{ "Event": { "published": true, "date": "2024-01-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-22", "timestamp": 1705968181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "702299d9-f941-4487-8927-3c198e02f5c1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d0ca12-b8bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705884424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884424, "uuid": "5b424541-c9dc-49d7-836d-aaf4fdca6d87", "comment": "Malware payload (zgRAT)", "value": "302ac1d64dabebfeb1ecb1ddbd1f46b0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884424, "uuid": "e9975842-e3fa-4fe5-8e32-55859c8637ba", "comment": "Malware payload (zgRAT)", "value": "003552c7c95845ab8bd7638e9c3365607701aff4d82220154debf9f8559171ee", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884424, "uuid": "605428b4-dcf2-4743-ae9d-c234e229b7e3", "comment": "Malware payload (zgRAT)", "value": "3b44fc274eeb6b20282586f478ead732cfc74ddf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884424, "uuid": "572d5a0d-8436-4897-a35a-fbf273518902", "comment": "Malware payload (zgRAT)", "value": "aa914a5a4d6a256d88cbb453f713694c0d8089be8b9c263656260a45b412c0a49ce0171dbe08290a243d6e0b35f77251", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705884424, "uuid": "e6e22b3d-4800-47e5-bcca-c0846783c95f", "value": "T19A4533A862D47783C8BF463F78E1E641439596378E6BC31F5C8412BBA5213DB5097FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705884424, "uuid": "b23dd5d4-fca3-4813-95ce-c31029c25316", "value": "24576:mGQI5ar88t5cIRAZCEFnYTl5MoBMKszacDpzLUVQ75RVgfsslc1PoX1APBJ4bk:/QIIg8LcIRYCE4ngK0VL8XJX1AL4bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705884424, "uuid": "efb8ee0f-db77-4166-a3a1-c1f77cd287ef", "value": 1253888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705884424, "uuid": "66845c7c-3a67-4add-aaa1-151129b2809b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705884424, "uuid": "37cada23-c0c0-4691-ab0e-9747fe669b52", "value": "302ac1d64dabebfeb1ecb1ddbd1f46b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb0a4e6-b952-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705947526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947526, "uuid": "cd519164-eda6-4a48-bb80-09edc05a0d31", "comment": "Malware payload", "value": "6830e8ef2e3abe892f37e7831982b75d", "object_relation": "md5", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947526, "uuid": "30d399a7-0437-4894-bff6-5fbc72961ee4", "comment": "Malware payload", "value": "006c3e59e32dc5f56cfa6b911e4e4fc171d681e614f3ec48edf232460814d31f", "object_relation": "sha256", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947526, "uuid": "0f2425d2-bd8d-4fe0-9173-b11a1f1b0ef5", "comment": "Malware payload", "value": "ba46ec010b096b2f3a3220da7a1967dc2bb33bd4", "object_relation": "sha1", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947526, "uuid": "563a843a-091a-42fb-a01d-2dfa7cb8f5a8", "comment": "Malware payload", "value": "ed7201a2928f796edd4b47a12fb5d2a4fb3c1c2d2a3d7815de41a047e5591e458d91b98106d4372cb165d4585379d46e", "object_relation": "sha3-384", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947526, "uuid": "9c9ea20f-7a65-4e66-8103-902f5dfcef01", "value": "T1CB06332401B42056D64372D34A76DC2798A9F13DBC2EE79935E7301C6FE45EFA029ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947526, "uuid": "946f1253-ea11-4d5f-8e95-aafed42edfbf", "value": "49152:geR3WIkiKCfh+ktqtQTG8Talg+Z+MLIhWhauiv36mNww/Cr0rn2D9NBI+xjIRjn2:WIyoqWSny+oM+OauiP//F29owr0WvI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705947526, "uuid": "10bcf273-8404-48fa-92cb-db147c0c1745", "value": 3840078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705947526, "uuid": "7c86f720-55dc-468e-bad8-6b14333207eb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947526, "uuid": "8b85ddcd-d11b-4175-b685-0a716d2c0d6b", "value": "2024__is__Pa$$words.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1ae760-b95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705952728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952728, "uuid": "495f7bd6-59e5-4d93-8cbe-7cea05a6cadc", "comment": "Malware payload", "value": "891cb442484c2fbde98cdc96ec19a1f1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952728, "uuid": "6861ca94-3632-4fac-a4b5-6e2d31278ad0", "comment": "Malware payload", "value": "016c02b11ed14355d4b5463e31ffaf232753bf8756d796b23347ea1ed406aa1b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952728, "uuid": "8e1bf178-5a85-4d9c-b976-918679a90c90", "comment": "Malware payload", "value": "de547b47ae112d0a9a2c6be3109f85bf9ceec005", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952728, "uuid": "68b31231-8ea9-450c-a81f-7996bce63557", "comment": "Malware payload", "value": "d46e392f1c6750d675c720575eb2bb13d399b6bcb0fc26b56619c76050b82972790de2fce2e210f53091568c11727154", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952728, "uuid": "ccf73ce4-9116-41a3-8982-1469c95c3416", "value": "T1D6C45B516193E731DC1250BA1819174383AFE8053E2EEC4BE9BADD7E93D5E0D2E6E630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952728, "uuid": "55e34991-a7ec-4f4f-9706-f19353481e75", "value": "4d23fab0881f56a7049de46ea1641459", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952728, "uuid": "914755ba-9d9e-4f78-af13-f4e34e177e2a", "value": "6144:zNBI5vXYuwMvq6iARr1NGHI9lChOrEf7dhdaN1DiBoAm:zN+5vYu5DiCPlgOrQ7FGBAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952728, "uuid": "cfb145a5-34d6-4bb6-a152-68657c003d86", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952728, "uuid": "dc612957-decf-40e2-9041-666c4668ffab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952728, "uuid": "049b2f81-21eb-4799-9612-6b34f02d6948", "value": "HIROSHI3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4268eff-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911967, "uuid": "8026d813-f3c8-43bc-b7c0-73e8126ce3f2", "comment": "Malware payload", "value": "1ebf3cb30f4368e074d6bef49d5f8b0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911967, "uuid": "6dc358af-4307-4abd-9a52-eb33fab37408", "comment": "Malware payload", "value": "023e0962652d8ee9f78921f8f6d3894da732874a3fb9f8234c21eecefd80490b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911967, "uuid": "ee1f224a-f8df-4c0e-91fd-efb2935d5d5f", "comment": "Malware payload", "value": "d8ca6811c400c0c01d0ff8ddeae785014f0b75ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911967, "uuid": "6717ff8a-3e75-4790-ad53-ac00eeab6db6", "comment": "Malware payload", "value": "9f5edceb2932846ef5e8499a3e8404b8277d09e7cf7862fbc1e55df909017c8cb874a8437d4e45944888d46767fe861f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911967, "uuid": "db02f012-f402-4a21-aa72-85e662c1d17c", "value": "T1BB237DF2D380C075D06992FF997677DCE67F3E612D11BEAA46E548ECCC5A080290D68B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911967, "uuid": "4927dbde-14d8-4516-bf7e-aa6bc24eb5f5", "value": "30d574d13f976b7e607482d404ba5a30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911967, "uuid": "ea1d1817-afa8-4a01-ba14-2b3c816b3956", "value": "768:QDeNJaLOa37B8itIJ8oAAWpVF6efd8StCDQHfqB:QDoePQJ8DAWpLfjCDQ/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911967, "uuid": "f16223e6-e05d-4288-9254-ef79bff062d9", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911967, "uuid": "81f05879-269f-4571-8cd8-e1c27559ed7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911967, "uuid": "de3c74bf-d2c0-42ce-b6b0-b7ce894d77d4", "value": "SecuriteInfo.com.Trojan.Agent.312.26229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e641b0a0-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705915836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915836, "uuid": "3edec2ef-1681-4e83-b8e6-970e5a924a92", "comment": "Malware payload (AgentTesla)", "value": "9073fc2b9aac99093c70969eb790504f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915836, "uuid": "0c5073c0-f2cf-440a-92ee-e55728e38104", "comment": "Malware payload (AgentTesla)", "value": "02f07b4febbbf92a6bf6b30a6dd98ea51df1792f014eff9483f57feb0ee97538", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915836, "uuid": "9b78ef25-3a90-41b2-8e00-83d340427e52", "comment": "Malware payload (AgentTesla)", "value": "bcb03f2818d0ed30970e1d0834108eb63ba653cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915836, "uuid": "08042073-edf1-45f7-9ac0-1484e9b1c635", "comment": "Malware payload (AgentTesla)", "value": "343d8c74dcb6ea833e93de8464c0e7b8cc8f1d215ce3f692c462db7379f24efbb9c3843066d4d01eccd2e9a36308a3d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915836, "uuid": "d5bf9465-575e-42eb-9e30-6d971c6876ae", "value": "T171D4121133FDC767D6B6C7F91652A14047BA7A5760BAEB4C1DC920CE0E72B8089A1B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915836, "uuid": "e2fefa3e-bb32-4058-ae97-1f681b0559f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915836, "uuid": "c6b69d95-0769-4f29-8572-3bc1c97c6d57", "value": "12288:KVbAo+Wo74kL+vG8pgybTvlc+lGOhCetc8lJauy:2AucLOhCeZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915836, "uuid": "35689a40-a268-4471-8102-e173c405670d", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915836, "uuid": "a23f69b6-6023-4f29-b86d-b4f31bbd3023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915836, "uuid": "3987f639-591d-4da1-8c76-9838705fb5f6", "value": "SecuriteInfo.com.Win32.PWSX-gen.26233.22129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33570c09-b910-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705918972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918972, "uuid": "8bfd7fb7-c940-4715-b93c-ba651a437c03", "comment": "Malware payload (Formbook)", "value": "6ec1aed2634c28a25d17be93a71150a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918972, "uuid": "5717be86-2576-444f-988e-5865372b2404", "comment": "Malware payload (Formbook)", "value": "0497f6d061c93f99d46132b30e460f5e856ad3749b1d7ac9c9e1351e6db37020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918972, "uuid": "d7693619-f5fd-408c-86f6-fbe8d3099414", "comment": "Malware payload (Formbook)", "value": "cff9dbd638ddfa2209837262cce69359962230b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918972, "uuid": "277450cf-f27f-4104-b70a-b85d39d36be6", "comment": "Malware payload (Formbook)", "value": "c083cd17175f7b239728b048af68d3f54e3e032a08016d6df661abca3f85510c420477f2e3c7bf2905d1e9714cd1bd49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918972, "uuid": "ca2f4d48-d8f2-41ca-b1e5-abc3549db1a3", "value": "T123D40100B3EC9B1AE9E787F66170A04047BA3E6B652AF71D1CD420CE5D72F449EA1B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918972, "uuid": "c7907afa-3203-45fd-b1ab-f848ffd28630", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918972, "uuid": "0787617f-40a4-4bc3-bacc-69bb6310ca39", "value": "12288:NVeo+JS8x48ijEzC4gaByZq2seZUGKlQZtlfHEhNk:6Px4Bxq2seZUOZtFcNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705918972, "uuid": "14ef0627-2eaf-437d-bfcf-1a290b2c7436", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705918972, "uuid": "e94cf3c4-545e-4d82-b83f-af8a6828f355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918972, "uuid": "5e858ade-8dd7-45cc-bfef-3f65b6b6c3c2", "value": "6ec1aed2634c28a25d17be93a71150a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70891eea-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923370, "uuid": "c3f7f55f-0683-4138-bd4d-0e01a6f72bc8", "comment": "Malware payload (AgentTesla)", "value": "f2a94f46e52ad2f3e775a2ca5183d475", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923370, "uuid": "20f07a6f-a8d8-4d5a-9cc5-db60c0ec7123", "comment": "Malware payload (AgentTesla)", "value": "053a822e68c35c99b5033c298b0d45cf270feaa6fff05dbbf948b008d8fa55ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923370, "uuid": "d72b0f94-ec1a-4c5f-ac9b-811d2f5a84ab", "comment": "Malware payload (AgentTesla)", "value": "05bf66c6a952dc33255d965ea7f9f32866b655e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923370, "uuid": "fc5ac8d2-73fa-49f9-bea8-5005302af157", "comment": "Malware payload (AgentTesla)", "value": "1af587af98fd35003a944b09f3bc5e54c91f801d220b3c2c78ae944705de9ee29e013d960817fac0b7f92e9a8aad172c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923370, "uuid": "b74c37a7-ba72-4c7a-bbfc-04d70b544d5a", "value": "T19BE433802163B0A2B3E6618C1F13D10DBD65FB8C195DDF780A976E4314EB2979EC9CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923370, "uuid": "c3d3e303-f9d5-454c-af6e-dbecb769e5fd", "value": "12288:lmnOBoUImkrtovkK3Crc0008nGu5SiTk2pyYUyuxXttBkFSjYNa0yL9LDlzx0m:aOiUIVr2vd3CrcQEGu5SiTkoy1bJtcFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923370, "uuid": "77601b35-22f1-476f-b938-3f9ea4423d6f", "value": 673114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923370, "uuid": "3af1be10-710b-4cf0-92fd-2766e897df5a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923370, "uuid": "ae49d128-ce3f-4c3d-9b94-a3ca29faead8", "value": "nSTATEMENT OF ACCOUNT.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29fc7c7-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911965, "uuid": "82733275-c8bd-4744-875e-083e0862211d", "comment": "Malware payload", "value": "60266b44043fa6eac1cf967fecfa1341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911965, "uuid": "b7793b61-33ce-4fe4-90ca-744ba3762f93", "comment": "Malware payload", "value": "0568d7075ea106c76f2dcbfce8cafd311348475f4c28199256a3265aa9760720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911965, "uuid": "1b851f36-4517-45a9-a65d-e5eb05c186eb", "comment": "Malware payload", "value": "c52d1d33a92a7250ad807c54b90c252f69e60753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911965, "uuid": "3691abc9-00b7-4deb-a2cf-40208e59be31", "comment": "Malware payload", "value": "b02dbbe6c3bc550a0d5443431775a5c54653bd3ac986dbe6f4ba8779ff27a7bf41d288ca1ef3fec36810e34b106a65ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911965, "uuid": "88ed8bfd-fdf4-4603-ab9f-2b5d98204e73", "value": "T1E2D49E0752C956FAFA6EEB74116B7A76E6307F8115486733C3A4FE464832381AD2E10F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911965, "uuid": "0022302e-fd47-400a-b5b2-279e2cfc373f", "value": "9a85427eedfa05206eb0a97fd48cc26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911965, "uuid": "2f8c853e-fef5-4062-9e82-4ae99c5163ee", "value": "12288:SAJKgj3YZj3a+rRLKTI5eOttxuvW335EcZ/mBe08/yXscd:SbJLttx3nKcpfid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911965, "uuid": "7c181eda-f60b-45cc-817a-ae3c20de7d1a", "value": 604472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911965, "uuid": "a70e1bd5-1b28-4697-b3a3-78d4e23b6c74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911965, "uuid": "9920f527-dbca-480f-90e3-c67b70b0dd1c", "value": "SecuriteInfo.com.Heur.13167.1868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81119a48-b929-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705929840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929840, "uuid": "17cd97a9-91cd-4acf-8ec7-5320b21320f9", "comment": "Malware payload", "value": "2c055ae247f20d08e9ce4545083bb841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929840, "uuid": "5dd097c1-a1dc-461c-94b7-99e35c09a48b", "comment": "Malware payload", "value": "069def83442cab92c30f9e797631bdefa36e983bbd861cdc48b1a223463cac00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929840, "uuid": "c1b03de0-c8fb-4cd4-a9da-038cb439a058", "comment": "Malware payload", "value": "27905e0c3af2c6fe7d0bdbf7bf894d397cf57633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929840, "uuid": "1ccba56f-85b8-4267-ad52-7351c3956943", "comment": "Malware payload", "value": "8fce1c3f90e0b7e482f6f6f913b956a14688fb08d0e4d88b861e6d9cd47f8bb676bfbe5b6b7a0a666081694953994f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929840, "uuid": "77026098-30b5-48e5-a58d-2da251639c76", "value": "T13F3622123BEB5810DC7F0BB406614B408ABA7E677A21CFFEDB91219D4A707C0B6546E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929840, "uuid": "da474e25-f74f-4390-874a-6368e7d621b5", "value": "8eff25505db74613252fcbfc5b281efb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929840, "uuid": "e3ae83ec-5163-4157-a234-ab09b0755b50", "value": "98304:cSZZj18jFMWbvIM1pJSUIwm+JkNEBfYK5C3:ZZBGSWz1aUIS277", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705929840, "uuid": "8de36f82-4957-4e6d-ba2c-e9bb7240c1ed", "value": 4980224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705929840, "uuid": "0303146a-3076-4927-9ef5-b828f30f7ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929840, "uuid": "a8fa278f-befa-4efc-be51-494c6c282bc1", "value": "SecuriteInfo.com.Win32.TrojanX-gen.4607.11172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d4cb97-b8f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705908779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908779, "uuid": "e7fd998b-a395-4470-a674-ec849ac8ae31", "comment": "Malware payload (AgentTesla)", "value": "c8060933cc8c797574b51c4051f8e658", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908779, "uuid": "0a3c4d40-1fc7-448d-b623-5156320a3021", "comment": "Malware payload (AgentTesla)", "value": "0739e5052cf110d757aa81d2253f675ee771623b293d000fd0bed0b2f0ed4a39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908779, "uuid": "0880449c-4954-47a1-8f11-f56be9320748", "comment": "Malware payload (AgentTesla)", "value": "60f8833ef3488f47140a7a813c77b73765a4ce7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908779, "uuid": "4edddc8f-fcf4-4539-b862-b5fa6e2a8ca9", "comment": "Malware payload (AgentTesla)", "value": "8215a26a7358d8d9b0aabff0c4b4e7d967a8c5bdd89af9992b99aa85014dd0a40deb7abbc71202f379866fae94eee8a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908779, "uuid": "8dfe0fa3-c369-44e1-87c2-7a9cadd8ddb9", "value": "T13DD4338FF70D6343A3D2C5489772C4595087FCCA2836065EC47179062FEABAE4BB196B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908779, "uuid": "de1628fe-dd93-4dfb-9c52-7ba37858e2a8", "value": "12288:eUNKGA2i29s19Obt3f6aAjcZJ6Ntg6+s1W1mdQCIcrakg:hA2i29Es53fmjc6NK6+stQCT/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705908779, "uuid": "d908701c-7dea-4c24-88a9-79cf9308bead", "value": 613996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705908779, "uuid": "e3592689-9eb2-42cd-b6a0-14c8fd781498", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908779, "uuid": "10c89e3c-7f60-44a2-a0e8-e890f191a440", "value": "RFQ-HIGH STAR PROJECT.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5602ba65-b8b9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705881664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705881664, "uuid": "33ed99a2-47c0-4020-b9a2-ba9d15fe65ab", "comment": "Malware payload", "value": "f5977a564a6d43b9bd7bb1396dda308d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705881664, "uuid": "24ac50e5-4f2b-437c-b7e4-aef1fcfea9df", "comment": "Malware payload", "value": "07e36da5e85333d8837364725637972aa41c2b50b6d697d45e83c635c3693cdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705881664, "uuid": "a0eb838c-fbc3-40bf-a3ce-12899a926d2b", "comment": "Malware payload", "value": "e2783e1883648bb13c7ad65fae8726c08973829f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705881664, "uuid": "0647547c-a925-4cd7-b5cb-e2f27e0a86e9", "comment": "Malware payload", "value": "5a54b8ea0a3eeb6340a3a26245a7f77626cb8c3ae932550f2bba4588bf235901ec8c613cbe7ce55a9c073c0429722685", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705881664, "uuid": "2869ee24-2e82-4b66-a2e0-feb6ec32c2ed", "value": "T17736869323E95107ED8880BDCC6ECFB57602BCE56490DEF23BA0BF7E65356069427606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705881664, "uuid": "10f7cd11-9556-4d55-bea8-79068449145a", "value": "cc5428ef6e6c61797b7c1fc530aae5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705881664, "uuid": "28e2b004-5e58-4a59-bf5a-5a730bd3b289", "value": "24576:hdfOanNY2H+3+3dvA52ksnnC9esdyW+Ogv:hdfOs22H+3+zmyOgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705881664, "uuid": "e15d5a70-1934-427f-8595-6d4416abb145", "value": 5181252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705881664, "uuid": "4ea87370-6928-4118-8308-79ced47a2a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705881664, "uuid": "91396856-ea4c-4cdb-bbb0-bef26c615474", "value": "f5977a564a6d43b9bd7bb1396dda308d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0998dbaa-b931-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705933076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933076, "uuid": "38191ed0-f19e-4104-babb-3672756a9649", "comment": "Malware payload (RemcosRAT)", "value": "e2994fd1d2f56f8352ebf4d30b221d8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933076, "uuid": "39203ba2-54e9-4182-a9f7-69c8a2fb5a0d", "comment": "Malware payload (RemcosRAT)", "value": "08d763ba6c1ef0fb1e1774e9050e6eae1e61cd4149dcb5334f6e73e9afb6cff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933076, "uuid": "8ebbb75d-b08c-4ce5-8b58-5741ee721e4b", "comment": "Malware payload (RemcosRAT)", "value": "8082ac7548eaf7264884c4295e0c1f272c0700d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933076, "uuid": "94525625-82ec-4327-84d3-f58753164405", "comment": "Malware payload (RemcosRAT)", "value": "5cfd4ca0f87e500de23b57258c39099e23965cd4859936ec007b6981611e6890b3a11653be5ce8ce1aa7415307db2af6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933076, "uuid": "ac868dea-c293-422a-8995-a5f023c79f4f", "value": "T1AAD5AE115F3CB8B2FCD4C936CE677364A7653E31AD6089A236A878DCD976E9D702C012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933076, "uuid": "e87c0c20-61a5-4e8e-a33b-c0400c47dcc7", "value": "02e3ebe88b2a6296bb4b034e0bd03814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933076, "uuid": "7aa627c8-d0f1-4b11-a968-cedaee3d9eed", "value": "49152:xDWu2Avcfk5wAQaEOsA7M0enZFcZrABL:xyu9uFK0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705933076, "uuid": "1af5cbb4-0ecd-480b-a02c-f9f37cd11069", "value": 2774016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705933076, "uuid": "77a9293f-6423-44b6-bb19-046bcad1435e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933076, "uuid": "a280a8e9-375a-4b34-8c9c-220b07ce09a0", "value": "SCAN_DSC0027929829.PDF..