtq+taBgYXjEAx:MD4neMSHMQdGBgYXjEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089602, "uuid": "dbf03fc1-91ce-45f3-a8b5-2d360f4c5e74", "value": 574192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089602, "uuid": "503a6626-35b4-4e96-84e6-682e144ef42d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089602, "uuid": "05fa0078-7e07-4133-8c5b-996cb6f6de23", "value": "fd988b737500c564d143095972b20f6a0acd5a4f16a0e10fec8c4bb776469601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb74d53-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089604, "uuid": "464d9361-2970-46d5-a451-bf4ea48585aa", "comment": "Malware payload", "value": "7efcf50d722b6259120d33df12b5cbdd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089604, "uuid": "8a8d5619-75ca-4864-8698-18d24260c274", "comment": "Malware payload", "value": "fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089604, "uuid": "91887a14-5111-47ac-87bf-293cd1458806", "comment": "Malware payload", "value": "b1af7de0d8cb5748d87524ffea340c0c414c38a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089604, "uuid": "8a5a7937-8112-4017-a5cd-2d187cc1945c", "comment": "Malware payload", "value": "e7ef73e4bbc34518c21c916f92499f5eddef2f706f10a33a68393cf7a9cdfb8226fc88941c3f19e717fbe0861dc80297", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089604, "uuid": "03daa117-9d79-412b-a5bc-0642838912c2", "value": "T1B4452393E1E9E436E9F01374A9F713832535FD72DE78635B7B49155B18A22C08231B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089604, "uuid": "02e5fd16-3b28-4fdd-936b-11c8dc34f32b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089604, "uuid": "39cc787f-565d-43b1-83db-1347b9f8211a", "value": "24576:UyHnLS2B41PUm8xwylQWaPxk2s2X3s9JINiO9UawWKx12rfpsttnLZ:jHLSD1PUfwYQXkR2X3Hr/wlXspstt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089604, "uuid": "d3be0a7f-43ee-422c-b0f7-d665b5942cd3", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089604, "uuid": "5842b593-e2df-48ff-8121-2846d6051462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089604, "uuid": "68aee8a3-5d37-40b3-b463-174c921b762e", "value": "fd9ba5fdb9c7a11812ef8aed5ef7afda54bed718c57f83e2dc39463348594c2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c040e262-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089608, "uuid": "755cfc7c-15a0-4c87-b1a5-7bc2f47da6d8", "comment": "Malware payload", "value": "64a30db275f270e4d7b0ad7e568cfd36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089608, "uuid": "90df2e7e-90dd-480b-8350-9db04ac00dc0", "comment": "Malware payload", "value": "fde9b68566d7dd06cda962c5b5fc3964be130480edccde10a7009c244f3cfba7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089608, "uuid": "0d5162f9-ef0d-4b9e-aa90-b804d3d07b53", "comment": "Malware payload", "value": "4f159c15fa9d7aa53c7f79fdee8566b305047284", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089608, "uuid": "9218a5ae-01a7-48fc-a8be-612126e3bac3", "comment": "Malware payload", "value": "d0ecb93567141d64493c5099a700a11a3f81f084702569aa8561259bb3edfd28e65cde2e5defea164a9709bd3369fc63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089608, "uuid": "96144c6e-fabd-4dee-8b31-2b613da1ae46", "value": "T1174633B8786725D8EC96D331C787120130B4B277A8262AE7F809C65C25CD93297FE779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089608, "uuid": "eb9595e5-c187-46d3-81f1-8fe4ef994712", "value": "ac736e50a441f678b7e94d5a21434881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089608, "uuid": "3f4054ab-9702-41d6-b1f9-bb75a4ae84b6", "value": "49152:bRgepwuWlv9/ll5xRHnb0CuamXHT80sZ0eZ/Z74qR+WaYVNUbuofcCrPfcAVfU50:baFxlLO15AZ5xNCuo5rHxyWQ5HolZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089608, "uuid": "554b5ec8-2edb-4186-ba06-8886d6428cb8", "value": 5827072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089608, "uuid": "da735877-8f42-4598-bc05-3fbe3fa2f185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089608, "uuid": "736a6e56-0a41-4902-b498-188cb34eac03", "value": "fde9b68566d7dd06cda962c5b5fc3964be130480edccde10a7009c244f3cfba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c101440e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089609, "uuid": "46738bb2-a08b-414d-bd3c-9b60c6814d89", "comment": "Malware