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e0f26f-b933-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934306, "uuid": "2d40e5da-68e1-47f0-86e3-b0ec43535030", "comment": "Malware payload (njrat)", "value": "26b832d8013f78d05221b3a38e787ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934306, "uuid": "eec8ea7f-f91d-499a-a1e4-400310d62178", "comment": "Malware payload (njrat)", "value": "08e38dda8de20ff312bea4727b7cd3ab82b8658482294454861ad7e78a0f00be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934306, "uuid": "1369e2e7-9535-41b5-845f-9c0fb48ca7ed", "comment": "Malware payload (njrat)", "value": "109b15235b5844e4c351ef48368cc6b6a5cf3cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934306, "uuid": "03e1541f-4de1-45f6-ba01-be873ab24314", "comment": "Malware payload (njrat)", "value": "b736d7a53c06f33dff961e3cb974515b19a9fc7c3a1aaf48afdc84211eb23bfd7ce01845b2f71214a4572549bd1bbc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934306, "uuid": "124d298a-e19c-4580-a4be-05871d2211a1", "value": "T11DF21A5D3FA08162C5EF2B744AA2D72102B2D1075A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934306, "uuid": "6b548199-bf09-422d-8d4d-a313d80605de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934306, "uuid": "5daf3389-3869-444a-bd46-1f3b036cf2d7", "value": "384:2Ld2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LobkyvGj:wizrecPEZeK45Sss2vGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934306, "uuid": "3c5993f7-b495-47c2-869b-158d976e1a3b", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934306, "uuid": "946b15a4-0ea0-4c71-b4b1-029dcbc285f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934306, "uuid": "340bf7c7-0816-4c3e-bea3-9231251756e5", "value": "bTdS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1cf24a-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948084, "uuid": "d0a86753-d8ff-4d04-a0c8-0230cc6c7021", "comment": "Malware payload", "value": "d2a56f03faeb761671dfab5a0f3aa271", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948084, "uuid": "7adaca8e-0f10-42ef-8105-79d4ce3a8ee3", "comment": "Malware payload", "value": "091853172c710452e19983af220d092ebd2e62453e85304a29a812e8dbbcbe8a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948084, "uuid": "b4921ec6-3d5d-4590-a08a-f88bf666ecf2", "comment": "Malware payload", "value": "5eca2bdcfcf882cfb50934142bd628a841cddb3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948084, "uuid": "22994b0e-db26-495f-9cd4-47748431920d", "comment": "Malware payload", "value": "0b86361c12db2d8f7957877c571bec294fa5e88bd99fa99ea54f6d42ad8e92852fa99fbe0ef3e92252c1c923f03a3e54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948084, "uuid": "8c0bb8b4-7b0e-4071-a5bd-2596ab78aaf5", "value": "T179657302BF04DF15C96C363681FB292853F5F6D70771851FDF0A76A62CC22A6AD8D24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948084, "uuid": "c6e1b7ba-f989-410c-ae41-971f724e00ce", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948084, "uuid": "68c91138-a44f-4a3d-b622-6679cf02421a", "value": "12288:rlOLn55pWFWR9YQvjDEOH3HFvlVZwGvrl/dS/0BWwBY+mxvmzoyz0ZJfv0Z+MXC:rgLn5XvjPHXFvlXvRBdmNm87jvU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948084, "uuid": "f840f475-f409-465d-bb56-1f50b3912766", "value": 1517568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948084, "uuid": "0c206763-5f6e-49f3-8630-0f1fcdfa3b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948084, "uuid": "227ee606-d23c-4d41-8007-906d440962a5", "value": "SecuriteInfo.com.Trojan.IL.MSILZilla.18983.30842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ddfc28-b916-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705921545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921545, "uuid": "8f35f96b-bbe3-45ab-beb5-90a666722873", "comment": "Malware payload (Socks5Systemz)", "value": "f6e55c8e0ee103b81be3f22593e1c276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921545, "uuid": "c2a49481-9890-458a-9e98-494d39abf598", "comment": "Malware payload (Socks5Systemz)", "value": "091e53b462b1b51e97d4fee0fec5f12a825035c3b03740227254e9e1bfb7a9f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921545, "uuid": "aad0bd1a-5486-49df-a27c-17ed6d641be0", "comment": "Malware payload (Socks5Systemz)", "value": "193bc7ae2cfacdbfa95a8c7c8e3d68a1336e6850", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921545, "uuid": "b991eb68-b3a6-4327-96f7-08861ad56243", "comment": "Malware payload (Socks5Systemz)", "value": "340a7aee76f413a0f82079a14332c3f0aacfddf64641dbf420a1664930d99007493272f53e1fe360ce222fae08c56a9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921545, "uuid": "f97cb2d8-e54d-4a6d-a2f3-669dfac61b34", "value": "T14D4633063F948773E2518A38DCE1B319AE30FC9C360A02175A5E44DE2DA67D81DBE7E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921545, "uuid": "946e8498-dac5-46c0-b6a9-7b6442851b0f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921545, "uuid": "c942421d-f3d2-4ccb-a24b-7a017d7fde0c", "value": "98304:Cn98jUacXVL/gOI+FLiAGdYWozmbkbe46hymIom7c9hqQFd358:Y985CVz1Hp/mwK4aComY9hqak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705921545, "uuid": "639e3a41-e490-4d15-a896-031c5e9eaa28", "value": 5502483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705921545, "uuid": "77cf750e-968a-453c-adc4-966ae7b4d234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921545, "uuid": "654b396e-73d6-48c4-91bb-bb9e78a7f762", "value": "f6e55c8e0ee103b81be3f22593e1c276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11827425-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705950698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950698, "uuid": "e8de6284-8000-43d1-b62f-92015941f52c", "comment": "Malware payload (Formbook)", "value": "0df4380f9173c90e896699c62aa8686c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950698, "uuid": "6838bef3-01bf-4932-890a-dd753d013bac", "comment": "Malware payload (Formbook)", "value": "095e7e26cce29387ae4138e417bd4e3c0ed4ff3ff4f5a977f5e8a2bc43011a3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950698, "uuid": "722ed096-86a0-40c7-878e-6acd4a47a9bd", "comment": "Malware payload (Formbook)", "value": "64bd66ebf6450fac2f0e74e3fa10208602705166", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950698, "uuid": "d22a115b-41be-4c7a-9eee-a9890174149a", "comment": "Malware payload (Formbook)", "value": "e3e0e530d489d82005eb06cff6fb98591739330c96096540a0c93989aedcc8bd727dbd12d58b33416a602be22ad7f08d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950698, "uuid": "59cf46ad-2d09-4e6d-b4b6-858c72cea1c1", "value": "T18235BE0333828022FF9B95774B56F35547BC6E260127A65F13A82979FE704A2173DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950698, "uuid": "509496c0-7fee-4573-8189-79871233823d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950698, "uuid": "b88eecc1-b85c-4cd5-ad7a-f26c0e77c704", "value": "24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8al/AwPocia+:3TvC/MTQYxsWR7al/VPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950698, "uuid": "612f6b47-8ea3-46f0-8ac4-8f430f076ba8", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950698, "uuid": "f8a8ed2a-e2fd-4b33-8fb7-f2b6d32803e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950698, "uuid": "83963119-8ba1-4239-8487-d4ccf23d92ec", "value": "Factura detalles_00537_47340.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df464fe-b927-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705928815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705928815, "uuid": "2b3e1627-a10a-4ec8-9617-16870c83efdf", "comment": "Malware payload", "value": "1a0bbcacffcba3e307ddb8089fa1e7dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705928815, "uuid": "d6abc331-a33c-4f48-9a1d-257bc93e2652", "comment": "Malware payload", "value": "0986c0a0504a6e7b229b5b5cd9913034446a9fffcb55bd2a31dfa412ee56dc7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705928815, "uuid": "f5940487-950b-415d-8a6a-5d4a80c8a752", "comment": "Malware payload", "value": "8b97958100288479ba1356d6844a8bc283c603be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705928815, "uuid": "24a93302-86a1-4611-9a3d-ade582357309", "comment": "Malware payload", "value": "30337554b1461bbbb0faf7964e54ca1367448f9fc05791eeb60c5a560d3479a0524b2b9e9a2d5f307ae44ea36a6beb98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705928815, "uuid": "3e0191a2-a078-40bc-8847-22240ef4d757", "value": "T190E63375B24285C0F2DB51FB17ACA91F863BB13AB2508B8917BD20680B5F7E1D738B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705928815, "uuid": "65ea4c92-378c-4b0f-98e1-b920cc3cade9", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705928815, "uuid": "d8d82525-dfc4-43a4-90f1-5e9db8c81e01", "value": "393216:jS1ceXGBdUL2Vmd6mWJJVAzDakAvq3+d9OA2tbftoNqW8FEb/Gzo:EtodUyVmdaDAvLDOd9/ODbW8s/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705928815, "uuid": "254c0850-0de1-4596-9191-d5442ce4fbf5", "value": 14442321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705928815, "uuid": "095d5c74-4f70-46a5-8fce-2ceb96025f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705928815, "uuid": "ff236cab-ae48-483d-9f87-7a0bf5594a52", "value": "VoiceSuperChanger-5.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c177ba-b934-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934468, "uuid": "c9124641-d156-4ae6-a01e-159d6150d098", "comment": "Malware payload (njrat)", "value": "76571b3e678fe0a8db4cdd6aa35332b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934468, "uuid": "255d7bc2-827c-4d90-9ed4-5d4b22705bc6", "comment": "Malware payload (njrat)", "value": "09df4341d6f961fe9ee80843d63bc6dbe630229eb4782faf068b3058ac91472e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934468, "uuid": "34f486cf-2e0f-44b7-982b-cf1b456a81d2", "comment": "Malware payload (njrat)", "value": "3296b8a534a74d462d01cb4502851710575bea2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934468, "uuid": "731a5579-06b3-4956-9fe5-8286f901d132", "comment": "Malware payload (njrat)", "value": "976561a1f8b9d9e6cf8129cab77d74494b8248ea057ac075c97dcffd02b6a4b8c40d774b1c8592e878ebb72ca96ed243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934468, "uuid": "b184e1b7-b6b8-4d00-9b47-c8e2ed509b11", "value": "T1C5F21A5D3FA08162C5EF2BB44AA2D72102B2D1075A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934468, "uuid": "c67cdf85-ae59-42b6-96f0-ff4c9e900a15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934468, "uuid": "b636fe50-ceef-49a5-9af4-f9bc83f2525f", "value": "384:RLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LZbdyvGj:RizrecPEZeK45SssCvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934468, "uuid": "13232ff9-6520-45d0-94e0-f5793b58d39b", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934468, "uuid": "069873fa-e530-4398-aca5-53191ccb5165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934468, "uuid": "31657143-ab14-4547-81b6-37d2eb969619", "value": "bTda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a923358-b91f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705925480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705925480, "uuid": "257be865-2e7a-4332-a2ee-eb077e38ba84", "comment": "Malware payload", "value": "13dd7c26d0d0dd230964f135fc1d64a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#869D36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705925480, "uuid": "775a4f19-a5e0-488f-977b-4228ef48b6b4", "comment": "Malware payload", "value": "0bd94f4cc110f53ddc9f912a577cafe4b1fc43b63d8c71c41148a4e9ed4fb41c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#869D36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705925480, "uuid": "baaebc4e-8650-4495-9934-0f52aa5fcbf9", "comment": "Malware payload", "value": "8217240426b25d77b673a83016f3a4c698121f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#869D36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705925480, "uuid": "4a3fc30c-64db-4be6-8c74-9903bb8b43e7", "comment": "Malware payload", "value": "2012a651054c3751f976be17de464a77646c027c7a5e623eb1d7472625d17dd1749b1545fd1f5e6b8e9cf9a57b02eda4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#869D36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705925480, "uuid": "fdfbc004-3116-4c7c-8001-ac9f3769073c", "value": "T173248C25F4018072CB812471963CAFB3A96DD9351FB460DBD7E84C72AA742D2E732B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705925480, "uuid": "22865d60-1a38-4835-ba4c-449a5a19d408", "value": "6144:tX3o98S1gjGm79VTXdFWThQV5noBVZVu1UKfinSTS+xJLahLcDgcDuF:zaiPd7VOfnSTS+xJLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705925480, "uuid": "e82e6c11-380e-4643-97aa-351cc80f36ea", "value": 228012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705925480, "uuid": "bd73f6af-6c01-4074-bfa5-0903f63170f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705925480, "uuid": "b6e0af43-aabd-4960-be95-41562554debc", "value": "13dd7c26d0d0dd230964f135fc1d64a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d4f223-b924-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705927511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927511, "uuid": "3b6219e8-35f5-41c7-962a-a8249a8ecdcb", "comment": "Malware payload (RecordBreaker)", "value": "57e411788e7ed9ab4770b03eb026533b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927511, "uuid": "b9ff7c0a-1d38-43c9-abb4-b5b4590a3c0b", "comment": "Malware payload (RecordBreaker)", "value": "0d79b46f4c9e6f78c0655e3b2a6dd2a0f7b47db44513d0165d710823f755b18b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927511, "uuid": "829ca8ce-7ef9-4d73-b00b-d44a833ed1c4", "comment": "Malware payload (RecordBreaker)", "value": "cb738621cb2de627804579d5071e372b286d2220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927511, "uuid": "1819f866-b97d-46f1-8292-742f111902d2", "comment": "Malware payload (RecordBreaker)", "value": "35e9361ffb89f3304939e561455240310653d2a1bf5eeccf29876564cda2c2181d0d60bd4cdbfb29f38b3309f123d072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927511, "uuid": "7a36fd71-9823-40bc-a4f1-acabec1401f6", "value": "T1BF75BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927511, "uuid": "bb00d141-058f-4fd8-b8dc-4560952cbf17", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927511, "uuid": "5a0fec6b-d522-4296-873b-3978c6cb86b1", "value": "24576:s7FUDowAyrTVE3U5F/N9YKic6QL3E2vVsjECUAQT45deRV9Rx:sBuZrEUkKIy029s4C1eH9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927511, "uuid": "aa3b08e3-8249-4039-9169-4fb5267f14fa", "value": 1672093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927511, "uuid": "48613300-afe2-4934-b188-1ef384b1a5e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927511, "uuid": "4dc50032-032e-4894-a72d-5a958bea9b90", "value": "0D79B46F4C9E6F78C0655E3B2A6DD2A0F7B47DB44513D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312de4ea-b8df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705897923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897923, "uuid": "c9385202-1c76-4d14-b1a0-04312a58c177", "comment": "Malware payload", "value": "ccd67babd6a17b598d6703a3cce61010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897923, "uuid": "e5aaf27b-c62e-4b71-9d5f-a6c5a7e4081a", "comment": "Malware payload", "value": "0e1d74ab9604ab90a5d4ae93bac4ff049d649896bcaf085364b1cc3c91396d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897923, "uuid": "699a681a-73bb-45e4-a243-309215741750", "comment": "Malware payload", "value": "f084d2287e026205a246d4f6c536a17a8dbd2fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897923, "uuid": "0f848eb1-c325-4253-9d7c-0876552ece3e", "comment": "Malware payload", "value": "e1539207ff67cbb399a19f7434c926c3febda9555ece7be8b66cdc8ea775d40d62a5c77dce746e458685350484da26ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897923, "uuid": "90a75789-353b-4baf-8fd4-b331d00a956e", "value": "T1DA84E0B45DFDCA92D3C847BEE480519006F1E622B68BD3D77A251AF83E523D14A0B19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897923, "uuid": "41dd4a7d-6703-4543-83c7-f7beb879508d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897923, "uuid": "2922bd6d-30a6-4d56-a9c9-911d77db9521", "value": "6144:vE/uwOXtRWjIGW7AWP+tsJ9GKH6aoiDlKfkW5VY8gz+bmFUMgAki77BG:auFnWju9IsJ9BvLh8zSFUM7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897923, "uuid": "6cbdb970-6c37-4a78-8c44-6491de16f191", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897923, "uuid": "ea6458e2-79d6-40df-960b-df183c622eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897923, "uuid": "6583126a-1568-4688-91e7-c4098f2e839f", "value": "SecuriteInfo.com.Win32.Evo-gen.23376.5503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70aa425-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948077, "uuid": "1b64596b-053f-40cc-812a-c8cbf94a8997", "comment": "Malware payload", "value": "a98cd661e957a40cbabc2a93ce19a9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948077, "uuid": "eb7e021e-87c8-4a04-8fb2-37e9c716d0b6", "comment": "Malware payload", "value": "1057d9b84b52fb39c64e543298449b776d0e69ec9f379662259a37907f1d9c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948077, "uuid": "1e1568f4-5972-4b79-a529-955f84a3e1cd", "comment": "Malware payload", "value": "c87696d1c7c374cb0321aa4e18995aa17b11810c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948077, "uuid": "6ca925ef-4b19-4ca3-9f61-0fe220afa785", "comment": "Malware payload", "value": "f4232cfe8da5d5c1d99a13070e50d9a2cd1b51c2445ea801ae93d412839126573cc66abd4060dc1b67d220b20f0e7fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948077, "uuid": "7fc7ff45-e838-469e-8eea-21728dbc8f79", "value": "T18D473399395F2479EB26C47095E0BDB4462E9E3CCBBB20168CC17F46D0BA3A6277501F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948077, "uuid": "a7791798-1798-4460-ad61-0e2a10455c2e", "value": "4d65eb009a5bed7efce0091931f34eb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948077, "uuid": "44a55f01-af5e-4391-baac-38803c38ffbb", "value": "786432:VNgsr4mWGPHOtDmwHYFIAzoX3vaUWE5GAd2UDBJ9DP9AC:VNu1GPHOtDwB6Sn0GkzlJVP9AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948077, "uuid": "771cf548-9819-43f7-b8eb-845482f48430", "value": 26502864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948077, "uuid": "77ccfe65-d803-4dd2-a838-ffbef0c106b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948077, "uuid": "11689f4e-93e1-4c14-ab5a-f37a815d68be", "value": "SecuriteInfo.com.Program.Unwanted.5457.12441.6663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317351b4-b929-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705929706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929706, "uuid": "f34b5c5a-0aae-4c27-946e-8ea312d7e2d6", "comment": "Malware payload (AgentTesla)", "value": "59880bb7a98775ad3709224a545a48bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929706, "uuid": "73a3e2c7-06f9-495b-a771-0fbef0d648d0", "comment": "Malware payload (AgentTesla)", "value": "10d031934fa1b90047827f9de838a28f96797e9959fa3ab2dacc383dc8a9be84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929706, "uuid": "4fdb5ea7-14a6-43ea-b8f8-c33d67740a94", "comment": "Malware payload (AgentTesla)", "value": "b093a0079d339288ebec185cf71f567b2553a334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929706, "uuid": "41a7d955-4111-4885-94bd-d056020e7aaa", "comment": "Malware payload (AgentTesla)", "value": "cf1a8fd8342d304147b3f63ec912e57e88f722da04b551a5a75fa4a0c2e06719f7882a1b49d5a14d478bd6f4c0bd80ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929706, "uuid": "288a5543-5e63-437c-8b91-1cc46a149abd", "value": "T174080158EFC0AA2DCAE037F61961D0EC5371BFD64AE5C688689570CA4E63B0CD505BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929706, "uuid": "8205638a-5007-43ec-9bbf-76e7bc5f76ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929706, "uuid": "03dfb6b7-b90b-4efe-8367-c558f2897b97", "value": "12288:h6b9M+viV+9aplYy5O8bjNYnje7+2/fWCo7y71eYN3TR:h6b9+KqlDQmanq7dwAzhTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705929706, "uuid": "730e7c2c-2683-4021-9132-d33954456039", "value": 83886080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705929706, "uuid": "4ef12e9a-a6e0-412b-87db-eaae6483697a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929706, "uuid": "a33ce08f-72ed-49f1-98ef-d460a41f8bb5", "value": "Supply List QT46178 REV 01 - Bubble Number ITEM 18 - ITEM 24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ef4641-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705915838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915838, "uuid": "05994eb0-3ade-4cc2-8d30-4c449f2038a3", "comment": "Malware payload (AgentTesla)", "value": "031e8eb37115da90eaa2cc8e9462b5bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915838, "uuid": "817849a2-f8e7-4b1f-88cb-2206d353bf98", "comment": "Malware payload (AgentTesla)", "value": "120bcacad9a80ef56165be4e91ab5cfaab7e3e428b40188dca5f2b17e0efcd93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915838, "uuid": "103be414-f3a6-4a3e-ac48-a242daf4eaa5", "comment": "Malware payload (AgentTesla)", "value": "195dff5908d75e63ed3ab1c75a16332a08f71b57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915838, "uuid": "3d88a639-11c7-42d2-bb02-12ba31bc6510", "comment": "Malware payload (AgentTesla)", "value": "dcc91f082ef10acd8f196e7b3ec463f32aab15eb9457f79d4f914d7750afec05893c4ab6bd97b2a86dbe28ded85c28de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915838, "uuid": "c25eec59-59bf-425d-a00b-c084ac1618a6", "value": "T1E4D21B2CCBEC413BDABFC73CD4964642F631552B720DEB5924D993622C83354BE912AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915838, "uuid": "d3c1e464-8bae-4445-8930-4037a40dee6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915838, "uuid": "250440e4-6a2e-4ab1-a7ca-0121f4009a83", "value": "384:UEGzTtCg3XuTF7dTI6eUVhceRzqdDCLTucvIRqUphuDfD+lSYEiZrhBtRCWMezlu:ULvYG0PT/7J1ggCLW6lSYEiZrh7Rxwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915838, "uuid": "8ea97c74-d69e-46f1-b701-4041dd798a73", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915838, "uuid": "810060a1-0d31-41f6-983a-6f981600cb0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915838, "uuid": "9ec4c379-2b1a-4910-83a8-28617dadfe89", "value": "SecuriteInfo.com.Win32.PWSX-gen.25252.22238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc6d8b7-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923395, "uuid": "bf5f6c3b-5f60-4670-a8ed-e3d98013e829", "comment": "Malware payload (AgentTesla)", "value": "03a74f6f9bb8f16703dbcbb014f41961", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923395, "uuid": "19abe0ed-563a-44c3-83de-4a30467dbb90", "comment": "Malware payload (AgentTesla)", "value": "123aea7d858103b5eb5ddf661f60e59fadf4dfdd27b6f12f81d6e4d667507013", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923395, "uuid": "295ee1a6-9869-4b1e-a633-130acefbd499", "comment": "Malware payload (AgentTesla)", "value": "46499011f5acda5b7da7060e92a90c8d0dcf8d5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923395, "uuid": "84b2d963-6e90-4d10-b110-b69d63c73de5", "comment": "Malware payload (AgentTesla)", "value": "02be2e398915111e86036e27fe96dc31c9f7ba77c463f9751f580ee8ef39e4241b6f54ddcaf21f07660d9fadeaeddeb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923395, "uuid": "22cf9d20-35fe-47f5-b12b-b423186fe799", "value": "T178F40119B7A1CD51C2ED6A3BC0E351141331CA87A123D74A7BD9A35A06437FF1D8EB8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923395, "uuid": "2b5ed4ca-44b4-413a-a4f9-142376a651a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923395, "uuid": "98f08437-f1f8-441e-8ba1-b802931ff29b", "value": "12288:5Z9/T+yFw7MlyePFLVoq3FaiO01tZ+hT5pOAoGZqXXt0jZQOaQgiDtbQv:JNwYlyePRVoMFaUtZ25RuXt0jZwApQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923395, "uuid": "ede1775b-6347-40fc-9eb7-97c5fe58f643", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923395, "uuid": "9e93e275-e8aa-481d-862f-f46ab1d12c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923395, "uuid": "9688e01f-d4a0-4283-adb1-448f03c035b5", "value": "rSTATEMENTOFACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ce6a4b-b916-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705921553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921553, "uuid": "8be365f7-a015-41eb-a026-7414cede4c83", "comment": "Malware payload (Socks5Systemz)", "value": "cab019fa65192274cff8e01e884f72cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921553, "uuid": "a03ba61a-bd98-4ae4-8602-2968303d3cb4", "comment": "Malware payload (Socks5Systemz)", "value": "146c0f730e978f7ec1a22382dc245f56913067bdeb004cc55c899e9e20cb91aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921553, "uuid": "25e446fe-ee20-47fd-86b8-3101acfcfe87", "comment": "Malware payload (Socks5Systemz)", "value": "2100aef6a0c6c3e55fef6f164159fc9f3f831b5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921553, "uuid": "2f5173ac-f176-4f16-8c22-c687de3ce5af", "comment": "Malware payload (Socks5Systemz)", "value": "4f3439eb798d1c353ee8844323e659a45dc8d0f629304183a053e52a4abd8349c70b3d89df3de41652665a7fb48b3a53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921553, "uuid": "9c882ec8-c27d-4406-a4a0-ce30bccdbcb4", "value": "T1993633297F484732D2459B32FCF2320AEF22FD2C2A215A075E6B59D93D19BD06DB91C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921553, "uuid": "dab788bf-54a5-4550-b7b1-c3a0f3a8f81d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921553, "uuid": "6c643eaa-7c7b-4fce-b4f0-3ca9e3f4204c", "value": "98304:Cn98jUacXVnoNxYu70APEGU7ntsT5CQBkAYrc7+SEveOV5JIZkgd358:Y985CVnKYyPEF7nECQWXcxEx0jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705921553, "uuid": "7b9bcaab-9ad1-42e4-8613-49e58db4b9e2", "value": 5305194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705921553, "uuid": "c4ec07bb-ab9f-4656-b203-1f9fcaecc455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921553, "uuid": "df84ef28-0269-468c-a79f-208e23216c3a", "value": "cab019fa65192274cff8e01e884f72cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46095d1-b930-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705932933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932933, "uuid": "90a59ce3-d74d-458f-8b4c-52bc689174d6", "comment": "Malware payload (Socks5Systemz)", "value": "8905a583aebb2fdd41dae587fe86fc78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932933, "uuid": "4feab331-4da4-4120-b251-782ab3b8af52", "comment": "Malware payload (Socks5Systemz)", "value": "14bad13f350a113cc2a72ba8016e68c3c39b3e547d48dd2de29e22237572f805", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932933, "uuid": "441a5100-3e81-41a5-92bb-8c903387e42e", "comment": "Malware payload (Socks5Systemz)", "value": "f59110ecf8369a3a0f6bd9ba6d94e8c45fd03d62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932933, "uuid": "1662d7b7-e16a-4f93-9ce8-d1423d17cab2", "comment": "Malware payload (Socks5Systemz)", "value": "d9778136714e7fd2ba6a476c42cce72b2721c88ee84de957f5247614170aff5e6cc1a173e647be2860a40ce788c0822c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932933, "uuid": "c153404a-68d6-47cf-ae9b-7bcbb1c789f5", "value": "T173463315BF514733D2428A71FDE2B205AF74FC1C26221507B95E69CA3DAA7E00CB62E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932933, "uuid": "3e856a48-cf82-4ee7-9430-016d725fc543", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932933, "uuid": "0d2fe38e-0ea7-4f11-9f62-1e56e854d41b", "value": "98304:Cn98jUacXVgFvVnwAkiadn1oZjLisEGteVfpC4xT/yOOTPh2e434lRsWFjd358:Y985CVgwDn6ZHX3eC4JeTPhOIDBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705932933, "uuid": "ad3921fd-0459-4200-9686-a75c1baa8dac", "value": 5453615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705932933, "uuid": "4dea2045-e71d-4a25-bbac-b027bc3c514b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932933, "uuid": "06f69903-dd77-476b-8198-73966eefed45", "value": "8905a583aebb2fdd41dae587fe86fc78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f396492-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StrelaStealer)", "timestamp": 1705917355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917355, "uuid": "29a9a2c8-670f-44b2-81e4-b00b957550a8", "comment": "Malware payload (StrelaStealer)", "value": "34bcdbd3855b4a4354f3cd03e608440a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917355, "uuid": "7068739f-1ede-4c80-9b4f-022d0c5060f5", "comment": "Malware payload (StrelaStealer)", "value": "14ff76924ff2f4102e06ba9f9109311e296c3d07bf5fc0cd888c93b69b545394", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917355, "uuid": "acbdf1f2-5fb0-40b3-8133-e0c102b2866e", "comment": "Malware payload (StrelaStealer)", "value": "6a8bf0531a981e6f567782801c5cfc0ef9f01a91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917355, "uuid": "50c4f95a-fbed-4ecf-a4bb-044584e3dd23", "comment": "Malware payload (StrelaStealer)", "value": "37e99ec4cf5e53f4ed6bdfe19cd686b275f81aa05b26f11f9942642e3ad7563dde0ec596c1fcae1bd5455f9ed7a47b6d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917355, "uuid": "090d7aeb-6c9b-4ee6-ab30-20f7fc1f00a8", "value": "T1E746F9E476E077D30FB5690DB7CE80B23D64B857F0EDAD86128D0D1E928035999BBDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917355, "uuid": "63f5ea6a-c235-49de-b7f7-eb09796e6b81", "value": "24576:LioNDFYpmVzSyuXqoeJxJNK2Q9bAnWdvgTABkeW+3khCxsOwy2WHM+sJE9qP4e2g:r2map+5wnVBK3UbUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917355, "uuid": "6e3b717c-73d2-4fc9-acdf-e33b1d64b62a", "value": 5562644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917355, "uuid": "0a53928a-dae3-415b-bf98-a2d84d3c3006", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917355, "uuid": "89d2dfea-b776-45d4-9973-8d08290155ec", "value": "INVOICE_1877_1553532450.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00dff80-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705917517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917517, "uuid": "85f6825e-8533-4436-b710-6893580d70dd", "comment": "Malware payload (SnakeKeylogger)", "value": "f8c241ee821f104309e38dde6b40580d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917517, "uuid": "223532a2-d732-4f13-8902-f111f14d725c", "comment": "Malware payload (SnakeKeylogger)", "value": "1772bc937beb129e72657d927f5f33420225761fc634aa0c2a65c48f2bf35c90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917517, "uuid": "b24f3e69-1d0c-468e-9991-2d4de3483733", "comment": "Malware payload (SnakeKeylogger)", "value": "d3e19bb621ab8df9db2b13ac0b6626e0afc0f526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917517, "uuid": "3f0609c6-9d07-483a-ae15-e499d7c22756", "comment": "Malware payload (SnakeKeylogger)", "value": "b30d7678fe231f46882de90396d2ba88bf994be50773f6076b33d3645286b6602c4609434e9b320fac3c20f9083efa67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917517, "uuid": "d2a0990f-6c0a-4e19-b48f-363fd82307cb", "value": "T1F1B4122273AE6FE3D8799BFC6822505847F6799EA981D7448DC635CF8834F019B11E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917517, "uuid": "75c5f0fa-8b4e-4748-a324-4833a6cc76a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917517, "uuid": "a2ab6481-b880-42eb-9c0c-81b2c86859c8", "value": "12288:INH+xDDwfDHdK19yWsSCxkZIrdJIQhQLT+4:w6DKHyXsLOeIQeLT+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917517, "uuid": "981d599e-8a07-459c-b502-905a094657a9", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917517, "uuid": "3c20f475-ad62-42d6-97f5-123241055c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917517, "uuid": "088b727e-4326-450d-9e1d-96e31e8bbe78", "value": "RFQ 54000899566600-00980WQPTTR98000450088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8fcb45-b8ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705904759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904759, "uuid": "3d8d5199-acd2-40f5-902b-270254ad4ac4", "comment": "Malware payload", "value": "54441d9d45349411356ad87a5212bfb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904759, "uuid": "2f66c839-8ca3-4a9e-a88f-fbe6657351cf", "comment": "Malware payload", "value": "17a3bb0004a51a48ac81e98a939e4c0d17eaee9b5bbf0415834f3514fd27ea80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904759, "uuid": "26423c6e-b20a-482f-a705-efe4d2ed1538", "comment": "Malware payload", "value": "d13c7ba6fe2532e089ac97c3c0223b97472ce3c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904759, "uuid": "7f70588f-1a27-495a-be9c-babe07f19333", "comment": "Malware payload", "value": "8d6e1ee344c5f74995979ea154b648557481ae067c2208145d2b725febb73d5622a054ccc364c90d54163a4013919acd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904759, "uuid": "2808f129-c67c-4caf-8d2e-5c747842d4d8", "value": "T15CA633BECFC7CD30D6BB1034BA3998A9D17D8D841D26037948EF7996933419CE92AE41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904759, "uuid": "515a6754-c929-4cd7-a510-2ab416ec4523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904759, "uuid": "17047622-ebf7-4617-af35-3d3c6338cb02", "value": "196608:hFmQkGPZk0udm3FgqNXfBEtJvinmABYLp02ajf:qhm3FgqNCLGm4YLp02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705904759, "uuid": "16ba0ee1-cc82-45f3-bd4d-b4e974827d01", "value": 9704960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705904759, "uuid": "8ce10546-2848-4fc7-9b2b-bb6d08583d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904759, "uuid": "65e3297c-6c0a-4101-8f9c-98e7d3c5ad21", "value": "54441d9d45349411356ad87a5212bfb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea402f5-b903-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705913542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913542, "uuid": "6129962a-3bc4-4139-86ab-294a280ab3e2", "comment": "Malware payload (AgentTesla)", "value": "9dcc954d112ba99e061519fdae504600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913542, "uuid": "5b47ada9-4449-4306-9ca8-f87d4c73cb7d", "comment": "Malware payload (AgentTesla)", "value": "18ab014eb02b94eef74b9c6fd3f84a8e9c593d9cd8deca6fc5d50adb723dcc83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913542, "uuid": "bc514f8a-1038-4875-9cb5-5d6004bed282", "comment": "Malware payload (AgentTesla)", "value": "75b5c1782b991c9e0e9fb2bcd5f04832c9ac8d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913542, "uuid": "a1466242-fce9-498e-87ee-fc2c36f4cc79", "comment": "Malware payload (AgentTesla)", "value": "5dd97ec219453a6beb4f84553a834d5215681e41937c9e646d6d5ad4d8e0d036c1b9e5a5b75701a0babb9ab065f406ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913542, "uuid": "36eb56f8-066f-4940-b96e-a1dff67bfabe", "value": "T1F7D41200B3F88B66E1F697B616B9D0902BB6792F6076E70C5DC960CE2C32F418761B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913542, "uuid": "dc98adcd-f95b-4358-8523-78902af99153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913542, "uuid": "bf2a0056-8d58-453e-b908-89a9000cc987", "value": "12288:xVXo+qA8w3vxteLzTdyvcOTdBKBIU2CazOPgz5M2rvCCGR6n4sh6xc/G2s:Xl8w/7pTk2CgOs22rKVM6u/G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705913542, "uuid": "fddf3dd9-0b85-46f0-9ea4-913b40b3d7aa", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705913542, "uuid": "33141cd2-032e-4bd4-a8f2-602d1bd8a059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913542, "uuid": "5fe9de96-2431-4b47-a981-a9a73c6d4324", "value": "Swift Bildirimi 10000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e9d9ad-b95c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705951610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951610, "uuid": "cca7140e-5812-45e0-ab8d-686770007142", "comment": "Malware payload (Stealc)", "value": "5ef55d28fdd870ccd6ce86aef3925a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951610, "uuid": "fa8da611-6d4a-4a08-88d3-70d5cc9c6371", "comment": "Malware payload (Stealc)", "value": "18b6d9af4a2895a4fe0d00a8345fac2e2b6186a3fafb34d6bb6af4f9e3a07477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951610, "uuid": "e0535e28-febf-4bd5-9b03-f857c9226caa", "comment": "Malware payload (Stealc)", "value": "9efb1869fb6d9e86567dc450ef6a2b3a2d704ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951610, "uuid": "aef92ae5-68fe-476d-891b-102c63a8ced3", "comment": "Malware payload (Stealc)", "value": "cf9c0e32aa0f6a42a3671d71cb0f55bef27854554a24342c7da39cd34a65000793b6b96b19e4cb8cfe47e75d947cb687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951610, "uuid": "ff57078f-23aa-472d-94be-4db5a11672f9", "value": "T132344B1352F13E02E5A68B328F3EC2E8764EF5518F5B775922689A1F1B710B2F123719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951610, "uuid": "95e27ccc-ee80-4787-9c27-bedac906b7d8", "value": "06115774cf36cf0ea7fdd99b0e95ce6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951610, "uuid": "c9dbdc17-d1be-4019-ae47-e6f5ee19f505", "value": "3072:rj/6SL0Z//IEcoWCbtAnKikxmbZJ/ii/HkUD9QyKpFO6Quc+5e2lBI4:rT6SLQXIE9Nbt2im9J6okuGQumMC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705951610, "uuid": "5db6e047-4279-479c-956a-2b22a15d20aa", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705951610, "uuid": "a4056ea0-30b9-461f-bfd4-f2050f970c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951610, "uuid": "f9b79790-8407-4b43-9b25-10666962b4d4", "value": "Justices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bdfbb7-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RevengeRAT)", "timestamp": 1705917372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917372, "uuid": "89140ef1-d7d1-4c52-b064-5e80fdc85b74", "comment": "Malware payload (RevengeRAT)", "value": "b37bdaaf0080a29e0a242ba0a257a977", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917372, "uuid": "55bf9754-cab0-43bb-bc22-ac9e9713f142", "comment": "Malware payload (RevengeRAT)", "value": "18cdd23ad044b247dd5e24623746cc01a6f813c26c241d9f8925289adec606d5", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917372, "uuid": "feed91e9-b9b3-4d38-87f1-babcf4247227", "comment": "Malware payload (RevengeRAT)", "value": "c1f206db9929dfd08d5b53dfe1e47d67b5821539", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917372, "uuid": "f91dfedb-c0ff-46b7-a2d7-50bb1bb93e11", "comment": "Malware payload (RevengeRAT)", "value": "a6a0724ea28db9e8f5bf13d0378beb4921e7ac89047fe026d07eafcd5877530c01b289046e03bed29d75abbd87bd6ca1", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917372, "uuid": "ce28a6e8-bd84-455f-a53d-1b4e0e38a67f", "value": "T10B22BF66D80F5BD3C6239D3582072FB6955CA00A70CE5B5AE8449A0918F11CF0E9BDCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917372, "uuid": "1144b5c4-a0c8-4585-a517-fc9aa4aa5718", "value": "192:xrXP/Gimwb0CPXzf6408ojuzA5W4yzD9a6XB:dXPnJXzQTuzAo4moY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917372, "uuid": "76a3452d-c862-42e8-b535-2395bac3925b", "value": 10842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917372, "uuid": "e21dbd47-e387-4368-8699-c74531bfa4ec", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917372, "uuid": "896cc962-ab4d-4ccb-9c04-5f892e485419", "value": "Detalhes Reserva.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee243c9c-b901-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1705912843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912843, "uuid": "6096aff7-a799-4e0f-9a0e-a6348cbdb9a4", "comment": "Malware payload (DarkTortilla)", "value": "80d7f8bdedf72701d2703a62809696bd", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912843, "uuid": "9b5d2963-1481-4fcc-a6d1-1b1b25d56244", "comment": "Malware payload (DarkTortilla)", "value": "1a305b9dc857a7c492b2c9d9f82bab7525fe4e7a17b49a14e7f37a0c57fca8c9", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912843, "uuid": "4ac2d99d-7a2f-469b-b5e8-cc90aebd580d", "comment": "Malware payload (DarkTortilla)", "value": "0425ed7170ef0681625dbd409ccdb50eadd4bc34", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912843, "uuid": "d30189d9-c883-428c-94fb-b2f8221b9379", "comment": "Malware payload (DarkTortilla)", "value": "ba79cff1112f425639a72f12623453e2e301295631d17b7f8d09daf1802537a748ad9f4de97115e1f40d544196ad2b2f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912843, "uuid": "7b908cb2-22e0-4f41-842b-550f02b84059", "value": "T1A825BE6163986FE4E43E77345072A41083F1BCD7CB65C30D7CA972DE9633B415AA2B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912843, "uuid": "2cdae230-dba6-49de-91ba-183c9bac5801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912843, "uuid": "b161bb8d-0341-41c5-9f50-d74e02b42b0d", "value": "12288:l7M/MVwzfh5yc+lhIG8kDy+t/EfCV1ninSd3SbkfR:qfslhgErTV1nAShoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912843, "uuid": "3181bc69-bc31-4ea3-bc45-bc647c898116", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912843, "uuid": "b3a1beb6-c954-4af2-84f6-c573c1e85cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912843, "uuid": "da0581fa-a347-43f0-a27c-a30541e11477", "value": "ROTOX_ZA.