payload", "value": "3073d7e1648638cde059a05b8398614b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089609, "uuid": "441f0f26-c149-466a-b38f-c26b73cd173e", "comment": "Malware payload", "value": "fe2b1b0feaa71d353720ba9872a3f74979194d47214457ae430d6e5a4104b8ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089609, "uuid": "249146d2-c6a5-4e61-946f-85b8dd6a2a86", "comment": "Malware payload", "value": "9195fe589883bf0b85fdf5f7e18e5d44d2ef3eb5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089609, "uuid": "41d6930a-3c3b-4644-b6f7-1405d18b1308", "comment": "Malware payload", "value": "44e36c5b969f421ce14990b7b5f1405a612ba2bf035577297e893ef6e132485d60f85446671a72a0eb47c769a56798de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089609, "uuid": "2583324d-1b9f-49ea-a495-47dfb484743b", "value": "T1D5452302E3E89831E9F137B061F683674E367CA19E7407526A8F6D9D0C73691B43276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089609, "uuid": "0ff3bfb7-8fd5-4665-af7b-1d90670c4a60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089609, "uuid": "eaa5b1f5-7abe-4448-86c6-569bd325c18e", "value": "24576:7ygknd76PmRLbL3DUnS30zSl/hODfaw4Ub6dfMDwsKwdU4LY:ugOd7rR3zYnSE+lpOGI6ZMDw6dUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089609, "uuid": "5fb1b53b-05c9-4550-8674-fde66f6974ce", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089609, "uuid": "24718e16-d859-4f57-9858-cba69c9b303a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089609, "uuid": "39add4a7-ceee-445f-9386-6513fff02af3", "value": "fe2b1b0feaa71d353720ba9872a3f74979194d47214457ae430d6e5a4104b8ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f027365-f201-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684032348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032348, "uuid": "8a571719-0a77-4ce9-97fb-4d57cbe0f4e4", "comment": "Malware payload (Mirai)", "value": "08a9b2aec7717fbd64f6a91bd9db0ffa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032348, "uuid": "7e9253fd-70c2-4b6a-bcc8-2052b848d949", "comment": "Malware payload (Mirai)", "value": "fe2f1ab35e53c7017cdb93d15055096472365a7fd518fa13602727c0d483b712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032348, "uuid": "e767dad4-2f94-4545-9f98-44a6d6b68499", "comment": "Malware payload (Mirai)", "value": "e13a37c4413a5410974de73968e764c406df046d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684032348, "uuid": "058d1b2a-0383-4513-a291-df91d76f03e5", "comment": "Malware payload (Mirai)", "value": "31ab77666df4dafbd8059f7519731e2400a2a1db797413eba0fcd63807bc76004bd3e6c5deebec18e3cea3e27a7a67b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032348, "uuid": "985890cd-3a79-4343-b666-3cb6b19471f1", "value": "T117A2D01576A32D55F3AD2C3CCD6E836BF9660BFC90F5327679405620C94D24A2E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032348, "uuid": "99e9d33f-5395-4e1d-bd15-6fea455fbbd4", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjJETThymdGUop5hM:UvQn4j+ZO5fKAlxefs3Uoz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684032348, "uuid": "de076da9-6c7c-4acc-918f-7448641558c0", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684032348, "uuid": "f2e7628b-c015-4f25-9084-69aa2e9996c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684032348, "uuid": "baee75bb-598b-47ad-b9bb-264671a731b5", "value": "08a9b2aec7717fbd64f6a91bd9db0ffa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c0bf60-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089610, "uuid": "75ba3828-f443-4f83-93f0-59e854a78a58", "comment": "Malware payload", "value": "2301dd64ea65b5ecaed2972125853a0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089610, "uuid": "570e8c04-e30d-4f58-8187-1c50982e0986", "comment": "Malware payload", "value": "fe4e83b188f0972ca7183f5e848dc0685bc85162482506d54ae4012126dffa9c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089610, "uuid": "fc2dc45d-09d5-47da-8c7d-93ea18d799da", "comment": "Malware payload", "value": "401f43fa0960a35e8ec01dce9c5eeef14d5a5af3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089610, "uuid": "2c4e3d37-d4ac-42dd-94d4-0006990b9db3", "comment": "Malware