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a020f2-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911972, "uuid": "8a108160-4dca-4efd-95f4-d5f4f5ac6a28", "comment": "Malware payload", "value": "da2176757b2fead6539243b42057cb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911972, "uuid": "07647520-b4a7-4f06-b38c-f64619cc12d8", "comment": "Malware payload", "value": "1a62ed192ff4a7bd746fa24c8d7cd96578a4c7e9f0d4a6651a2a3d0baff9c433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911972, "uuid": "259c242b-16d0-45a7-bef9-1a7fa57de2a8", "comment": "Malware payload", "value": "e14195bd4066e90c821caabd6ca63a173c1ca802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911972, "uuid": "dd1ced56-a181-4842-835a-e2cbbe292797", "comment": "Malware payload", "value": "61c504b50bfd9da7b1b8f5cc2ed55d02869b48adce9cbdc27ac505eabb282c2b2d3b2fe1769209142dd1a4f4c36b0bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911972, "uuid": "c326bf16-434e-4bbd-bbfa-0679c3ed5e3b", "value": "T1E3063386988BA4BED45003F235C4EE8B970063C1A556C805D73F7FCFAD8AEED6899714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911972, "uuid": "76463f02-bf89-4064-a598-afa99d04e16b", "value": "601220c66b113c88c30f73c3ad6b921a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911972, "uuid": "b31af086-f640-4f5f-82b7-e5fad9dbacbc", "value": "98304:gmQu0iNucsADierKQYRc4sNHOZjKg5tkdv+HR5+a:fQabDieOQ944HOZjp5tkx+x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911972, "uuid": "e4f6b550-4b12-44dc-94d3-d9d0a5ae8c7a", "value": 3807760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911972, "uuid": "e8980670-02b8-4612-83ee-85f4a5c496ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911972, "uuid": "9ab023fb-ffc2-4509-90c4-51a3b4d134a5", "value": "SecuriteInfo.com.Trojan.Siggen21.1994.11991.13508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0353f91-b901-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705912766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912766, "uuid": "0a85199a-9ff8-4cde-a380-9b96ed326d2d", "comment": "Malware payload (Stealc)", "value": "b714283f90e2f8a168b4c77cb14ccefb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912766, "uuid": "48a82cdc-25f8-4857-8187-8a0a03d7fce3", "comment": "Malware payload (Stealc)", "value": "1bab1d69639c9405906703c5e671f6a489d3f7f84c022c758aad77beff5d8d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912766, "uuid": "c2133ec6-6987-4415-be56-aa52f8affe8b", "comment": "Malware payload (Stealc)", "value": "3bcafab2d9c9524e4d9c449a9c92beabaaae0e0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912766, "uuid": "d577071a-3ea0-4dcf-9e8d-9cb3c594c7ed", "comment": "Malware payload (Stealc)", "value": "d64f12931ad113eca8da48e00d42218bcad3f045cd1a72b7c8d1d5c56dd21378e8b54462098b71bf8cde74c95f4894c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912766, "uuid": "2931e2d3-bfcd-4d9e-9962-a740afa8c15c", "value": "T1D134398392E27D90FA664E729E6EC6E8761FF1518F593769E21C9B1F04B01F2C223701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912766, "uuid": "9c39abfb-c836-4cbc-a89c-a898aae6920b", "value": "c52f363ae887f7e2b622bb07b5377eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912766, "uuid": "076452ff-c54d-41d2-b830-4b6a3b2915f6", "value": "3072:YQhh7/LwvwGXK5Mwt/EhjFCJg/1TZRgxSFSfX2MMZ856Hx:YQhd/LwY6K5MwWvV/1TrGD2MM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912766, "uuid": "0734ac28-987c-4940-bfe9-f9f09365dffa", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912766, "uuid": "6e1a9e41-a7f3-4fd8-a58b-62f71bd80777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912766, "uuid": "f9054103-c6f7-4706-9534-a8e14af3db46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9612b0-b958-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705949910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949910, "uuid": "1c845258-4f39-4168-a56e-9ddd82fe38ea", "comment": "Malware payload", "value": "f247dd714686f4a76c6653b1fa7bc4d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949910, "uuid": "87e8ddbf-07b1-450c-880e-7bfca2a02107", "comment": "Malware payload", "value": "1c0871b1629331f619a73404c115f462828c2dd9296f7484bb0fa634d81c3ba5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949910, "uuid": "6878ce9c-f736-4e75-9277-81a16cf0566a", "comment": "Malware payload", "value": "2324d21aee81e80cfa7a999f24d43e25d955da74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949910, "uuid": "97bdc4a1-b5d8-4319-afae-8d5791f9b4a1", "comment": "Malware payload", "value": "b11d33e8798c3287b624fcf56d5ba1f065017194d39a816a721d8c2afec49e013d3e432c039040b0ec963526276a088d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949910, "uuid": "9882ab6f-558d-432a-9a98-09520c621fce", "value": "T1E6467E07FAA204A9D9A9CC74831FE123EB25B8494112B62B7BD45F113F26F30AF5D752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949910, "uuid": "1afaf798-7a39-4dcd-acc8-7733ae4ee401", "value": "49152:tzBkO4eR0e10onRTYLmUdDWLYPqYCO56fE6/Fcmp9qokmluBHegjwdP2f6NcavKo:tzBd7Z9UdHjmIrfU2foE6V+U+eAFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705949910, "uuid": "aa648df3-6d57-4d38-9f2f-4861f4c94fdf", "value": 5817760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705949910, "uuid": "c5038cf1-2df9-44e2-9293-fe6cfb982c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949910, "uuid": "3ed93d45-cbcb-4759-bf24-e40ede8f5dd8", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0d7c07-b923-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705927416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927416, "uuid": "a0505638-587d-48c5-82a3-5aabc27b0d5a", "comment": "Malware payload (RiseProStealer)", "value": "4bf40a595b37b88d2f0967eb52a30d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927416, "uuid": "5bb1ac74-460f-4a82-975b-9523e91fc8f6", "comment": "Malware payload (RiseProStealer)", "value": "1cf4a4b0f9432f78cd76b30cf8e6070d2d49b70d42ec4e2192da86d09a0a02fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927416, "uuid": "726def83-2727-440d-b90c-8459839257a7", "comment": "Malware payload (RiseProStealer)", "value": "4ae12b7d109b46943121a6ee5feeff34b454e5f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927416, "uuid": "4276d9ae-0924-4aea-a4a2-4a81ec02bcbf", "comment": "Malware payload (RiseProStealer)", "value": "37e8d83ab730f59981610f929b417d40923adc4a86590d8f8314a1d232d4fb87bd16fa2763fa004ab69be4d3ef366b2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927416, "uuid": "15faf760-4716-4f1d-980c-334b5cb43b3d", "value": "T11966F14CF3ED902C4D14CD72BDE16F5B932E4F27121E09B98AA62BFAC2195DE1E0546C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927416, "uuid": "e7ed7cc4-6bf4-46c9-bd24-b7e66a2b96e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927416, "uuid": "992af492-f2da-40ee-a1ce-32abd7f93df4", "value": "98304:v627llWkfUUxdWhVwDGd6wJgl12SS3aayEb22ZA6EbK54UQYvhvWgVPWGAMh1uxT:v68XZ1dMgGYwJSax6u5JdBS7UkxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927416, "uuid": "0ba25510-1150-48af-b82f-dff5230cec06", "value": 6712320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927416, "uuid": "dd76ccc7-80d1-4aa8-81e5-2295d13b4ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927416, "uuid": "6c405be1-907f-4886-bbf7-68be567d1ac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755ed0c2-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705923378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923378, "uuid": "8f033fed-3e5f-46af-aecf-3f90b79def68", "comment": "Malware payload (Formbook)", "value": "a596fe3be7b357ddee0df3f26c54d4e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923378, "uuid": "1731467e-fd95-4e0e-a56d-9725ca91bfec", "comment": "Malware payload (Formbook)", "value": "1d3bb973e4c641a575475f8ec003ab081c24950b6bbee45093e0931970683071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923378, "uuid": "41f98890-1746-4bf4-9ec8-75b50620d6a8", "comment": "Malware payload (Formbook)", "value": "cb9ec866573b2f7aa74c99c31aacf3ada14b9978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923378, "uuid": "48278f2c-e203-4316-a79f-2b9edc0eda72", "comment": "Malware payload (Formbook)", "value": "de891b4bac015edf360c5e9712c2d7349f1787258862a41802cf738a7548df0572fd00bd0cb2b94fc1d795790d961427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923378, "uuid": "ee1cf6f1-e3db-48aa-8409-1320d4a4a527", "value": "T1BB821805E3459B26E03673F59012952033379DA158A3EBC01DBC7E4A7AB374BCEA365E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923378, "uuid": "998a041a-34ef-48aa-a6ef-c665a0cb80c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923378, "uuid": "50a6367f-4df3-4b0b-a7de-0cc30117a73a", "value": "384:qXhQ2rPKX8og7wak9kqMX7gWP4uu7UJ5dRDU1O+kU:KKXIYMLgI4uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923378, "uuid": "d62f4b52-a395-4a76-9a03-d1b9d0170e9c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923378, "uuid": "762a83ba-9c16-4414-ae77-f600f5a5d4f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923378, "uuid": "d968cdfa-146e-4402-ae3b-0287a468f4b1", "value": "rAlAdrakContractingBOQ-202421001-0241429142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47095929-b948-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1705943057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943057, "uuid": "274b780d-6912-4c32-88c5-508f3ace234e", "comment": "Malware payload (DarkCloud)", "value": "d33e029670979b9b113f5e019fd7c89c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943057, "uuid": "78655a75-c375-49e1-aa75-2b22980a957a", "comment": "Malware payload (DarkCloud)", "value": "1e7bec6e211e8cd375a52939396d844622a93c487758a9e6dae6ed8733ceda9e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943057, "uuid": "f079d236-f057-4217-9696-45b6bf9b50c5", "comment": "Malware payload (DarkCloud)", "value": "aa245e7abb445325d127a551a316b1d9c9d2aca7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943057, "uuid": "2e794a8d-9802-499c-a1a3-8a4918e769b4", "comment": "Malware payload (DarkCloud)", "value": "e0d67a3fc627ff4c8059ead5e3aeb83b4e77998217ed73694dd5f3c78968318c20008e44eb6b39591a2ce985b774085a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943057, "uuid": "91263ea9-4d0b-4ebe-9d88-51916f8eab31", "value": "T17705E039E3948538EDE64A34F97A48141ABCE7DA1C02E75B3E8F607D79977170223A34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943057, "uuid": "499edea6-768b-480b-b55b-53d4482598ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943057, "uuid": "65fa940e-6282-4ba8-825f-8cb5f4196649", "value": "12288:QvcfkIOldtSlQ5od3dI+6csqNpzZuV3NLrq0Wxjrx+dZjJD05I3J2Y:7fkrl2fdIvqgV3w/trx+pQcJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705943057, "uuid": "e7ab5da9-4369-44d0-a34c-2db9cb666d1d", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705943057, "uuid": "a236908a-cfdf-4fac-bc48-34502c15b7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943057, "uuid": "00fe7179-44be-4936-bb94-62450abc1ec2", "value": "Q-Specification#107287.pdf (189K).scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22401f6e-b934-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934405, "uuid": "db1538a7-7641-4b3a-98ad-c236c0d18881", "comment": "Malware payload (njrat)", "value": "51cd30c1bc46879422c8ac1d0af25a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934405, "uuid": "53a3818c-bffc-45a0-8f2d-2dbae66627db", "comment": "Malware payload (njrat)", "value": "1e9238e61f729255784879099fb66f90f4c7543cd16232d51be0409d3e2ce266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934405, "uuid": "4a5fa5d1-9cec-4ee9-b827-92e900c7db9b", "comment": "Malware payload (njrat)", "value": "8dc9ffc37b2cfa78526ca1fa13634383742d63e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934405, "uuid": "15f02412-8aeb-4029-8074-8558e844cf44", "comment": "Malware payload (njrat)", "value": "6f7a9fa11286f81c011883ab2aee7716161ca567d653c6f2ac6909cfdcfa7dac7095146a62d77236a1f03c86397d72e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934405, "uuid": "392a8d6c-e0b6-4e16-82c0-e6892327005c", "value": "T16BF21A5D3FA08162C5EF2BB44AA2D72502B2D1075A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934405, "uuid": "e0724753-5e84-45ab-983c-15bf75ca4192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934405, "uuid": "b770045f-7cf7-48d9-aa28-74cb58b2799e", "value": "384:GLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LUbQyvGj:gizrecPEZeK45SssmvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934405, "uuid": "950da7be-9e96-49b1-a93d-6341082e3544", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934405, "uuid": "56809054-cb87-4a27-8cff-69da85ad62ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934405, "uuid": "9c896c32-e97c-407e-b391-89f968f1e370", "value": "bTdG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f939d85-b95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705952467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952467, "uuid": "0cb5c159-ae40-45d9-9b74-1437e50fbc14", "comment": "Malware payload", "value": "fe4e41fa88292d8be48fddfa6b0c0d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952467, "uuid": "9a6ebb1c-bc6e-43fa-b52d-2b477d4c8e8c", "comment": "Malware payload", "value": "1f5e25a403ec45bb014587df458dbd7ff7e94a50ec3d89b51fd0b67f1cb97f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952467, "uuid": "00cbad50-003b-4d36-a6f0-95120304e727", "comment": "Malware payload", "value": "d137e7adb171e6500800ac215b7ab5b1747823cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952467, "uuid": "764927e9-fcd9-46eb-8748-f8425c6046f3", "comment": "Malware payload", "value": "cc98ad38a05e643bb02f9d2f0ee52ba3b89f59a95948619b2c8dfce351861a79665d8861a03cc77617f960350cafcdf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952467, "uuid": "c6cbf4eb-46db-4b1b-bd29-4908cd64f796", "value": "T140C4AF01FAD1C072D57524300D26E776EAB8BD6018364A7B73DA1D5BFE30190B73AAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952467, "uuid": "ba08a73c-e43d-452c-917b-5c7f83149a54", "value": "6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoH9sAOZZsAXBpj:6X7tPMK8ctGe4Dzl4h2QnuPs/Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952467, "uuid": "a9d26fe6-0bf0-4c2f-8584-10bf105b50ae", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952467, "uuid": "70e1d85e-6433-49ca-8bf4-8b13acd3aa57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952467, "uuid": "f42b88c3-8ded-40a6-a8f5-5b9a8cdfee82", "value": "acoustic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c722d57-b924-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705927551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927551, "uuid": "012df5b2-a46e-460b-b984-bd6b15e28ca1", "comment": "Malware payload (RiseProStealer)", "value": "eda9183c164c6c511ee00a49a56155ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927551, "uuid": "afd80196-e321-46b7-878f-c3637e14de55", "comment": "Malware payload (RiseProStealer)", "value": "1fd8dc58f5db52c547bc14e180e0ac6591f5acc669caadd0642a200543261be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927551, "uuid": "a5bb0f49-4cd9-41dc-8385-c7f00d59e5da", "comment": "Malware payload (RiseProStealer)", "value": "3486b585428173fea8a98f8bf56db993e0d57e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927551, "uuid": "6642b827-7630-400d-bc9f-5ee8c1ff7dd4", "comment": "Malware payload (RiseProStealer)", "value": "b33050a2202e518042b2fa70e55fa5eb33475427ec8c016ceb919208b48de6a781a1742ee702b75b38f922f62c11b523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927551, "uuid": "7ec82efb-1963-4e06-b76c-799d432a4a11", "value": "T1DC4523FA66363510D14323F4E885DDA1963B3C8F0149849AAB6AF9E9077C17EE361F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927551, "uuid": "e1f4b428-0eb8-4c56-b271-92cf0d0e8162", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927551, "uuid": "a8819800-03ff-483c-bc32-8086547e45f6", "value": "24576:5XA/rPCZF67fevBsDYawQcu6icoEC+cJ78+Z:pgrKKD5lsoER678c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927551, "uuid": "adfd8d04-2de2-49e4-8938-95c069452adb", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927551, "uuid": "72a49d16-19ad-4648-8b98-a7e37ceb2cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927551, "uuid": "09516189-3629-4420-8f5e-cf522fdafb0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23cff10-b937-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Godfather)", "timestamp": 1705935989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935989, "uuid": "21f5c8ed-58a2-41de-a0a5-38f03e8222b2", "comment": "Malware payload (Godfather)", "value": "8a4c5cac12adc46ea3fc7dfb4c818642", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935989, "uuid": "3dc4e157-6793-49d0-b1ab-31f807786153", "comment": "Malware payload (Godfather)", "value": "20116083565a50f6b2db59011e9994e9a9f5db5994703d53233b8b202a5ad2f3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935989, "uuid": "5af65951-fe89-493b-b804-9c447844f821", "comment": "Malware payload (Godfather)", "value": "e07c99492f803c23fafa3cb27dc49bf2183c67f3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935989, "uuid": "62643bd0-e0fc-4472-9646-f6a436994276", "comment": "Malware payload (Godfather)", "value": "40495bc660e38abea325e8bdb70c7a385b7c613e62fc1acfc3cff3c3eb6da3ff29eb65dac12e6c05aa13dab4a9b09b80", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705935989, "uuid": "6ac84911-a790-43c8-8cca-910634bf0924", "value": "T14136F046F744A97BC4F343324275926A21BBCC268B83D2971D5D323C58BB6D84F5AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705935989, "uuid": "918bb90c-cdfa-4596-a0a4-6c571edcf73b", "value": "98304:9rr9leGyg2u+TxqR0+lBVtvHeL3BkH8dCq1Q8riv0Ua7zfroZHR6RHwvGHEf:9rr9lkg/iGTLHeLRkBq1Xr0ap5wvGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705935989, "uuid": "6d043732-5161-466c-a5ed-85cacff15b27", "value": 5061037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705935989, "uuid": "d07ae317-a550-457b-b6d1-d2049afed05d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705935989, "uuid": "d5d81239-448a-4c4a-aaad-2a4210a8578a", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c26172-b95c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705951798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951798, "uuid": "14d80574-656d-4a89-91f6-a9fa96c3cf16", "comment": "Malware payload", "value": "ba426d1562db9a51985c0edc62c393d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951798, "uuid": "44dff043-cbd1-48bc-91c0-fde1c911e5fb", "comment": "Malware payload", "value": "2098d609c03dbaa022b6a43fbe3e035c804c452aed50a3c4fe6f36b137bde2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951798, "uuid": "5de0b7ae-5d45-49a6-80cc-056f16241066", "comment": "Malware payload", "value": "0b2a6e65ccb83693665d31b3bb0a7e4db6cb8811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951798, "uuid": "a13aaf9a-fd60-4e0b-b47e-2c89653910c1", "comment": "Malware payload", "value": "e48ff27ced5f7ccfe23972d5dc79cc3a338537755d1e2b562e9c2e4b7094a9367dc088e9768034b5dc1328b93e2d4aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951798, "uuid": "14e61dd7-892e-41e2-a11a-a01028a51eba", "value": "T14DA59EB3B794A99FD51307318ADAC3B02335AB00F3569B2355A47E3675AB3C09F1B981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951798, "uuid": "7fcaa230-c4b0-4ffd-a436-7921990dd7cd", "value": "b13aa829ed02f35ebb7c1ac735c565cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951798, "uuid": "8bf9bf10-5532-4763-8c24-941f2f0b109e", "value": "49152:/50XgjryTMJ0mqffhZ00CUlo4X6qPtC6aBUrY:/507MmmqHhZ0xUq4X6atC6aBUrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705951798, "uuid": "0d0fb9d2-5981-470f-ae37-54a69d23ee53", "value": 2229361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705951798, "uuid": "c358b7a7-e58a-4ca2-823f-704d63d8428a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951798, "uuid": "63a3d369-2aeb-416f-a724-f0dd0cd892ba", "value": "SecuriteInfo.com.Win32.TrojanX-gen.4781.32674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7e73b7-b922-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705926858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926858, "uuid": "e8e543cf-d12b-4155-9e2b-b35e50e3288d", "comment": "Malware payload (LummaStealer)", "value": "21e4a83a29d2ff9f76ec9bcf15ac4496", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926858, "uuid": "f74d85b7-9ee4-4d38-a4e6-447c8cb4e27d", "comment": "Malware payload (LummaStealer)", "value": "20ab498b278b14f3786f634778a04d219c74e9fd8517b98f4aca313c9934b7f2", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926858, "uuid": "3dbdf62b-a7ae-4f73-a588-5bb11e21ef64", "comment": "Malware payload (LummaStealer)", "value": "06b5e8071ed87d62d09409b44ceec37c8cb60fac", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926858, "uuid": "39a1a321-8b81-474b-ad88-2137aca91018", "comment": "Malware payload (LummaStealer)", "value": "de4dfd2872d5d7332035a4b2c68b45c95ae522f7c6c32133e830e9dfed867f7defd891e0190a572168e1f9c5a1d88141", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926858, "uuid": "5fee59dd-dfda-4c73-85c4-704fa76b61ec", "value": "T16327333F7E71FB342A9991504C1D707B48F63782D5A2EE19A44F840A7B4E90ACF9E0B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926858, "uuid": "009a79ed-4e17-4bc0-b285-e6881d4e2027", "value": "393216:hEPPp5MO9/LXjaB2LUPdtiY0NyyNXV1nUepybF/N:hEnp5MK/LXmBfPdEMVeIh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705926858, "uuid": "e1685f3b-99d7-4cb1-b020-f8912750e5a9", "value": 20789108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705926858, "uuid": "39533b26-1adb-4f7f-8947-6b58fbe9919f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926858, "uuid": "7c627467-4d44-4624-a078-c08b014e89f2", "value": "plan_dsns.gov.ua.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aca2df4-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705923387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923387, "uuid": "201c0cd6-1c38-471c-bbf6-c10561c2f39c", "comment": "Malware payload (Formbook)", "value": "8f0d5f3651967151ad772123616bfe13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923387, "uuid": "0c9de37c-d532-4bdd-a6dd-607e4c79f1e8", "comment": "Malware payload (Formbook)", "value": "22de0b61308c9e186e46c8b584a91bf0d30e41822c8bb057ba83d8ec1c4b215a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923387, "uuid": "147a1075-acac-426c-a9c6-1836625895c5", "comment": "Malware payload (Formbook)", "value": "300dbf2071aa56e1cbc716bfcf9aa4554ed71557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923387, "uuid": "e5e71220-bcf8-490f-a013-22bdb9b49513", "comment": "Malware payload (Formbook)", "value": "ffa90e913d144251e8f477bea6e1ba8de2929c9fa39a89e655d1c00098e7e49cfce59886ec5ca5321e59ea22d15ae89f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923387, "uuid": "c17e5b37-cf4e-4915-9566-071039d2c746", "value": "T18FD4120033E99B6AE5B69BF65161A0101BF73E2B3439E68C4EC260DE5D31B85CA51F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923387, "uuid": "8d729818-6c38-48a0-803a-61e5038f10d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923387, "uuid": "6c5e6b86-acba-4808-80c8-271ac1ce91d3", "value": "12288:bVko+yTT5V7ePd+N9Z/ZLXgI3TGYgjp0XnHdOt58kAg8cEeaYE+fJnmMp:OWTSPUBLXdzSiH4XcnHYE+xmMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923387, "uuid": "55e0a5dd-e15a-4e8c-a306-e5f9aa86d1e7", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923387, "uuid": "203905e2-9942-46dd-8216-526f8166555e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923387, "uuid": "863d3d8e-01c8-4b66-867a-30441cd24962", "value": "rI8eQ1jlPUINVyqb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399eb61f-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705950765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950765, "uuid": "c78bd6c4-bb04-431b-9a53-a93651468a82", "comment": "Malware payload (RemcosRAT)", "value": "0adde8b59fdacd77b8030d1d7ab5431c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950765, "uuid": "dd7de913-b12d-4074-bed6-80b1336ea741", "comment": "Malware payload (RemcosRAT)", "value": "25036e72fbc62c869373fcd4608aa376123e6ef58152abcb8b76dee6fb59f819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950765, "uuid": "799e196a-9781-4207-9e7f-1a585072f970", "comment": "Malware payload (RemcosRAT)", "value": "330c569f46366ec660ed3e98bf384bcaeec3fe00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950765, "uuid": "7fa37eff-8a36-43b6-b04f-9e1cebca01ff", "comment": "Malware payload (RemcosRAT)", "value": "b1c098c7539fdb660e762244b44b3b1bc424ee1f387054a63f06dfaa34d5361c1f018ab2e7c935adc999c62efedb96a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950765, "uuid": "c6334722-3cef-4c43-9448-b486f6718ae0", "value": "T1A7B4236424811463FE1B0FB291F15732F9B3F11985B5E1770B78EEB549C26CB9A2B08B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950765, "uuid": "5c8b4969-112f-4e47-bbd9-e17b45bfd51d", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950765, "uuid": "e97e4d62-aeec-4fe5-83a0-fcbc7d9cca89", "value": "12288:LwCTqwzkurmSB1mgtXPa/JVoJ7frmIsqKOeIaV:LDuHcP1tf0JVoJfs5Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950765, "uuid": "36b315ef-80b0-4403-80d5-2a312a67088c", "value": 512536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950765, "uuid": "e9ec6a92-6787-4ae3-86d1-dbac34e00a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950765, "uuid": "d653a40f-2e47-463e-845c-355610a37d99", "value": "RFQ BCG 10094601152024_pdf(73kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3747d382-b95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705952050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952050, "uuid": "727545e5-9560-4110-8946-f011d0922b5a", "comment": "Malware payload (njrat)", "value": "72d595eebef948926edcb8a6dd97c3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952050, "uuid": "132cef7c-900b-4a10-8056-df7902f71b20", "comment": "Malware payload (njrat)", "value": "2537fca11c35a9c8e7655513b53aefb88bddd133855fbb4b56b5e6b0ee206cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952050, "uuid": "9b72be06-3c44-4037-b267-1b95789888e0", "comment": "Malware payload (njrat)", "value": "a05f52de028f8ff73cfbbf34f7e51af0435c5650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952050, "uuid": "17a23188-0cc3-4f2f-b5fd-18fa199236c4", "comment": "Malware payload (njrat)", "value": "eaab07fbd7450185cadeace75b3d070b5356945d33f8c1310d630170b34469efd065fe9aa9d6b6c9cd89fa129cd3e656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952050, "uuid": "5cf1ee60-d9f1-4517-b34b-7fbc66ef4afe", "value": "T18EA5128DED4319F58D28E5F2B87AF7A5416AF4E344DEE72C7AE3C8851509E88840F5C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952050, "uuid": "940c38d0-2585-451c-97af-a3ca0abb5095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952050, "uuid": "dd74ce40-5708-406f-8ee2-88ca1d4335f6", "value": "49152:Zt3toam4Igz1Yz+cSE0th0Qcwy1JQ728tuBN:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952050, "uuid": "3fe4ec72-b3af-428d-94fe-70cf4dd98255", "value": 2087936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952050, "uuid": "d07ca9bf-8c19-4de8-9124-8fa2a76956fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952050, "uuid": "352a5edb-ff7a-4021-bb36-4ca2d6766797", "value": "2537fca11c35a9c8e7655513b53aefb88bddd133855fbb4b56b5e6b0ee206cb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5311c50a-b980-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705967129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705967129, "uuid": "9114a28e-3e33-4747-b812-ecaf9bc872df", "comment": "Malware payload", "value": "bece745574b72ec240978be151175145", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705967129, "uuid": "97c9d0a0-71ab-4ca9-8108-696aa53e4d0e", "comment": "Malware payload", "value": "269fa5b0efcabd3bc4b8718e35c0e95284a280d920c32b2d68cf7418fb11cef0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705967129, "uuid": "9b74bf89-e06b-49a1-8a87-995d8bd8f425", "comment": "Malware payload", "value": "7ebfea86bd041b65462a42e0320df53776ad577a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705967129, "uuid": "85727950-cc1b-43dd-8d9c-17f9cc10e206", "comment": "Malware payload", "value": "22cf8ce3151cb6bb71722e8792859595f42719e316de08993c2ef7ad56975c533dade6b27c54ac545f7989bab02029f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705967129, "uuid": "9135c21c-2506-4125-80a2-015e8a55fe4a", "value": "T18916020B3B2062AED15D57F5AC8BB0F2BF08FF4EC32155656259A3A83991780DF13E64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705967129, "uuid": "86d7b3ad-cc3b-4c89-ba55-64a9a1b1f8b0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705967129, "uuid": "1f683176-1031-4da4-8cd0-5403c10be3aa", "value": "98304:ustcHjbsKb/fiXAa4p/OWz48SqFuUQgr0oKN4nrZd358:hcDgK9DFurJ1NUZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705967129, "uuid": "9a01a2e0-82b3-45c0-b9b7-7d83fe0d4c72", "value": 4069203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705967129, "uuid": "cd8eabaa-33c4-4435-98fa-5d242bb8bb25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705967129, "uuid": "4b290330-c73d-483a-9207-bb5f54ad8c2e", "value": "bece745574b72ec240978be151175145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f99caf-b922-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705926795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926795, "uuid": "a917fa45-1a18-446a-92b4-e98734ed820c", "comment": "Malware payload (AgentTesla)", "value": "6e40cf952a894b5fd10b870dcef5358c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926795, "uuid": "0dd3f976-ade4-4c21-ad53-c487b3602454", "comment": "Malware payload (AgentTesla)", "value": "26ed08d9f1a0832cc912b2b997685a52a8d3ac1b65bcc425b317db53446f7ffe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926795, "uuid": "e14f9783-0796-4c52-84fa-bf469095731a", "comment": "Malware payload (AgentTesla)", "value": "59c445cc424f5c98cde1d828c1bfffa66d7bee2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926795, "uuid": "3293419a-c741-412c-b9b8-94b1971c4c50", "comment": "Malware payload (AgentTesla)", "value": "670240f207dafc6e8dc627b1d50559843011160b6ea42859d8096d859767445d92eada9ac3376d45bef99f6a7c93e3ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926795, "uuid": "10fb0aa4-e819-457a-b40c-b6c090be499e", "value": "T142E40115BFD0929CCAE0B3F108B5C4DC6371BFD696EADA889891709A4E1370EC541BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926795, "uuid": "ff240b39-8b14-4312-8a92-8a8e744e7172", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926795, "uuid": "523a0522-564f-4bfa-af02-bded442d4c9d", "value": "12288:C4E9M+ZUn0HiS1VAh1/J3x2U7c0LweyvdLZeqSNycoHB/sTd4oN:C4E9JUnwiS1Y1umZYvdFebNycoHB/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705926795, "uuid": "fdb3778e-0e04-4a9f-9372-6bd9c1e3c33b", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705926795, "uuid": "d2287e99-dbc2-45f6-a0e6-784c16220fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926795, "uuid": "a4b45c00-eab5-4a08-8054-40bee492daf3", "value": "SecuriteInfo.com.Heur.17187.21282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275a70d0-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705950735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950735, "uuid": "feb85103-cfea-447e-a5c9-b2e8dd72d07c", "comment": "Malware payload (Formbook)", "value": "d8302efb582348df811c76893cf8609a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950735, "uuid": "46292cb0-02a9-4421-aed9-dcc4f1733923", "comment": "Malware payload (Formbook)", "value": "26ee1cba5f36e05e9f40a256973ad61d559552e8db02204f2e756b591ee9c0ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950735, "uuid": "03de18ae-6f13-4951-ab1c-3898cd5c8f83", "comment": "Malware payload (Formbook)", "value": "3b97eb9c3f611802ea8e4c646c5e14630cab7aa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950735, "uuid": "5b56cadd-3c8e-445d-a6ff-25475fb88c42", "comment": "Malware payload (Formbook)", "value": "a3109d29efcafb558807d808d4e1b1630080283d2040071da5fb90cbf89a9a4e688ce28ffa20151ca982302426d5878e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950735, "uuid": "1d24a700-bf96-4b63-9608-6995077395ce", "value": "T144459E4FB38290AEFEDA9D32CA56E2D1467869E60123A51F06DD1879F9F00F1133D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950735, "uuid": "f441a7a8-b72d-4c6b-ba65-05cac53d2435", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950735, "uuid": "f583c2c1-4842-48dc-bb1e-16a8f6f53672", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8asSaZ+987w:WTvC/MTQYxsWR7asSaZ+i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950735, "uuid": "04b5f7d7-787d-410d-b729-5ed3268f7f68", "value": 1217024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950735, "uuid": "87085dbe-2fe8-47ff-9ff0-aa2116845748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950735, "uuid": "a00031a6-70f8-433f-94f9-8ef1665e3dc3", "value": "Notificacion Z DTP-ADU-000126.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fca6e38-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705950776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950776, "uuid": "0dd4c547-2f82-4cc7-833b-08cfac881f5f", "comment": "Malware payload (Formbook)", "value": "3c7d710345e5bcc8c5cce3aa4b4c3473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950776, "uuid": "2ab61350-89a0-4612-b725-764dabf071bc", "comment": "Malware payload (Formbook)", "value": "27240e11a975190759a1e323fd91f2c92414947086ab813c999845d0332f3c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950776, "uuid": "34a6efc0-9573-4570-8042-691ee7e2e5fb", "comment": "Malware payload (Formbook)", "value": "38cb7f6951f5273bff8bc9693a52ebf392b7abec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950776, "uuid": "c6ebadb3-93c4-4b5d-8097-0cf9b7fc21df", "comment": "Malware payload (Formbook)", "value": "61521c73de943a055bba35db380fa6641ec7daceb1c7234d129e53e374fd156bec0b16bb6846fc6cc1c7589a79839138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950776, "uuid": "fe245c40-c5da-47b6-9a58-b0fff8e42492", "value": "T1B7F4122A73E6DD35C39F663AC2C710280332C751A263CB0A7FC91255594739B6E4ABDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950776, "uuid": "1905079f-4740-4a89-aa66-947a984285c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950776, "uuid": "80b58ba9-1fbb-4131-9d63-8816a49eee98", "value": "12288:aJYzxC632iNhJz/IIHF3fKqHhAlcKfSJcbpWJ+rBVUPEkbnc6Q9M3J7xefOwYDw:AYVC631HJz/IIHFv9HhAvSJUWs3UPEkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950776, "uuid": "7ed15181-840d-4e59-94f8-8df128ff4a9e", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950776, "uuid": "d4f32fa0-3cb3-46ee-8496-4ed9fc268b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950776, "uuid": "4d3f2f5b-2a8d-4b72-a09b-7ffbf1b70089", "value": "FQ_079487.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad912d2-b8f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1705908623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908623, "uuid": "25bfe292-b48b-4763-9c14-fcd24dc847b1", "comment": "Malware payload (AveMariaRAT)", "value": "fd881b48dc4b01071f7fa4168527f010", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908623, "uuid": "dd515cfe-7bb0-4399-965a-fa85a4279669", "comment": "Malware payload (AveMariaRAT)", "value": "2869196ff20a8b024ccaec7a3e5522fe6f7e1547aacace7e1bcd9c20da249188", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908623, "uuid": "fc6bdaa4-62f1-402c-981e-42841b3212b6", "comment": "Malware payload (AveMariaRAT)", "value": "9f1d1824d7a51b5cf3cfe5429242736981cfd522", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908623, "uuid": "81e166be-1919-45e8-bcd4-19803cb18b5b", "comment": "Malware payload (AveMariaRAT)", "value": "a92ee9e8bcc83d3d39ed1526eb0894f46f8b3d3dc05c72ba2c157911373fa67a62546c0ec4e8a6dcc18668a2f18c249c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908623, "uuid": "203af9b0-0d15-456d-86d6-02e60f0848f9", "value": "T1F3C4010072F99B57EAEADBF521B2941047F7783B242AD64C0DD520CE5D71F448AA2F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908623, "uuid": "27cb021d-a496-40ce-9cce-afed44fcf8e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908623, "uuid": "779a6421-d8f0-445c-90ef-d8ba855e207c", "value": "12288:KVxNo+UD6UFtDtevAFMzx8NOnfVHIzSpbNXOCNgjBv:INwDnhteIFwx8kfVoSJtOCNEBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705908623, "uuid": "9043dca1-d264-4590-98f8-56997a453fe7", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705908623, "uuid": "41366770-8fec-462c-b7ea-a8e51ac4b579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908623, "uuid": "ed2e16ce-679d-413c-a55d-b8b1935796a0", "value": "SecuriteInfo.com.Win32.PWSX-gen.2684.26774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d924fe-b8ce-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705890594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890594, "uuid": "aeb0e2f2-7f9f-46ce-ac43-b09922846ddc", "comment": "Malware payload", "value": "92a4345cba6037bf6ae2933b042a1b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890594, "uuid": "e6ba2757-8db8-44e4-98a1-871c193e8deb", "comment": "Malware payload", "value": "29287d32dd97101ed74a8bc2da86f6807ac3765306e041b870a590e6e889fa83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890594, "uuid": "225504f0-13d0-470b-a757-b8d57406fc41", "comment": "Malware payload", "value": "1e7b1676955e00e601ee6f9c8353d13682992344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890594, "uuid": "7a344cc3-d313-4ccc-aa49-2b968be69e47", "comment": "Malware payload", "value": "3b14cfeea421ee4bc7d8c36688cc2d91437d3fba8aba30f3f93f308541c9800a16812f88b134ef84a5dbb8bb45dc3f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890594, "uuid": "d3735feb-4cb5-4743-8a07-728e8b21099a", "value": "T12AE613CB97EE4C42DC58407BDC1DCEA9F1016AED14088DF2BBBD7FFA106560AA857A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890594, "uuid": "929c3dc3-04f7-4b9f-bf32-5b010d018b0e", "value": "cc5428ef6e6c61797b7c1fc530aae5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890594, "uuid": "7aa7dbf5-c78e-429d-9085-b011bcc89112", "value": "24576:hdfOanNY2H+3+3dvA52ksnnC9esdyW+Og1iLbuN7O0bM2+PC2yiojPIpsigpD6BJ:hdfOs22H+3+zmyOg4TQropBa8PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705890594, "uuid": "fa53489d-bd8c-4142-9d2e-37a6a71e4f17", "value": 14228480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705890594, "uuid": "d924d5f9-4797-4afc-90f7-c303bac722a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890594, "uuid": "133759da-bcfe-4700-ad20-ca06864462ce", "value": "SecuriteInfo.com.Trojan.DownLoader46.45829.820.13193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76abf4be-b903-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705913502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913502, "uuid": "63d7335c-a726-438c-8cf8-417551159f4c", "comment": "Malware payload (RemcosRAT)", "value": "13b7485eb1a3cec4811bf83e746ec541", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913502, "uuid": "dd74185d-596b-4f06-87ac-7fd07d14aa82", "comment": "Malware payload (RemcosRAT)", "value": "293f48cd034293d6aaf5f4aec8c49a8ca9ce639db7752676138b11dcd6fed385", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913502, "uuid": "fb6087e8-add7-4aa7-a68c-780c05d8e2d9", "comment": "Malware payload (RemcosRAT)", "value": "19d728ada3a45e68fbd442d0c81f56eccc89c3eb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913502, "uuid": "422736cd-3d6d-4142-a6da-0d22fea65fd3", "comment": "Malware payload (RemcosRAT)", "value": "5217305151c3aad634edb78f2f40006b70796b8696a52cb54676a2a3938e19dcc29e8ff9b82593258fe52c4565d383d5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913502, "uuid": "48e9fb70-2bf9-48ca-a337-e73dc52ad32c", "value": "T12F4423619C6A43009E359DA4397F358A3599A0111BE05EEFBEE59730D333B20BC97F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913502, "uuid": "d825e9dc-1136-462e-b6b1-ca14e99fe251", "value": "6144:28aywKW8Gl56Pf5XBxOtL7otc85PXB0DCg6t0bT:GywRWgL71Cp6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705913502, "uuid": "5f13ff6a-8124-4ea9-893d-a073c6617698", "value": 272289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705913502, "uuid": "bc76e0c1-68cf-480b-bb9a-64105600d6e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913502, "uuid": "b6f5bf67-f98a-4f0f-b9db-9155d6a888f9", "value": "13b7485eb1a3cec4811bf83e746ec541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a7b60f-b95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705952024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952024, "uuid": "5a950311-a952-4aa9-a51d-c48310fbc89f", "comment": "Malware payload (RiseProStealer)", "value": "b59bad833ec1df6fa6be123e4403cdd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952024, "uuid": "cc5d8727-02c2-440d-b6a6-0c269e188b23", "comment": "Malware payload (RiseProStealer)", "value": "2c3c48cf8ef821403c105cd0dc171245eb72941e6510483b3527a0d2b2277d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952024, "uuid": "67887604-ac6f-47e3-8c36-8e54ceba27aa", "comment": "Malware payload (RiseProStealer)", "value": "fbb7b9fb456649e16ec8856b9a31c94880189e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952024, "uuid": "053ca076-781a-4b37-ac0a-626e039f0548", "comment": "Malware payload (RiseProStealer)", "value": "b4a35c1d8f1d838aa8164c765c62a4568b1b9c2dcff2c22abd51ee24e5d99a7d4d4889822ec57faa808c2f83947a1d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952024, "uuid": "e037152c-b78f-45b4-8937-3b88c26f5c69", "value": "T11D5512F832FAA91DE0C053F01BB0A26813D8BCE9DF454ED6D5EB1A563B531C91B5248B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952024, "uuid": "c5bb73c7-1772-4a8f-a069-e821867b5677", "value": "b7119bcfb690c73f07e6d5dec29f5481", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952024, "uuid": "e2fcc7f7-d88b-46fb-932e-ff37efa8c2a3", "value": "24576:hV1lO1U63Ocae0iriG2pYjW2/UawQTyEvOhodNA80G56r:T69/aYiGPjVUalchoTYfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952024, "uuid": "4368674f-1856-44dc-841e-d05a9e385e4b", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952024, "uuid": "288a815d-3003-4664-a9f6-09531a2748a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952024, "uuid": "c6ff57b1-0c4c-4526-aa54-66c4e3798cd8", "value": "rps9534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6897792d-b930-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1705932805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932805, "uuid": "f9429a3e-d1f8-4cc2-82a5-f0a122a7e861", "comment": "Malware payload (NetSupport)", "value": "cc53b1d688bccf02424463393a3c2928", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932805, "uuid": "64ca3255-440f-4b15-a3e7-15ae437e2a51", "comment": "Malware payload (NetSupport)", "value": "2e211cca3a02e1249a748a6c3cf388913db257d0f6d45ecf48d6c81e94f67fad", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932805, "uuid": "40b95101-18ca-40e9-926b-f65f7efdb8df", "comment": "Malware payload (NetSupport)", "value": "fbbba4e293e054e6e349ad21c1b22d5bab92f408", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932805, "uuid": "eba9ee14-ed4f-43f2-a939-e19e72f8e316", "comment": "Malware payload (NetSupport)", "value": "c8cbe4b6a3f8c493f60324b6d134b7eaac3297db3f47438f4ec7f591ca7c03334a36968d7846d785f4ded90b538361ee", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932805, "uuid": "8e93b4ff-ff78-4af0-ae4d-6cf7740f6c9b", "value": "T1B4D533526393F7A6C0E2F67BA09DAC161E6C607894F63A730C7FA9D2D636491C47F402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932805, "uuid": "257c602f-7a51-40ac-92e8-30fd4b67fc94", "value": "49152:3lAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqR/gV:3l7/FXamhRFY89YYc9jh23redpmQRC1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705932805, "uuid": "6485a8dd-dd5a-4d84-a9f4-c36c23a6b12c", "value": 2997628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705932805, "uuid": "e921c382-4b31-45e0-a564-08473dd957f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932805, "uuid": "90ad240e-7b44-4715-b4fa-8937f301b776", "value": "lol.