payload", "value": "3a4289252f8e5164c9afddc4db2fcff7819b36a2cab5a93c31b34740f189e0f68d7f9279ba7ac0588d3882c05495745e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089610, "uuid": "4c5d85b7-9806-4393-8143-c5bf5a7ad377", "value": "T150452305FBE9A461DEF43B7018F103C31DB5BCE18E38D75E1645A94B2EB6688E930366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089610, "uuid": "3108c406-09b7-4795-858d-9431752a5864", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089610, "uuid": "61b29373-57c0-4301-ab90-7ba9b66803ab", "value": "24576:SysKi/tI0w9TfVJdGKSZBxnLvSCifA0L/2eUleGgIi:5gtI0w9VInLvifZqpleGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089610, "uuid": "bdae9b38-f7ce-4431-90ac-1ae6f803cb39", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089610, "uuid": "074ce27b-d342-4f7d-af1a-5e3836362dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089610, "uuid": "8748b9d9-8489-4a5a-abc9-57c9fa58a73e", "value": "fe4e83b188f0972ca7183f5e848dc0685bc85162482506d54ae4012126dffa9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2617847-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089611, "uuid": "72f791e3-ca2b-4d22-827e-a5850df117a1", "comment": "Malware payload", "value": "7ad9e7782adb97d00699301cb0a415c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089611, "uuid": "1f93cd4e-bbb6-4ebc-ad41-5d9e4b8072bb", "comment": "Malware payload", "value": "fe616b2c98d4cfed8780c24c4c9c705274846cfb86c6e7f4a1e5c9b1fa03b381", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089611, "uuid": "4b8b63c0-ebb0-424d-adef-772c12ffacd0", "comment": "Malware payload", "value": "92b0ca7f27b2131597406f61c4b6048ee8c5897e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089611, "uuid": "3e5585e9-3b55-4673-b0b6-6fd28182071e", "comment": "Malware payload", "value": "10e23fdf10f63f411c21dcf764417b248ed6561378bf46595c73e1ab0fe6bc17828a03504092403f253dbf4cdc240358", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089611, "uuid": "796b4e77-02fc-4df0-b677-300f472dc454", "value": "T175152302F7E850B9CAB117B00DFE06C31B39BD61AABC579737841A5A4DB2695787032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089611, "uuid": "e510ba29-9109-40a4-8098-e9fcf787f733", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089611, "uuid": "edde4b49-8d12-4ae0-8174-06e8dd1713b4", "value": "12288:gMrSy909PlkxR6vzKIPZHeMfFMYg3intmkxZcJ7Qzr7KTQBaf9Ea/t9jlLk:iyaggKaiYg3intZLzmlbj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089611, "uuid": "e5bdde2c-b40e-4734-b76c-4f9a62f5286f", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089611, "uuid": "0a0de3ab-e907-4b27-945c-1576161774fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089611, "uuid": "7bdd4f33-e8da-429f-8158-77822a1342a6", "value": "fe616b2c98d4cfed8780c24c4c9c705274846cfb86c6e7f4a1e5c9b1fa03b381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30893fb-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089613, "uuid": "5a4845eb-8e6e-46a9-a58c-3a262ab9428a", "comment": "Malware payload", "value": "f14acfc36fe6c75486e293452050873a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089613, "uuid": "c2a4e6c9-9084-41a0-8799-62649c11c741", "comment": "Malware payload", "value": "fe8cea0fa501f14dced5646340afd5ae6aab600e8efb2e8e552addf955f0a7e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089613, "uuid": "a4417a6f-58ae-4134-bee5-624582fab2db", "comment": "Malware payload", "value": "99ebb70a446116aa0efdc498aea1c10847311feb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089613, "uuid": "f30c7622-d34b-4cc1-99a0-c2b4c84155f3", "comment": "Malware payload", "value": "56243458f577083b06ade7e3902f18030294f4e1d20476c9c89f3c3bad74f0f00a672ab745e20c4d60d32e2cc9376693", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089613, "uuid": "600d441f-1c8b-4784-98d9-b4a67025340a", "value": "T1C1151213EAC95473EDB81BB009F717830739BD9249F59A572A806D0E1872780B93677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089613, "uuid": "c3f0afd3-fbbf-406d-8e28-b004b463a893", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089613, "uuid": "0f067b5e-a31a-4fff-9b1c-4432400fd292", "value": "12288:zMr1y90dJ17Xvwlbq8I15mx3PKK+OHEaD1mR05HzAvDky/sIb+p9NP1HJ0/7mGCx:eyzbqBTEJHEaD0+5TYDkW+f5Nt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089613, "uuid": "4e93b870-8a75-4bf7-a370-3061c096b6c2", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089613, "uuid": "8a1ace7d-35f5-4d6d-bc81-4982c6742b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089613, "uuid": "f6bc2fe4-011c-4995-8371-e452a03e71d2", "value": "fe8cea0fa501f14dced5646340afd5ae6aab600e8efb2e8e552addf955f0a7e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d08418-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089614, "uuid": "b01a22fc-3a20-49c5-b118-dbe7421d2d93", "comment": "Malware