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f51905-b8ed-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1705904127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904127, "uuid": "7a5f3ab1-68f7-45d7-ac75-b5c735342ba5", "comment": "Malware payload (AveMariaRAT)", "value": "010b1992555965e82a43f5642aaf8ba1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904127, "uuid": "afcdd512-66d4-4432-85eb-cd64ec7fcb0a", "comment": "Malware payload (AveMariaRAT)", "value": "2eefb5dc5aae0ca14290ded3490ec8ae44c88fafdac0b062bacd8b9bd1497eb3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904127, "uuid": "2d700b5b-5ad1-40d5-8a3b-156bdd695d99", "comment": "Malware payload (AveMariaRAT)", "value": "ae665f4148618c9f48332ed3795cf91326311bb2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904127, "uuid": "cce1e627-ebca-4da0-8c3f-12e575a72dfa", "comment": "Malware payload (AveMariaRAT)", "value": "aa329d32f3a05079209bb7878c09ee808354a3987e1c6de4279d8a3d14dd8806dd5a4474be5ef0fa86bd47ed0ce3ed1a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904127, "uuid": "3ef5f01e-35ad-461d-a2c6-ab96e8b6e6fb", "value": "T110C4232A35B85792C86653F7189870045FFAF843B431EBA5BAD261DB4C12B13875AF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904127, "uuid": "64017317-12d1-4e35-915c-e1062e263538", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904127, "uuid": "871d1a7f-2b3c-4bdc-80d6-e23c95761992", "value": "12288:sPf6X60ET/3W+pLzJWN0sMeG5n4Ps6lrjV7qIAxe4I/3YMa2URX:sPHvW+rKGJ4PplDX4OTalRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705904127, "uuid": "5829ecf9-4ff9-4dc2-9eff-4a94af3f9215", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705904127, "uuid": "7033c717-57aa-4e74-b9cc-2e7906a50d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904127, "uuid": "9b07d825-5be3-485c-9ec5-b7fb0a9627b4", "value": "010b1992555965e82a43f5642aaf8ba1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e7fc5b-b909-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705916165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916165, "uuid": "e293ec37-631b-4d5b-b200-0b729357658f", "comment": "Malware payload (Mirai)", "value": "6f30b8c106d43b74401c569afd0fde74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916165, "uuid": "39cb895c-9e7a-4dad-b473-f191966d94fd", "comment": "Malware payload (Mirai)", "value": "303e0244bddbdce2bc1cbecb1bd62cdc534c2b7aeee5256001da65b6ed0f7fd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916165, "uuid": "75ed328a-bed1-4df2-ad0c-500bd1cb91e4", "comment": "Malware payload (Mirai)", "value": "ff93a368969d3c8bc9766dae841e17ee97a8c508", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916165, "uuid": "92514969-5a47-4668-8769-bd12e0b676aa", "comment": "Malware payload (Mirai)", "value": "d57b8f727aa6f44e7008afac2f2477e98c6692973f0780ae7d5cf372e35b5ddbbb1d8b84749371db0bad6eca99927a6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916165, "uuid": "1707adc5-e34c-4dc8-a777-2ebaa1b5cf1e", "value": "T1C3634C4272280A47E5A20DB4253F1BE043BFED5034F4BA88694FDB5A4A39E771186FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916165, "uuid": "da2e6e46-8cc3-4397-9932-125904d8755f", "value": "768:wstzZkTAyxWTdTRns/qP5TS1SZeSq/HHD05X39rsxrQ70pj5HtReBmJMJqCmOQZC:IATyMTS1SZhGD0KpBlnC0ZIZuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916165, "uuid": "58f30bd9-b461-4365-bf47-02a39404084c", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916165, "uuid": "7b04a8a5-00e1-4082-9233-774723946331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916165, "uuid": "60d6ce26-9abf-47fa-9cec-99e859155803", "value": "6f30b8c106d43b74401c569afd0fde74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce43f512-b933-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934265, "uuid": "4e76fab9-5efa-4b70-87e9-7aca9495a2d8", "comment": "Malware payload (njrat)", "value": "84ad1dd49843929ebb768f91bee9011a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934265, "uuid": "bb175543-7c38-4444-bff5-497d8c0daa9d", "comment": "Malware payload (njrat)", "value": "3218644f13ca1ba71cf2075b441d9c511b3475d8fde45231eda86dc2f5bf798b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934265, "uuid": "21b26281-82b0-4273-8d50-4c0dcb9c0275", "comment": "Malware payload (njrat)", "value": "5127eb26840bc484d711945ddf3ae60c55ecabf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934265, "uuid": "40751556-730b-4e65-8318-50250cb6fab7", "comment": "Malware payload (njrat)", "value": "ed72790c3810f7f585072b27abd63d448546be6f895ca87a961192ac3332c5196c47a191a0e1b188b479cbbdda28016e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934265, "uuid": "1475eacc-dcec-4f23-9b6d-eb43ae477cb3", "value": "T1E4F21A5D3FA08162C5EF2B744AA2D72102B2D1075A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934265, "uuid": "bc07a6c1-15dd-4255-9c73-4ddc2b8aeb2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934265, "uuid": "06f7c8d9-2a85-4f21-9623-9a0a7e5dc113", "value": "384:fkLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LBbmyvGj:fyizrecPEZeK45SssnvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934265, "uuid": "24cbb172-82eb-4c4e-8117-89f050ae418d", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934265, "uuid": "219c12a3-d022-439a-9a67-0eeca2bb0632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934265, "uuid": "f88e433f-7857-4422-a7fa-11fd03286012", "value": "bTde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9170f3a1-b941-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705940175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940175, "uuid": "6dab10bb-82ef-4c1b-af8b-d354365d01e9", "comment": "Malware payload", "value": "198b173855b54e4c27071936b3fdff27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940175, "uuid": "d8435e13-1522-4e1f-a862-0c285fd3a773", "comment": "Malware payload", "value": "325b34e9fb0cb6dd3c9ae6e4911c6a8669e715d14825c4cd00da24e24f287789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940175, "uuid": "9dda316f-db79-4aa8-ab44-9eecf158565f", "comment": "Malware payload", "value": "f4256a0bc63ae3955080b402b4c65583c9e4d415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940175, "uuid": "ed5eb9df-909d-4254-8bd5-eff8bba70c84", "comment": "Malware payload", "value": "03c18a7ec7d15c49aa6972f0ed9585422169b62c5278cbc91ee59c0f7c22a19e71cb602fdc2f599b9f065fb48ed09894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940175, "uuid": "adbb5505-18a7-43fb-8f1e-128eca09d2ac", "value": "T1C04622178D4A12F1CFFB9C336E3AACEE1039B62B285A22DB211D745F344D94C7712996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940175, "uuid": "407881cb-c191-43f8-ba61-25670a65b89c", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940175, "uuid": "4171b9ee-9787-4b4e-a481-270e128fdb52", "value": "98304:qY9OK6UC6n/xAS0ZdNcxz2xlfLgeokKqoWQXoFW8MJ3JpMed+tG4H+x1amCAVZz:qY964aPlfLgeo6oWQEPMJUkHT7Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705940175, "uuid": "e18423a0-161e-4153-9542-27b3fada1d3d", "value": 5432852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705940175, "uuid": "466c7c3f-345d-4ee9-bef7-69d539cc24d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940175, "uuid": "6c84d36c-a9c9-4e79-bae5-520105537f03", "value": "198b173855b54e4c27071936b3fdff27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e9e35a-b8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1705907214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907214, "uuid": "394854d7-2888-4dd4-ae0d-8fa06b96f15a", "comment": "Malware payload (DarkTortilla)", "value": "65ab04311976024c3cfc3792a31f4433", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907214, "uuid": "84d0e1f7-d368-42ca-9020-7e31cee8887b", "comment": "Malware payload (DarkTortilla)", "value": "33fdf584a7c1ab97e173f90e236c2eca4cd5dbb3bb19aac74447c61aa9067a64", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907214, "uuid": "5c7a7098-1175-439a-a850-6317f31f3318", "comment": "Malware payload (DarkTortilla)", "value": "9a33531d54088f8d2c850a0f6ebce13568707e9e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907214, "uuid": "7d1951f4-9ad7-4a0f-a575-20c97d1bfca5", "comment": "Malware payload (DarkTortilla)", "value": "7c1807a60aaca5419b90248fa62bf40033e39d4a1deb4eb43de328859677cb54e069fd5306f8d5623b70186fe907ab4e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907214, "uuid": "06c0d798-4bed-439a-8708-a4c4c60f4f2f", "value": "T1B165F13EB7C4BEDAE6392D768453290583F0C4E35B37F60B7CEC19E2AA256059A1F015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907214, "uuid": "53da373e-87f4-4668-b463-be9b9bdc09f9", "value": "24576:z1s5KNvUy2MKnolTrpzFPWZK54gvF4zFor:zPNvUZMKnolTrpz54gvF4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705907214, "uuid": "d0c13b45-ce72-438f-a8d3-c290e03219a7", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705907214, "uuid": "4e62e1d8-aac6-47a4-841a-4ec3f2db964d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907214, "uuid": "44f25ff3-17f9-4d72-9ec9-ee69ded9610e", "value": "INSD0004_RFQ_2024.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73369aa1-b965-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705955587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955587, "uuid": "387d640b-e917-466f-bbde-feb285801c29", "comment": "Malware payload", "value": "f9e4ae00290e5259c78ba11b4c851417", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955587, "uuid": "a920f692-f844-4806-b49a-733f0674d355", "comment": "Malware payload", "value": "34ab005b549534dba9a83d9346e1618a18ecee2c99a93079551634f9480b2b79", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955587, "uuid": "c9b5b231-8d13-4edc-a746-01a695939ce8", "comment": "Malware payload", "value": "247b5c812136a40f85c106ca6441315b123f625e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955587, "uuid": "53dc6459-859e-4be2-a47f-cb3dc4041c4f", "comment": "Malware payload", "value": "7e0146d849e0e25f3e69d6294ee3c714b8851c985821cf256908005a5f33712aa0ada18dd20efe3b69727719321588dc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955587, "uuid": "c9d4a74c-87d4-4db8-8a68-6e02170f2ba7", "value": "T1F0D6330E6A4E07D4E6FA77319FA8C87407C15D7A504D79D50CF08CA77EE916BA320A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955587, "uuid": "6097cbd5-e5b3-44f0-834c-cbc9287b2283", "value": "6f462fcc6b830b77fb3fef2add9dc570", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955587, "uuid": "4fafb106-7e76-4f66-ba3c-861845f55398", "value": "196608:/i76SDEa0mOCb5xm4J15iY5XBx9vjnWmf58eOt6dp2wGSECksB579u5gnynV:/imJa0mN/p1599vjnXVd9pl5Ggn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705955587, "uuid": "08633bd4-93b8-4469-be7d-7c7ced8ef659", "value": 13190144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705955587, "uuid": "42b3143b-2ddb-4a9e-8bd3-79fdfc4041e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955587, "uuid": "cf35e8d1-37e4-4544-bf8c-74964951a248", "value": "GXBuilder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d729b83e-b957-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705949741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949741, "uuid": "692e76b5-3818-4b45-aa76-1f425efa20d7", "comment": "Malware payload", "value": "9fd1bcf02436e003b66b559c3ece2e12", "object_relation": "md5", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949741, "uuid": "e3e96b26-980d-47e2-b308-84bb4bb03482", "comment": "Malware payload", "value": "3568a5ff424ee5c5c00c8a3551f78d40050c674009b21de437bcc949faaf1f08", "object_relation": "sha256", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949741, "uuid": "705b0467-181c-47bf-b664-839299e86458", "comment": "Malware payload", "value": "a3cc4d72f081b14e818fde79d489e6a366ba91d0", "object_relation": "sha1", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949741, "uuid": "1447872a-b382-4d17-af7e-22bc7a88259e", "comment": "Malware payload", "value": "da5c203e841d69e85ed80124f4c0be84349284ead5bdb7b5a1cb5ec15e6174f10fb87c730804ff51901febe43b1706d6", "object_relation": "sha3-384", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949741, "uuid": "ca26cb75-5230-4530-be53-6da40ced4a55", "value": "T1D286332AF543BB5BD9960B363222DB988013DD25C34B23E511597AA73EB375E3113F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949741, "uuid": "e07a2edd-d789-4c9c-8cfc-f5e26661d708", "value": "49152:Ao2/FywTOJtkBOqiBTaks8+wUtGOKU92NfrmlxSG0+mxaVU5k:/AAzmJ9j8+ptfKU92gxH0+mMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705949741, "uuid": "9cf64d16-d6f3-4bfc-bab9-cab03ebf1a2e", "value": 8413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705949741, "uuid": "94e973bb-8694-4b3a-a896-4a9e509c1626", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949741, "uuid": "ff1f2dd4-862d-4ec0-ad91-50eb6a6d4a0d", "value": "3568a5ff424ee5c5c00c8a3551f78d40050c674009b21de437bcc949faaf1f08.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de173bab-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911957, "uuid": "7f4e01b7-5f4d-48f0-8a14-ae6774963883", "comment": "Malware payload", "value": "c0b0feb7e8770977ec896f251ed6139b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911957, "uuid": "e9a13491-75ab-4367-8726-9cb42786c47c", "comment": "Malware payload", "value": "35b2b5a3816ec3bf51819cba02f3e1e76c9e1f306f9b2ab5bcdeb5ef8eb56273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911957, "uuid": "185b96c4-5536-4238-bd81-a02110b37102", "comment": "Malware payload", "value": "837420079536b8d2bae850c4ec84ba86bd8238d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911957, "uuid": "8ae8f2b3-7624-4b5a-90f3-cb72297418d0", "comment": "Malware payload", "value": "2a0dd15e73d2379476a97ef084da1c209989db3bf0b80ba7148bc7d3f608fb8be6eddc3aa69cce6cb628ca62d68e4c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911957, "uuid": "2d0e6333-cc90-4bb7-aa98-70fe6412396a", "value": "T16C1633180943E95EFE4E9AF7BCBED12DBE44EC1563A218C5334F680DA656B8D6B74C00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911957, "uuid": "c642701e-c45e-4d19-943c-2dd939612f83", "value": "fa5da2b1ce2f3ccfcdc8335435558287", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911957, "uuid": "412be008-0a9a-47d5-aa5e-736180b55428", "value": "98304:/U7BSF+8NNIu0UHPPvykGgx8gBPMYLXu+uSgz3/:/WSzDIu0UHPPvy1gxPBPMaXu+uRzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911957, "uuid": "ad95cc07-3113-4a7c-9e01-a4d5f2241dc4", "value": 4125712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911957, "uuid": "150adf20-29e6-4583-a02f-8163ab99cd83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911957, "uuid": "d131e2a8-11a9-4660-a118-a3b06bbc1051", "value": "SecuriteInfo.com.Win64.MalwareX-gen.11131.5814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e53f7cb-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705917273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917273, "uuid": "3c361abe-df52-493c-acb4-a9fea510e03d", "comment": "Malware payload (GCleaner)", "value": "2af7c020d18d5643c54085614218603a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917273, "uuid": "1b9b051d-7a43-4707-8f60-02ea4849c7b4", "comment": "Malware payload (GCleaner)", "value": "3625dc9e5840d432009874e69e7f2e333802046b66c9ff8767d0d81db12948cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917273, "uuid": "6ee4a6a9-e7de-46c4-ae75-cbb4dd620e23", "comment": "Malware payload (GCleaner)", "value": "23f8da387d22a1656d3f0403e5784e7825ecb24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917273, "uuid": "95f49c81-9a99-4a63-b92f-f9b5883e3bc4", "comment": "Malware payload (GCleaner)", "value": "5f1a838ae23442214acb1b52f88756be565b88b90064aca6e153da285991b9b77c13e6b192eb2845197ab708315367fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917273, "uuid": "bb66a120-6155-4fb3-8bf1-9d02d9ce4682", "value": "T105446B83D2E27D85FA66CB728E2EC6E8371EF5109F5937695218AE2F04701F2C263751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917273, "uuid": "9eab5291-6a8f-46af-97ff-57f4a82e9dd7", "value": "c52f363ae887f7e2b622bb07b5377eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917273, "uuid": "f1676224-206d-4424-9c0f-99625073f218", "value": "3072:eRt0LT9BcqVYzLMe3gpOYzmAMF7OZyuEaYguRekezGmHzSFZhue2Fts5vDx:e/0LJWqVYvupOYdaOMuErfllmkZhrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917273, "uuid": "bd9d4a80-83a5-45f7-bba5-6a6956587ea3", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917273, "uuid": "f6e13e19-e4bc-4650-a891-a280acf73a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917273, "uuid": "883f85f9-5936-44b3-a7a2-5f7b14dae943", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51732bb-b92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705932558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932558, "uuid": "6e478143-8d30-48dd-bf45-caabb214d78d", "comment": "Malware payload (AgentTesla)", "value": "9ad3df98ff6a260e0619834e0a7f1cdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932558, "uuid": "de76bc84-07f4-4b76-8731-be74c7e81dd0", "comment": "Malware payload (AgentTesla)", "value": "36333708c9444391b6a026b688b2ee4429165a1d3fe0fc3869ae67095f050ce4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932558, "uuid": "48388fc7-cb3b-47d7-9bca-487554665289", "comment": "Malware payload (AgentTesla)", "value": "a3493448827523e971ec8544c40198421b807a6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932558, "uuid": "87ba667c-d168-49de-a6f3-6099ac8848c9", "comment": "Malware payload (AgentTesla)", "value": "6271b949b5705bc8e6e5c331dc3659fdf9bd7bd923ae5e214e8c6e6e2e14a4bee5c74549a31eade16df72eb75407ff23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932558, "uuid": "497b5e9d-c687-40f3-9d0e-5be9802ed59b", "value": "T19BF4F108AF93C21DDAD0BBF448A1D5D963703FCA65F3D6086A953099DE22B0FD980776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932558, "uuid": "0b1ffbf1-89a2-4af5-8b63-2752d8c930f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932558, "uuid": "09679554-8cb7-4c5f-b70a-fdd4f589d8b6", "value": "12288:zdt9M+61GBQyUgXmNgjThH8j/RGPiObez+k57BrhJaMSmAaNk6:zdt9HIGjFeRqiDz+WBdJd9AaNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705932558, "uuid": "fd2c9639-bcf7-4d4a-a6f6-26c64d853b4b", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705932558, "uuid": "d917d144-841d-409a-a6d9-3ac17e31cd1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932558, "uuid": "08558a0e-3d7e-4b97-8b9e-58b0f5eb2210", "value": "ORDINE 01-005919_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00ad806-b937-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705935959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935959, "uuid": "aec55dd2-2cff-4766-a8b8-17065450d25f", "comment": "Malware payload", "value": "6251c024b0065745ca503279d7400cd0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935959, "uuid": "0ccaeafb-a52a-4678-a563-d08c996607e8", "comment": "Malware payload", "value": "386d39eb7ff2699d42cb4bd5a13b1f40f08956f32a58b1ed58d7d7c3e2e6b30e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935959, "uuid": "4f3124d7-ecdf-4736-969c-f3ff6ae0d655", "comment": "Malware payload", "value": "d3dd45c19029962239efd7c6cfd0d177595ad666", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705935959, "uuid": "4f21163a-0fd0-43c8-ada4-ee3aad1cf566", "comment": "Malware payload", "value": "ae9871e0266882bd7e0df36c7eb49bbe078a3860a432d7f798033a86526f9c0ac2b12ce22421dbe646707c09ad35ba93", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705935959, "uuid": "968acb72-4682-4235-a37f-f0d2d17427a2", "value": "T152181282E76DEC95E1F3A736D63151666A168CB08B23E3B31E01B23D1EF35C0A519EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705935959, "uuid": "5e4ec2ce-4768-450b-9655-49a28b7de01e", "value": "1572864:7rHylT1c4sV0MmDIPwpJSAPcNudvkPQM55hsCZ3zDsl4IYgbFJ8N:fH6A0rDUcdvKQWbZ3nPLkFJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705935959, "uuid": "ef05226b-b6dc-4b5f-a1a7-b117268902ff", "value": 86698121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705935959, "uuid": "4bd38a24-0ba0-42a3-be49-906d8e4e9b86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705935959, "uuid": "6343d533-52be-4d6d-be14-a1910ae1604e", "value": "FM_M6337_hks.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273b6597-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705910362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910362, "uuid": "03411905-53b4-43d4-9727-b6ee290b048c", "comment": "Malware payload (AgentTesla)", "value": "924a6d4ca5cf0c193d09325f2d8af02e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910362, "uuid": "b6e069ba-9493-492f-8412-e191feaf6ec5", "comment": "Malware payload (AgentTesla)", "value": "38edeae06916cdd360fd332ec2ab03af1b0af917d772406109f0e755e08af291", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910362, "uuid": "46fd959b-6d76-42db-b28c-511665e3c0d3", "comment": "Malware payload (AgentTesla)", "value": "77d6afa625f2e1b16ba4599df1f7e7bb7b8762c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910362, "uuid": "90b50eab-d69a-4329-bb2e-37357cc7be0e", "comment": "Malware payload (AgentTesla)", "value": "10f834c835444a0da2261d3bfebd2e1c2a15dbe6c126636255041c6c09ce702d233a60b87f3a704774557c337a8f04b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910362, "uuid": "5cd8a01a-5ec7-445a-8093-6ec6b823df2d", "value": "T139D423D23F32D7B1D2140371A3713A3A15BA365FB366453C06B3AC25B540279DBEA18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910362, "uuid": "121fac11-f1e5-4480-a2dc-284a1646f5ae", "value": "12288:SzBN9kjwzIeEcya2E37NjL9TMy4OFSGSyCR64H4N/OYVod0r4htk64N:ADN0ebyy5pQX+UnRA2o4rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910362, "uuid": "150013f6-7f16-48ab-93f4-427b18e49b25", "value": 610024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910362, "uuid": "d124d209-e6ed-4b05-9a82-037b5763d629", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910362, "uuid": "95a3a6cc-ec46-4886-9761-66e8bb3fc2bd", "value": "Spare Part and Service quotation for S9 and T300e.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caeb5346-b959-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705950580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950580, "uuid": "57810d54-e51d-4884-8409-25ee08713cff", "comment": "Malware payload (AgentTesla)", "value": "4bcd6a071580fcbc0a17d7d27f6d9269", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950580, "uuid": "6dc4790a-225e-403f-ba6b-c1f8c4167340", "comment": "Malware payload (AgentTesla)", "value": "398c85003f5e9e47b109c4d6fd2efbc9a17f2501c2ebc4ebd0dc3fef2bbd2614", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950580, "uuid": "c98789b7-c567-4786-a7af-911db8a6240d", "comment": "Malware payload (AgentTesla)", "value": "b9586c8ba29b1a9ab81cf89fbc5d366ec01277b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950580, "uuid": "266d46b1-e022-4cfb-8a54-201683c8d0d9", "comment": "Malware payload (AgentTesla)", "value": "25db9c716905c0addb193f80b955dabfa58d04744fb51d207f651d66608ed6fc34dbc7211ad7a51dfa96467a22c49911", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950580, "uuid": "5f38bda2-ce1b-41d0-bf83-5ac3d371bb04", "value": "T1A945AE0E3381802EFE9BD133CB56E63146B86D263127A5DF135839B9B97C161163E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950580, "uuid": "04e00f7d-4987-4c17-a654-fd310a0a36ac", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950580, "uuid": "2d08556a-7cc7-4f94-ae90-841973102dac", "value": "24576:qqDEvCTbMWu7rQYlBQcBiT6rprG8aW7BHiIZTXDJ:qTvC/MTQYxsWR7aW7RbZTXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950580, "uuid": "4963188f-6241-4f28-a2f1-50ec23b23d05", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950580, "uuid": "d634eaa4-e03d-45c6-9968-3d71dc888ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950580, "uuid": "29c96879-b06c-41bf-b726-e90a8f9858a5", "value": "PO-4500628950.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7839adba-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923383, "uuid": "cdf51891-8b42-4945-9aab-301864ba31c0", "comment": "Malware payload (AgentTesla)", "value": "33ba8d8149f8446741a81e950af0e440", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923383, "uuid": "0d888d07-852a-4d88-b447-50447a0e2307", "comment": "Malware payload (AgentTesla)", "value": "3bc8d75fa8701770ed77fe6a4533e09eb3bab70f4605c6b34928f41a4a5d6487", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923383, "uuid": "04b7bc4f-7c55-4abd-aafe-6d25c3124e2a", "comment": "Malware payload (AgentTesla)", "value": "b97c4569b8aab12cb33c71c7db39376e59f06b2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923383, "uuid": "8014b860-b0a8-4b1f-a783-007510fff5d1", "comment": "Malware payload (AgentTesla)", "value": "b495825a8d0f39c3a45fff7d777d6abd1d2b9dbe27bcbfcccfb93718c123758a8db8b8390370ed7c9db338c3625ec3f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923383, "uuid": "21a02341-481d-4420-a6a5-7f1e4e49c1e0", "value": "T15235BF023381D122FF9BDA770BA6F6115A7C6D260123E51F13581DB9BE705B2163EBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923383, "uuid": "0a43a08c-4c82-4def-86e9-9cb2dc7c68d0", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923383, "uuid": "eabd3ba1-7776-4264-be1d-fcba3d2a15c9", "value": "24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aDlPNuUO:QTvC/MTQYxsWR7aD/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923383, "uuid": "063036fc-67b1-4553-8f42-d0cfe515c97c", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923383, "uuid": "8c3f3866-f905-4577-b06a-98ca5535188b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923383, "uuid": "776a6bc7-aa7f-4b35-8352-27670c118831", "value": "rComprobante_00643233352_Monex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0236f88e-b929-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705929627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929627, "uuid": "2d144ef8-cf64-4a59-9bf9-241acfd869bf", "comment": "Malware payload", "value": "aacd99c7edaa76d6a675eca5a10b7027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929627, "uuid": "f8326e6d-8d40-467b-8507-dad7a3d0a4f2", "comment": "Malware payload", "value": "3cc7ea8b61d2c06446a4b8c082b1aafdb3925f8ef837f952701a3e1bc384b596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929627, "uuid": "a9b5ce3b-b0ad-4edb-b026-80cb64fb0b39", "comment": "Malware payload", "value": "bcf3dceabdae3f0d8690fd208b5ae4ecfb48980c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929627, "uuid": "ed49fdfc-58df-4d89-bbdb-dcea0f8f0778", "comment": "Malware payload", "value": "b8a21d01e8e992da38d44e7c99ed240e8ab60eb3f86f2d026cd8b61fd0ad7d870ce35e64c94eeb7720c02b12d01a4d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929627, "uuid": "d52e93f5-cfdf-412b-9ea9-39b350e6819a", "value": "T1F3E47D15B3E841E9E0B78678C9B78545E772BC225F31D74F2294E23E2E376904D3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929627, "uuid": "610bd4c9-bcf0-45dd-bfaf-d8e6c154f139", "value": "7bd0be4e7e942acf6956fcb35e6259e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929627, "uuid": "92c4d63f-bcce-4ee2-83e2-b0fd67a62b0a", "value": "12288:aAS7wlt8iKQc2Bhvd6hb1eeukjkEximt0E6rRU8rD3F+knRU8rD3F+kg:y7wlt8ec2Bhvd6hb1eeukohw0DU8f3F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705929627, "uuid": "96fc1136-715f-452b-88db-2dbb2e5b6df2", "value": 696736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705929627, "uuid": "0bc36bc4-8494-4942-9288-469ff8fd09bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929627, "uuid": "e6b6b7b0-d5c8-44de-90b8-bbf13ae65210", "value": "4354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76976020-b945-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705941848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941848, "uuid": "5f651f85-10d8-4ec9-8f11-b368aad2466e", "comment": "Malware payload (Mirai)", "value": "c70c5ef179f80bda20f063b4670ac4c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941848, "uuid": "ee4e8af4-3734-4d29-bd10-182177387099", "comment": "Malware payload (Mirai)", "value": "3d588518e85851c442b20aeb1294922889cb26aae48a4d5202283233bc551694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941848, "uuid": "b034a555-f950-4a2a-b830-05b41393b82c", "comment": "Malware payload (Mirai)", "value": "e7fde742c48d1d2ec4ad842d065c03ab8b08cac9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941848, "uuid": "767853ed-a452-4201-8b5b-a65a9dfee4ad", "comment": "Malware payload (Mirai)", "value": "836adb4c00f6bb2786f63550425471feb25565919c0f049cd60a66fb4b3e0196fda9b5b35019f332a23cefd177118a2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941848, "uuid": "24c79241-d9dd-4fe7-b1a7-842b431cdb4a", "value": "T138F2D06472044DDED0AAD475CAAA07523AB046D17E93ED1C33F0AC835D8A8B63DD6BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941848, "uuid": "346a9b8a-791e-421b-ad37-d06d59547ebe", "value": "768:f0EQrTzqfaGaoPo4pXxE+QEpPy5PPuVxJgGlzDpbuR1Jw1:f0HrTzqhaoPo4pXxEMY5uRVJuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705941848, "uuid": "87fb2efd-2d44-4991-8df8-4acb17e58c7d", "value": 34932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705941848, "uuid": "cc2f62e8-72e1-4271-b203-a3afedc5a77d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941848, "uuid": "778d0161-7705-485e-8a1a-9d28edefcb04", "value": "SecuriteInfo.com.Linux.Siggen.9999.9238.32406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c99cfcd-b922-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1705926799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926799, "uuid": "1a850d9c-ea54-418e-b299-054f1e1317dc", "comment": "Malware payload (Adware.Generic)", "value": "56f36b2d4386e387f272b0d70c2d4c1b", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926799, "uuid": "571ec87d-f0d8-4e5c-b8eb-02638b227369", "comment": "Malware payload (Adware.Generic)", "value": "3d6f4d135057f265879c13f8c568c1591bb349d5cab86a0b1e24f94893d60779", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926799, "uuid": "f611dc40-c093-4fd4-a5a6-124ec94bf5d0", "comment": "Malware payload (Adware.Generic)", "value": "48ba50f093d16f72821db2b1c337b2153ac8cb1f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926799, "uuid": "f7ba259e-ea19-4158-a20b-29223e90dbbd", "comment": "Malware payload (Adware.Generic)", "value": "9c019fe97dfdec571d0cefc80a0a90bc070e7bb45f98a9422c1f6b32fbd0a60aba489eb35d4be799d857dfc23f3577fc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926799, "uuid": "acfbb405-1b96-4a7c-bd40-afd72056f4c6", "value": "T1F4C50261A50EC82DD2DA1DFC7822B725E83ACF945BF8C59DAB70311AC577F9024CAE05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926799, "uuid": "746e603b-069f-4db3-b5b1-f73cab6e4fc2", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926799, "uuid": "38db51ad-ce2d-42dc-bb25-2a5ce7145a95", "value": "49152:NcH8BgLrRghGysE8B2AVJ16bEet/2APggAYjx6qFK51pJ05FVVCJElqegeKG5/n+:NVGysEdKCbE7TgAH1EfVIigex5/TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705926799, "uuid": "6cf0bd34-ed7d-457e-a9f6-496060b43bec", "value": 2664280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705926799, "uuid": "ecf57285-c1e2-4ee8-b1ba-7ae681f969e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926799, "uuid": "6ad66f4f-f936-452c-8631-20fb0cb634ad", "value": "SecuriteInfo.com.PUA.RegistryReviver.29146.17945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02dfa157-b902-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705912878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912878, "uuid": "f54394d0-457e-4925-9c76-7c0a4a1f6689", "comment": "Malware payload (Formbook)", "value": "5c8b305236ca208eea43945d2771a401", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912878, "uuid": "bfc34133-10b5-43aa-9e38-8ccf0831aa69", "comment": "Malware payload (Formbook)", "value": "3d8a60463219bf3008e509aed8a505043d3e76e7110d5dbe9a245a26e957330e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912878, "uuid": "c2864ccf-e8a3-40f3-bd78-4bdf3224b2e7", "comment": "Malware payload (Formbook)", "value": "f73eff1d83d88158f32ab062c8279b8209dff82f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912878, "uuid": "266734b8-bd9c-46d0-bddf-7c4bf1cbbd76", "comment": "Malware payload (Formbook)", "value": "ce0dcf6058a767035cb74e62bba1c5171eff1b02537c51c047614afcad468aae8c4788764c60d9d655f8e2c7c853e821", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912878, "uuid": "f4de616d-1fd2-4fe3-9e74-39bf19f57e81", "value": "T17DB4235530D7DB6BC0D760704EEA80DB1607BC02A742F97735ACB7AE197A740C8B2A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912878, "uuid": "7ec1d97e-7cc3-44c1-aeb1-9c95367fcf8e", "value": "12288:pSNtBC6uEkpQpozwjTqCfgb+W6xZsVPg0vik:Ow6srWWCfgKWNVPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912878, "uuid": "d5944c14-d8d1-465e-a4e5-dc8b22ca20a1", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912878, "uuid": "ab99de2c-2849-4c1a-b428-0b236b9a408b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912878, "uuid": "4703a025-1268-4426-abea-35ff5fd78807", "value": "Enquire 2455.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2df215e-b90a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705916636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916636, "uuid": "760dae57-e091-4595-8ee3-0bfc02b40830", "comment": "Malware payload (RemcosRAT)", "value": "8f70e913513b30a144165829ba3261bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916636, "uuid": "3e439019-a2aa-444d-b9a0-2acdec346946", "comment": "Malware payload (RemcosRAT)", "value": "3e32447ea3b5f07c7f6a180269f5443378acb32c5d0e0bf01a5e39264f691587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916636, "uuid": "d71322f9-0ecb-46dc-aecb-3377cb655ec3", "comment": "Malware payload (RemcosRAT)", "value": "906b4b04b638f9bea41a39649f3a69cac64a9c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916636, "uuid": "853a8f3b-0730-471c-9519-ed14364309de", "comment": "Malware payload (RemcosRAT)", "value": "c202b7566dc53f50a4ab1859139791eca25bdf6c263fc2f82b873c635a8a90739dcb78c4db9063c407c3387d5c6b25e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916636, "uuid": "e098239c-1ce9-48a8-85f9-4b319da67df1", "value": "T1ABB49E01BAD1C072D57524300D36F776EAB8BD2018364A7BB3D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916636, "uuid": "4b195699-98ca-4ce4-9d2c-28ca4edbc8c6", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916636, "uuid": "6656b67f-9202-4f95-9d80-3c19ed7f69c5", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNE5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/Zs9cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916636, "uuid": "a2479b9c-48af-4d87-b8a3-7b2ac75ea071", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916636, "uuid": "dd1c95f7-4a68-46c3-9bd6-dbec08d13a2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916636, "uuid": "8b4728a7-fad7-4698-9607-647f1f5f4ab7", "value": "8f70e913513b30a144165829ba3261bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9fcf40-b979-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705964061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705964061, "uuid": "03bde287-634b-4da9-a1a5-8bd0b71d93d7", "comment": "Malware payload", "value": "33e20d17d1ac19b0491fa9d71fb30296", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705964061, "uuid": "e87469b8-2519-47da-91b2-7dcb25df20d2", "comment": "Malware payload", "value": "4029b7967eac8e5c7e441915fbe24552b56bb52b044ccd447a1ade6db574d7c2", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705964061, "uuid": "7da610b8-6dc7-4312-8255-fb4104a2b942", "comment": "Malware payload", "value": "41b4631a0d5a33598f4ae3c9726709d658116570", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705964061, "uuid": "5aeafb2b-1367-4271-ba78-a8364152efb9", "comment": "Malware payload", "value": "9a38cb6e474db5b293b34cb5e42bba3b48dc1fdb338fc7b422b313c6439da960019be749803909ac10d811b4c0a41114", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705964061, "uuid": "4ff218af-7970-4445-a95e-baaaad8d324e", "value": "T1D5A4CE83D2E27D51FA724B768E2FC6D8761EF5118E5837A962189E2F04B11F2C273712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705964061, "uuid": "556d6d09-9c9e-473c-8fce-002b5256a99a", "value": "c52f363ae887f7e2b622bb07b5377eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705964061, "uuid": "cc25d54e-81d4-4737-b568-f86cf6d5bf60", "value": "6144:KETbLiOeeI26BKN/jXY2SwAyvNv8b/HV/AtbwGqwFp5JJDz87KVXTnyJYNDKT:ZHGtEaKNLZurV0bwGqwTGKVGCNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705964061, "uuid": "ff8d8580-1135-4fbd-9dd0-ff76d127534e", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705964061, "uuid": "9e5e5608-671f-43fc-9bae-4f9480f5042c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705964061, "uuid": "0875c57e-9551-47c3-b3ce-a3f93f084082", "value": "Wallet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be34d346-b919-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705923071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923071, "uuid": "1aa86e0b-0f17-4110-937b-2c7c59e8a258", "comment": "Malware payload (Mirai)", "value": "952f3656a6bda5d3dbf6b0ecde242060", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923071, "uuid": "88f437bf-eb0b-4f5d-aa6f-3cf512a72dca", "comment": "Malware payload (Mirai)", "value": "40cf07d2ef310a210582631d0ccb68b9b2eb7183d5dc305b7eb4abc0b6b9477f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923071, "uuid": "0175db9a-d597-4e29-839b-13a747ea12f6", "comment": "Malware payload (Mirai)", "value": "910c8d9b8c4adfbf215ed9951dd4c061bc3fc84b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923071, "uuid": "29c73198-e1e3-4220-829f-5ee506bada8d", "comment": "Malware payload (Mirai)", "value": "4c9a8b408225ea2caba39c7e8d43aa985a8a2b498518df6851ee853630ae6887b5b870ac39e4954fe7721430f56d3a94", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923071, "uuid": "c35e84c9-4da5-45c0-a95e-0d849edc228c", "value": "T1C6F32B46A7408A13C0D62B79F6DB425533239B64D3EB73059928BFF43F8279E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923071, "uuid": "2fda7d0a-8a76-4011-910a-61fb4151d1b1", "value": "3072:ipcAMMV2ZifY8EaAM4CApiE8TyPP0zhJKiHbX70M/9+iRsomWwRQv/7:ipcfMVhw8EaAM4CAAEPPIHnHbXgM/9Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923071, "uuid": "212be78d-1f02-48ca-87ea-b98039774c30", "value": 162133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923071, "uuid": "66a1a5ad-3bfd-4612-a91d-f416b2fecefb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923071, "uuid": "3d163962-6dc3-46f3-bf44-43860714f60e", "value": "arm7.nn-20240122-1131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf6eee7-b929-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705929910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929910, "uuid": "fd381e43-8117-464c-9fed-538fb676cb23", "comment": "Malware payload (DCRat)", "value": "72ed3a83991db28e051d9b5c2f1794a3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929910, "uuid": "aa93f0b1-bd31-4be8-b7c5-4374716fcf7e", "comment": "Malware payload (DCRat)", "value": "40f1ca5f9ecae0c8c1a6a4355c8cfe1a641f06665396b0883fa0b67c9c1600e7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929910, "uuid": "f9d8ba18-e211-4447-b60a-7cabb5314bcf", "comment": "Malware payload (DCRat)", "value": "5bb5027c6824438d1d8838e94777314fa319d191", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929910, "uuid": "fcf32ec9-61cf-408b-93bc-f963f084c9a4", "comment": "Malware payload (DCRat)", "value": "a97d05e0d4a8a32e39d80b58f9157ffff8ac16feafeed4d197a998dc83b6f9401dd441984c72aa1104390a11d124f92c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929910, "uuid": "b1591f8b-5bd3-4a8f-ae96-5ce6b2c9f2a0", "value": "T19F95AE4BA9924F73C2B97B3584D7102D52B0C7A23513EF1B7A2F51A5B80A2358E136F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929910, "uuid": "7205196a-7eb4-4376-8fb9-76147a25e05c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929910, "uuid": "ae4e9e14-2847-49d7-812b-712f811f50b8", "value": "24576:VCien//wxzxwEvsccd49GO58YEiIsPqk4U9K3qIa4sX/gtdmEETgaXHkwBi5K7:Vz6xck+EiJCkS6IPtdEr3nQ5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705929910, "uuid": "89b48655-bca1-481d-ad29-3300817657b3", "value": 2003968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705929910, "uuid": "5619442e-324e-4a44-a993-caba196dcc95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929910, "uuid": "03ed80a2-0d98-4ab0-ba0c-10d4bceff8af", "value": "72ED3A83991DB28E051D9B5C2F1794A3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275123e0-b924-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705927542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927542, "uuid": "d0dc5ec2-fb7e-47de-83d9-099d58869801", "comment": "Malware payload (RedLineStealer)", "value": "d177caf6762f5eb7e63e33d19c854089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927542, "uuid": "9108dc9b-3217-4ad0-ab7e-a117c8d65561", "comment": "Malware payload (RedLineStealer)", "value": "4296e28124f0def71c811d4b21284c5d4e1a068484db03aeae56f536c89976c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927542, "uuid": "1d431f1c-7463-46b9-a5d6-f94b2d2237ef", "comment": "Malware payload (RedLineStealer)", "value": "f25cf817e3272302c2b319cedf075cb69e8c1670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927542, "uuid": "16ceecf1-10ae-4a87-9ecf-e69eddb59a82", "comment": "Malware payload (RedLineStealer)", "value": "e95ded56259f7b7881be4ef6a43eab8d1363b5c4d8f603337a5153ec6aa59ff5dae5fc7e197ffc73ffb8498717a044f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927542, "uuid": "ff654080-d767-4760-a169-e9c1311b3ea2", "value": "T1A6548D1135B0CD72D0A6203F89D6DA255A2F28214BA6B5D7B78B27ED5E303D1B2371CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927542, "uuid": "c5c9242c-8052-4827-8b83-925cd460dff5", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927542, "uuid": "96a92723-0616-47d6-ab95-b112f801bad5", "value": "6144:iDKW1Lgbdl0TBBvjc/vGDn5rm0YEPFbBCM/:kh1Lk70Tnvjc2DxmNENdp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927542, "uuid": "74ab90c0-eeca-4445-8981-4ac2913b0d8b", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927542, "uuid": "473c6f3b-8f8a-4445-8fe7-e266b572b2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927542, "uuid": "8cd7b960-0abf-453b-b8f0-ef665715be99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ae40e2-b97d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705965956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965956, "uuid": "abeb6b62-fa06-4189-a55b-791df09f3efe", "comment": "Malware payload", "value": "79b4fe034db509452fa4b6906c85ff64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965956, "uuid": "6fc27786-b27c-4d0d-ba73-66f08e2746c7", "comment": "Malware payload", "value": "42cc9c440b2d531f2acc3cc2681c9bb4e834530349816b49dfa01ac090ba731b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965956, "uuid": "82bef067-f114-45e6-9fd5-8a75bf32088b", "comment": "Malware payload", "value": "c3e85665ab52f0d470ff2138593bfed665381c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965956, "uuid": "5e98f021-1c09-435e-ace2-abfaee0b6ce6", "comment": "Malware payload", "value": "58fa9fbfd3312d0b0528267ef0f94fb5c35e241610f079c427553dc68a33689d296d31ede54822d3aa2e5b26b09cfb7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965956, "uuid": "0a63ea9f-7513-45f0-99ef-43d6693a52ad", "value": "T191B55A03A65544EAD299C078CE16D136EB627C5D4BF661FF36806AD53E37AE03B39B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965956, "uuid": "6cab1f54-003a-4990-a8de-b6f845772891", "value": "7ac9a4d21dc49f82e6a6779ce74825da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965956, "uuid": "cd677cca-c100-45fa-ba5f-101c98903af9", "value": "49152:zvHlE9n/AjJ3Rf05xU0NG0EkCQb9OTGr2o2oK:Lc7Xb99PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705965956, "uuid": "b8514dde-0312-4475-953e-6816227ec915", "value": 2475008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705965956, "uuid": "13349509-930d-428c-bf08-ec0c416ef4d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965956, "uuid": "9942ef9e-f2b5-4e2b-92d4-932075a46d19", "value": "SecuriteInfo.com.W32.PossibleThreat.30397.20878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dba6c7-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948078, "uuid": "63460f04-0fde-4c4c-aae5-da02a0e43774", "comment": "Malware payload", "value": "0692382a5ccf0b0b9406a434352bcd66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948078, "uuid": "a21a6d47-6d52-456e-8111-eab911e415ca", "comment": "Malware payload", "value": "44c11f2419a7650053168843f0c092a45187920bec71ede3d26473472575ee6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948078, "uuid": "ad6f8c22-a109-47bc-837a-40e21134f93c", "comment": "Malware payload", "value": "d67f6d9f3353d712c13a96b00f87f4c9d511e26d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948078, "uuid": "3812786b-12d8-4564-a5f5-d049da38af57", "comment": "Malware payload", "value": "2b57402f0161aaf96d1f04992c46b56d6f36679ad711c9e6a94205b2fa51babc864ddbd690528a1a4cdf7a2a02ddabbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948078, "uuid": "20d6bf47-9ef6-4a53-b0fb-2fbba646b39c", "value": "T166C53385FFC495B0F1624E762C83B0896F3AFD2A6E98954B76D43F4E2C7DA81184C4E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948078, "uuid": "29ff0707-dbd5-47e3-b2af-f15d9913e0d3", "value": "de1fa96ad5bc81910ffb7ed552e29d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948078, "uuid": "13592bc5-8bfc-41af-bf9c-fb34a39f5070", "value": "49152:5wTtKTyEJdyyUa6PrvMrKQHBhzFrBRucp2uBUYYs2aoywX7AqomhDHsH:5atKOMFkxQHBBZOtuBUg2aKXTJMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948078, "uuid": "d64cf76c-9a00-4cbe-b6bc-6e08f1ae4707", "value": 2619113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948078, "uuid": "45a0a130-fde2-4a1b-b896-13194014ff6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948078, "uuid": "63576fd5-0553-4f37-b394-713d9012a55d", "value": "SecuriteInfo.com.Trojan.PWS.Panda.8062.7332.22919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7880d5a4-b922-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RuRAT)", "timestamp": 1705926819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926819, "uuid": "dff15d8f-fa31-4e4e-872a-7801445ae9e4", "comment": "Malware payload (RuRAT)", "value": "96c5a1f7734e12ca8532ae046cd69657", "object_relation": "md5", "Tag": [ { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926819, "uuid": "76668726-7a76-4b0a-a05d-ffe1289a9c53", "comment": "Malware payload (RuRAT)", "value": "44cb295694f3332b31500c7d8408e6f93bb34a56617ae6850a205ed16c2a42a8", "object_relation": "sha256", "Tag": [ { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926819, "uuid": "0e9a20d1-b1ca-4e49-8b55-d3491d6543e9", "comment": "Malware payload (RuRAT)", "value": "506a9966b53fa3bd185c957ca66860a37a03883b", "object_relation": "sha1", "Tag": [ { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926819, "uuid": "1dedaca6-bdf8-406a-83c4-f6e9f433e657", "comment": "Malware payload (RuRAT)", "value": "f427897c01b3ccd1d757b272731873ce3bdf65f75d2e0a912c22234f8329dd22ad5ab55c6f808475bfd2d74538c29d4f", "object_relation": "sha3-384", "Tag": [ { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926819, "uuid": "b77a0dfb-f587-4b56-8e22-2c5b71018637", "value": "T15FF733B3B4B38C2CC14F27646CA3514CB475AA031836FB6276E1D694F215EB28536FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926819, "uuid": "cc6b7569-d0fa-47dc-8396-dc345bff10aa", "value": "1572864:odGgTRKAeOnFhPUfaHj9x4Zo6W/JiWdBLkZAekooRN5r9WJw:WfRKAznFd92ZoPRiWdBYmekt1J6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705926819, "uuid": "9425aa27-2512-497c-baf3-7afe01a490e3", "value": 72929920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705926819, "uuid": "0ad75a51-edd6-4102-9607-1bea56056955", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926819, "uuid": "8041412c-a4a2-4249-ad6b-a5c76769f587", "value": "CCleaner.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a13ae55-b916-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705921560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921560, "uuid": "cb4f2401-02af-4325-8445-f04e27d47821", "comment": "Malware payload (Socks5Systemz)", "value": "32105000ce675b2910883ae7d50ff265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921560, "uuid": "9350671c-adc2-4e2b-9c03-753dd4346592", "comment": "Malware payload (Socks5Systemz)", "value": "44d3b36090f29f48969dba1638d31097243516188cfe62b62559c450c4303293", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921560, "uuid": "04eb4edf-afa2-4199-b9ba-1dbdd0da87b1", "comment": "Malware payload (Socks5Systemz)", "value": "bc81e4dabc33af5149d3cf63151904429cb2d43a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921560, "uuid": "f2235ae0-127d-45b7-a0d8-4851b96e7033", "comment": "Malware payload (Socks5Systemz)", "value": "1e717baa82990a154b17bc2d4ce711ec1e60f7257b7d998ebd25dd2af452729c25634ebea42ea5c294e9d47f2d92b1f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921560, "uuid": "93c1106f-241c-4951-a824-b31d2eb100bb", "value": "T106463325BF014B77D3015931ACF77348EE32FE5D3A26A2138E6A54C62DA03D09DB92D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921560, "uuid": "44d83d73-4513-4e7d-bf1b-ceddf2b4f651", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921560, "uuid": "3edd7847-26aa-4929-a150-ca319eb9fa35", "value": "98304:Cn98jUacXV1xlF1BNKwh2L4HN/81sgrcpnhWy59AALdxqbwBKtB1cTsCmBegwZgO:Y985CV1xlF1XcLGcTSwpA5Q8arkgmIhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705921560, "uuid": "2998da9a-79a5-4500-a826-7337b9c9aa90", "value": 5691951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705921560, "uuid": "61f602ae-d824-4f91-adf9-4251348146ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921560, "uuid": "c3258e8b-3819-49c8-8bd6-af37745c8d8f", "value": "32105000ce675b2910883ae7d50ff265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e0ceb7-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1705910486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910486, "uuid": "bb71cde7-9c7c-4622-9528-12b9935c7d41", "comment": "Malware payload (Arechclient2)", "value": "e5cd5b8795b356a7d1fe665651f8ee6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910486, "uuid": "20e1d117-61a4-438e-8110-81ee305855f7", "comment": "Malware payload (Arechclient2)", "value": "450661cce79d0476ba06dfbfa4f24ad1e513ca8ff338ee0e23deaf3c05ace865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910486, "uuid": "618683ad-e0a3-46e3-9fcf-6b4a28d53a5a", "comment": "Malware payload (Arechclient2)", "value": "2e2a652c389fea91f67f94cbf0fcd314df27a786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910486, "uuid": "12af1496-a469-4b54-86aa-c873cc63b2b4", "comment": "Malware payload (Arechclient2)", "value": "8ee5795006364a07aa21c7e25df0b8cd1553177133356ec6a810d357ded577773c8e3ea88132796b57a21a80b036beb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910486, "uuid": "3a3d9453-6161-4846-87f2-096d2c5bd806", "value": "T10766AF02FF55DF12C34E6B77C6D7102893B0D9926323E64A3AC9136519433AA6DCEACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910486, "uuid": "670dcb69-e479-4723-9466-ea45b9b6f919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910486, "uuid": "08403d3e-171b-470e-b230-6dcf1c83218e", "value": "98304:WkikQhkEGDzGqMuzueh4Y5PtrmVVS1WJc48faiy8oehIs:WkikQhkEGDzGqM/y4AmVV4WJ3kyKIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910486, "uuid": "7837ae31-949d-4632-90e5-7191d74bb1b1", "value": 6896928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910486, "uuid": "ea7527dd-d318-43f1-a9f6-1f57311c61d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910486, "uuid": "7ffd954d-5e5d-4a74-bc00-734cc2743861", "value": "e5cd5b8795b356a7d1fe665651f8ee6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3845cc3-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911966, "uuid": "3ff981b3-c886-4b4b-9d1c-b3fd7e43f157", "comment": "Malware payload", "value": "f96eb2236970fb3ea97101b923af4228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911966, "uuid": "8e6318ad-e269-426d-8783-18e115cb1844", "comment": "Malware payload", "value": "46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911966, "uuid": "4671ac6a-7ba9-413f-9870-91a92ab8c3d6", "comment": "Malware payload", "value": "e0eed80f1054acbf5389a7b8860a4503dd3e184a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911966, "uuid": "e6efd4c6-ef3b-4dd0-87aa-96d7cf0071f5", "comment": "Malware payload", "value": "48e38439caf82beb7b08e0e63c583fa203783f9e0532816199752b7379323fe72ca7895737c9835291e8382591ea6d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911966, "uuid": "c2602502-f1d8-43b4-adcc-d080c776b2a3", "value": "T1E806337D7627CA7CCC39E7F00D8E165EA0DC0C64DFA81591B43E708E5CC946A9CAB6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911966, "uuid": "63214c26-e105-4452-9048-4f04df5d2646", "value": "5589c8b18b47c59f6fbea6f1e217ba76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911966, "uuid": "279f32ea-4244-4899-87a8-68bfc3596894", "value": "98304:z7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6Ko:e+y4ihkl/Wo/afHPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911966, "uuid": "b413be2e-8b0f-4882-bece-681a34f177c4", "value": 3799568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911966, "uuid": "d728c52c-fa6d-4154-8e45-2c72a68355a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911966, "uuid": "db682ca0-00c4-4840-a8f7-5e56edb4526e", "value": "SecuriteInfo.com.Variant.Ulise.431799.10899.28007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3722d00-b933-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934327, "uuid": "932120dd-c89d-4860-940c-752d55f8955c", "comment": "Malware payload (njrat)", "value": "9bb1d1ffbf0029674b6d6cec7c31ceeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934327, "uuid": "b754cf33-a3e9-4d5f-aecb-33b704d7fcd4", "comment": "Malware payload (njrat)", "value": "478792cb2859dc39aa03896107902d1f3941693b244d79628d41b10f75170b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934327, "uuid": "957d0d8e-987c-4eb0-9a7c-2a3d99bcf8a9", "comment": "Malware payload (njrat)", "value": "9865fb196f376614e9be9d29241aa00c72da518a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934327, "uuid": "79a15756-5c35-4f03-a681-5eac47b96517", "comment": "Malware payload (njrat)", "value": "3017eff8a47317e82f930f24ffd719ac84d8b21acaa889dda713b86b55aa9e41f86787aa30de00aa719d0eca73909d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934327, "uuid": "0ad96c7c-69f9-423d-945f-1abcda8ee5cd", "value": "T162F2295D3BA08162D6EF2B7406A2D72102F2D1075A27EB5F8CC840FA6B777C14D81AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934327, "uuid": "df397ca5-3c62-4b2f-b0e5-e5de059a4b03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934327, "uuid": "d5407da5-4415-40c7-a260-34ba1adcdd5b", "value": "384:4Ld2p9zO7q/+0jMIKq4EZePC4/rY2OzRLTm3yilqr6hnbu2vGR:GY9zSMQEZeK4/rsaBvGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934327, "uuid": "68efaf4d-e759-427e-8288-792ee70368bc", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934327, "uuid": "42002d9c-fec9-4876-a44b-3ca8304cd05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934327, "uuid": "e96f16ee-2163-45c2-92cb-a0a4229a48b8", "value": "bTaS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513bd9cb-b944-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705941356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941356, "uuid": "0efaabb4-730b-45fd-baff-6c35a17ea968", "comment": "Malware payload (Socks5Systemz)", "value": "62021d2869a330427567e45b0a1f8e53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941356, "uuid": "091c0bec-0899-4f36-a659-ce6f854c802f", "comment": "Malware payload (Socks5Systemz)", "value": "479179b35bf5ee0042940137db914a07d967139ae0725b3b94acf5173034356b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941356, "uuid": "4bd5fb42-074f-4e97-9f33-f69042469b71", "comment": "Malware payload (Socks5Systemz)", "value": "ec71eb3b8f8721b90f5535962d96373d168cae7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941356, "uuid": "a9e870b6-d49b-49e1-b3d8-ae56ac4cfbc6", "comment": "Malware payload (Socks5Systemz)", "value": "a41d617e40726e5d17b86f77c05fb3d96f5d03a82ca159eb3259417fdcca6220ae5661803dd35c39d8d4b5c248c7c32f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941356, "uuid": "eaa60543-dcb2-4fc0-9c1f-e8f17f40ed70", "value": "T1BB163321BF904367C6504E35EDE2B310AF32FD5E562B0A06356FA6DA1C623D09CB73A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941356, "uuid": "1b90de1e-3e46-4508-b484-133a3b8720c6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941356, "uuid": "d1d9cb3a-fdd5-415a-8e3b-aae9d4690962", "value": "98304:jftnXRS16h7v2xxsNQyvk8r24cTlBfhuJ38/ed358:ZXRS1c7N214QlZC3Qek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705941356, "uuid": "5c8bfb25-9686-47e3-820f-623d2c05f0d9", "value": 4175965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705941356, "uuid": "ce3b849b-6e2b-4a8e-9420-3e5e3ad00641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941356, "uuid": "9e37d38f-75e2-4067-b832-f384eb0ad011", "value": "62021d2869a330427567e45b0a1f8e53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a34ceb-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705910327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910327, "uuid": "e7f33f4b-a020-4ef1-b80b-e7b52dd57534", "comment": "Malware payload (AgentTesla)", "value": "b43d069cc71a21c44f77693c5e0e9de8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910327, "uuid": "6df0d2da-30a6-4240-a353-dc8f268e459c", "comment": "Malware payload (AgentTesla)", "value": "47f361fe2676807f11cc86b266cb8efd4aebbfcc45cf0590eca54b4407948a69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910327, "uuid": "71c9cec6-6ae8-4d35-9751-c2eefcc5e972", "comment": "Malware payload (AgentTesla)", "value": "f3ccdc0c29a751d57f6ddbefbc65396c8ccba6f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910327, "uuid": "2d5b66d4-302b-4bc4-8254-3e103ebc7a3c", "comment": "Malware payload (AgentTesla)", "value": "7e16f2a4443df3ff78d8594d8c1dd186dd5bc34162326a15724c36dcacf3d23e544ae7f33a8454af02b75627fc620311", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910327, "uuid": "55e9ad69-1df6-4ccb-91ad-05291e74aa15", "value": "T186F422191EC59610CA995DB594F3F3605373E67C97B9D30AB88C9A820F333E66593B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910327, "uuid": "85767bd2-756d-4564-965a-6ee56587e659", "value": "12288:MK6JVzgRzQYyNduR7T9JiOlSmVHS8v0HgT8iSd/voTqtpI4:wzyPyQ9JKW/vNTpwYTypI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910327, "uuid": "1881e85b-1f98-4456-b94c-e5dfd455d81b", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910327, "uuid": "80145782-fcb1-4b41-a493-f91f3bca9ec8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910327, "uuid": "32d3f5a9-674e-4624-b791-5486a7e013ef", "value": "S004212823122940.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8905082e-b8de-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705897641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897641, "uuid": "fe77ba4b-e798-4ae4-94da-f97d52d82689", "comment": "Malware payload (Amadey)", "value": "f29e03482ef250e5c8f2014f660bb86a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897641, "uuid": "b7fb3e4d-c679-499d-82c3-7e6dd85db0d3", "comment": "Malware payload (Amadey)", "value": "49128966da54f55e6fd663f8bb8da56e800de17363a33d53e8fc370e29f34e20", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897641, "uuid": "70ab3086-ec34-4385-8da3-2a60c5ed5050", "comment": "Malware payload (Amadey)", "value": "b2d2c6a09b5ad1566bcc3af92fcd4d6be1406bc1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897641, "uuid": "7261ff43-35c9-48f2-b29b-f7c29a949186", "comment": "Malware payload (Amadey)", "value": "fb9848579596b3bf88f04f1518c98734f5973f4f1864097954d8e2482f6c90d3bd3c9db3a7e679f3a0c58e4fab22f13f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897641, "uuid": "77fdf8a3-3594-4f57-86f4-971ab8183450", "value": "T1AD569E03BF61CE12C14EAB33C5E7251853B0EAD66323E70A7AD92356194336E5DCE6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897641, "uuid": "f7edc987-b230-4e27-bc1b-f1a26f282a09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897641, "uuid": "7225d389-fc20-443d-92ec-2ba68510afcb", "value": "98304:6yAkHknbi4rnhhyQxDD7FuFMWC9qum/kQQfteIpj:6yATnbi4lhy8jsFMD3mPypj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897641, "uuid": "d7f4430a-a6d7-434c-882d-f3ef4b11623e", "value": 6401400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897641, "uuid": "c756bdb7-6cf7-4b53-92a2-4ee6808063ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897641, "uuid": "9d35de18-d8d3-4a0d-8b9c-7ece6107bdcc", "value": "ama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6840b05a-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705910471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910471, "uuid": "48208fdf-4881-4f66-8871-d6919c8f08e1", "comment": "Malware payload (RemcosRAT)", "value": "c5f3fe9e18ea911125d73a31fbd1ec22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910471, "uuid": "b3736b31-6522-4fdd-82b7-293c11851bc1", "comment": "Malware payload (RemcosRAT)", "value": "4a1dc08451e4f487bae83a62906f874e9f1378f8bf3115c0b1335febf94382fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910471, "uuid": "ded8a80b-5130-4f89-9fcb-90537d90e09d", "comment": "Malware payload (RemcosRAT)", "value": "576997da11bf21820ee9eaacca2b1e4b32aa5636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910471, "uuid": "0d262c7f-aa0e-43e9-833f-e20cbca41390", "comment": "Malware payload (RemcosRAT)", "value": "71d6fc91a3383e6906545da4110aae0ac7a8c7e49eaee107c842bd60624f652ff4eb729b97a9a15e64dc899fa7d8b1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910471, "uuid": "d75071e7-c8ae-44f4-9ee8-15756c9503fd", "value": "T15275AE02A3C5D4A5FF6B20324979F535553CEA164173D82F1B283CA4F4B2292A77FE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910471, "uuid": "6ee1f01f-c8db-4d05-bd82-a2d345437551", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910471, "uuid": "1adc5bde-ff5b-42df-b137-2ea6fb0aea66", "value": "24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8aa9eA0e0d8NQLrFYnzzht2HYVZV:zTvC/MTQYxsWR7aae5e9NQLr2nz+HYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910471