payload", "value": "88c1ee32fb16e295b2e845bd8dd51b93", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089614, "uuid": "2c08cd4f-22bd-4423-a116-e88caf205ce4", "comment": "Malware payload", "value": "fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089614, "uuid": "fb13ce71-ab43-4549-a716-54407c4a831b", "comment": "Malware payload", "value": "6be47a42849f15f565da66dfa097f6b5265f5075", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089614, "uuid": "2d5b94cc-d784-4ea0-b555-ae3f3e899d72", "comment": "Malware payload", "value": "14dd93733fe86b725845b8c4d9f4ddb14c163038210e57d74ad69dbfa254bd67789a658e1076b76ea03d3b3a8e695ba7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089614, "uuid": "7b4c2ab2-dc24-43c4-83f6-667c7d7541c3", "value": "T1CA452317BAD98532D87427F488FE13570B3ABCB5AE7492732294AD361C72691F132327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089614, "uuid": "53e96f3c-66c0-4bef-9ec3-e127a1b1deaf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089614, "uuid": "8b4e9efe-ee03-4fce-936e-0f40743008e1", "value": "24576:+yABLYhtlEtECOl426WoU44ZkiyW0RHWNBc2DX3MI:NAurlEtEe8xy2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089614, "uuid": "0b777731-cd8f-4ed8-8bcb-9998679503d7", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089614, "uuid": "6cdc6843-f26e-4380-bc5b-8d3545ef45e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089614, "uuid": "d9105104-d158-4901-a152-5311205cd557", "value": "fecf856b99edb62d300108f908c3fd958e74291ab84f9f3114caaaf9de229680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0054057-f239-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684056483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056483, "uuid": "4f1f916c-da44-44e8-9deb-04ca1fce800a", "comment": "Malware payload (Formbook)", "value": "36248ceb3d6352e931e0726a0494bc4a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056483, "uuid": "7151c1d4-476a-41d0-a6e6-b358c1c037ee", "comment": "Malware payload (Formbook)", "value": "fedc599e2ac5deae790a550b54cc5f497e3f0d3e8519ce45202c7e5a05590830", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056483, "uuid": "bf7a6176-049a-4ccb-933b-e8a813067993", "comment": "Malware payload (Formbook)", "value": "b760357d85b6777414acd109a27110c59132ea78", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684056483, "uuid": "6a1f5bb0-570e-4ebb-aaf3-a86752e56a8b", "comment": "Malware payload (Formbook)", "value": "688ac29146b61df753c075ea467d4a60feacd62ff54c9a525f85dd7342a17f263f4f9580cedf3f79d7923de047dc42e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056483, "uuid": "dbf41ece-bf8e-4b4c-b9d0-ba1f8d12e3a9", "value": "T121441225BFB1C06BF8A755720E7B4B97AFF7A5171025DB0B23616E48B9332019A0F325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056483, "uuid": "569946aa-cb38-49e4-8ac8-f555bf67fac8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056483, "uuid": "80142644-aae7-4ee9-a0bd-a0f29c9160cc", "value": "6144:PYa6EvsLPGvxbRe1LNTon6q7iJxpDfusgoKTEeJt6Huj:PYiv5pwon67prusgo0TIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684056483, "uuid": "cfa44f91-93ec-4dfc-8c6d-7eb0a47d649c", "value": 255216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684056483, "uuid": "b9c93bf4-5301-41e6-be4e-af7e13190120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684056483, "uuid": "bdb4002a-eaec-414d-85ce-87a7c346ed11", "value": "fedc599e2ac5deae790a550b54cc5f497e3f0d3e8519ce45202c7e5a05590830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a0bf37-f287-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089830, "uuid": "a32b16e5-464e-4079-8157-f1fdee2ae17b", "comment": "Malware payload", "value": "118ce670012f32204618be3cf568f155", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089830, "uuid": "093e5ab7-bbce-4561-9e0f-ca12d7203190", "comment": "Malware payload", "value": "ff47c707f035d4cfcceee231bd4880c7e40f3c272762ffc3b5a55fd77017a22c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089830, "uuid": "efb41955-bbcf-4618-b6d3-d6999c2e6559", "comment": "Malware payload", "value": "007fb52e680280848009936dcb34076d8a5efdf5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089830, "uuid": "88cb4360-4ba8-4693-b7fc-f4e0d154135e", "comment": "Malware payload", "value": "444a8aa609f4e731c74a683719d56ef9e55cae5003a8c420daa16aa53735cb7888b387d03af9632e47e54f4ee878cddc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089830, "uuid": "abe9c032-f16c-4c4d-b3dd-46601f2eed33", "value": "T15F14BC98476238624B1B7D766751A1BAEFA90EA0C3D4459FF8EB3290F1DFE0ED8D0510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089830, "uuid": "a85c66b6-764b-45a6-99be-f7716457f0cd", "value": "6144:VSHoB4U5WDPbj8lx1K78TyTCuuSWD4OKCr1K9t00pXh:cKBoXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089830, "uuid": "5b1358be-88b7-420e-8cd5-e1f49832562a", "value": 200117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089830, "uuid": "6eab4335-7c43-40ea-a24e-5ca9ef1078d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089830, "uuid": "e253432c-0633-46dd-ad77-9adf6a83d970", "value": "Yyeb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c510c4b6-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089616, "uuid": "48f5dc32-f28b-4a99-bc0d-23f87f1ce968", "comment": "Malware payload", "value": "41f6fa0bcb7ebbf71ba9f7bad407648e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089616, "uuid": "078f3df2-a06a-4551-98dd-5fc8851ea77d", "comment": "Malware payload", "value": "ff6f9e2634dbeeeaded817e008e7dbe487c316a7546093de3fee20dfbc21b4bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089616, "uuid": "ae9c93b0-fe43-4a29-a775-74079ebeda4c", "comment": "Malware payload", "value": "c9947b3e67322b76afcc8a533fb481d73ae61b1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089616, "uuid": "cd5504d1-e602-4309-a1e0-d46bf5b9b2e1", "comment": "Malware payload", "value": "f51524c5353793ac13c3ea04073e6e4b761eae7d56da48c77269a1842fa3aa35dd847c0091fd57349bbfe37383871c6d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089616, "uuid": "fa8adfd3-8503-4046-a63f-daba5751202e", "value": "T1D1452313EBE45171CAB43B74B4F91793093ABCA38870866B234AAC5B1DB27C5143677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089616, "uuid": "443d31e4-21e3-44c0-a26a-cc3eba140dcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089616, "uuid": "4106e4a2-2eb8-41f4-9cd0-fbe4674e8e6e", "value": "24576:byYK08jGLtsa5+k8WXxRYb04Qg43+F5yzmqRHtRk6g5w:OYBsatv5L1x14UiumYHIv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089616, "uuid": "8f763266-3c45-410f-adf9-9a400c790e1d", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089616, "uuid": "14ebc087-d33e-4ccc-ab6f-605d6c51c243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089616, "uuid": "1aeac6c0-722b-470f-91d1-31ab4bfdc03f", "value": "ff6f9e2634dbeeeaded817e008e7dbe487c316a7546093de3fee20dfbc21b4bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dedf3e-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089617, "uuid": "2c05f5e8-1490-41d3-b283-81c95e9f939c", "comment": "Malware payload", "value": "b7f6d0b549859f41392f5e0f6346bb77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089617, "uuid": "a24bf85a-3036-4ea9-8358-caea698f56ba", "comment": "Malware payload", "value": "ff81f851e4d16ec84fd89649249ed67f4d38f352ca42a4485c586bd1781c6159", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089617, "uuid": "22d1acc3-ba22-411c-a897-2aa7c096e08f", "comment": "Malware payload", "value": "94c83429491f06dccaa380baab2c55ffd554fc91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089617, "uuid": "99518ab2-1c96-45a5-b8be-9fec5271bc59", "comment": "Malware payload", "value": "756749d910a1a250ea3a18e1bba2599b9b78544239271a5bb70b2a16d14b332727e5e06450ed089349e6ea7f2abcb6bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089617, "uuid": "a6952550-813c-4c54-907b-179f58d2e05a", "value": "T1AF452212A7D49872D9FA47B054F603830E32BDA1E9F8C39B2745A84A1D73994B07377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089617, "uuid": "f7436f61-17b9-4173-93c8-d4742ca9bf26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089617, "uuid": "13b2490a-923a-4f38-877d-bb0676585f87", "value": "24576:tyQkcwICrmKfIakeuXaGx5VJ4d0+gIL7rfBxzooVMi2jiBSb5p:ItrXLeaGxJ4d00f3Mo7aiBSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089617, "uuid": "311eaabe-945a-4882-9273-326f6f7432ce", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089617, "uuid": "24601e81-7bc7-459d-a46f-4366bb07b3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089617, "uuid": "f07ce1b1-d676-47f4-a9ca-314d658ec6a8", "value": "ff81f851e4d16ec84fd89649249ed67f4d38f352ca42a4485c586bd1781c6159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67bfc91-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089618, "uuid": "8647a73f-6e19-4638-a5be-ddce246dd73c", "comment": "Malware payload", "value": "862a0a68c747cbabd3447273b160a392", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089618, "uuid": "86895c7f-3f5e-421d-8ed6-bb9aaa0ca984", "comment": "Malware payload", "value": "ffb2caf2181442fa0c3f45eb342e31f7283eeaa8786f5ccffe0f8bfcfd166e8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089618, "uuid": "124666af-b835-4ca8-8a13-66f268559751", "comment": "Malware payload", "value": "3a4a94fc803dcbfd0a280fbbcc736f701a1708fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089618, "uuid": "8f89fd9c-95cd-4b88-b771-644a5e77cfb8", "comment": "Malware payload", "value": "c988299b5d18f0cc3c610c45461911fdd9bbfadee4cb9a0b8cafaadcc73fc7e22fb6a0e58d207c204899f97ee734af15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089618, "uuid": "9ccb2a6c-7b6f-4006-9092-81013de5b5db", "value": "T10515230366D85532CD765BB42CFB07C3073ABDE24A75834B6290A8AF0C73795963236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089618, "uuid": "9a9f4997-5de5-4ffb-90bc-14abe0f0cddc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089618, "uuid": "5cd429a8-7a69-4659-97d9-8d505c6f6e83", "value": "12288:CMriy9077nTnJ0eAkGfy02XWQUibRQrrqXxyMWOrLMoyGdtN/lEWadBc1zkT1ot:0y8nTnKvibggxxWvoyiEBc6TWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089618, "uuid": "a83471a5-1c52-491d-b3b3-c201ed15df87", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089618, "uuid": "c0dc5791-24cf-4a4d-9a18-dfb19b2b9453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089618, "uuid": "eaa6a114-23ce-4bf1-9e72-a3cd1c67f974", "value": "ffb2caf2181442fa0c3f45eb342e31f7283eeaa8786f5ccffe0f8bfcfd166e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7293e61-f286-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684089619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089619, "uuid": "798e6562-444b-449a-952d-5230c11ce9eb", "comment": "Malware payload", "value": "93e673d527a1cc7c71e22a97ac57d498", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089619, "uuid": "e52ca138-538b-4f7c-8854-4605afa8398b", "comment": "Malware payload", "value": "ffcdbeb2750ad3f9e667de2c513c025a2e5920af2677bcebc9d09d7f694e7731", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089619, "uuid": "ab30afc0-3f60-4884-b22b-49ec50f92d9f", "comment": "Malware payload", "value": "f6b4143fd5f1229cba1380bf21e2febfd842c469", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684089619, "uuid": "5206c2c7-a049-45e6-af3f-f631e825f202", "comment": "Malware payload", "value": "65dbada765b3596161f08e3bd393813bedd9e605304701f9855c463b6cbdb53fee73abe7fe13237b5a02233cb99b744f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089619, "uuid": "f99d8fdc-9fc8-4767-a688-44a6a2861c78", "value": "T136452343E9D810A3EDB95BB028F5029B0A76BC514CB4036A27998D8D0EB3BD4F975377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089619, "uuid": "8f0c0f99-e297-456b-afb9-9a83c02c3f2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089619, "uuid": "4ceaefe7-d492-4e6f-bade-51e44fe51199", "value": "24576:gyoA9YNia0WO9DCkSx2TfPKkdm+zZogXbSAdwa:noA8r0HIkS/kHz20x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684089619, "uuid": "4c01293c-70b8-4bbd-b3b1-e867163052a2", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684089619, "uuid": "f4f71f44-5400-498e-a8de-d569ce6d67cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684089619, "uuid": "41f3ba79-3a20-4657-9035-e8bd5c5c6e7e", "value": "ffcdbeb2750ad3f9e667de2c513c025a2e5920af2677bcebc9d09d7f694e7731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }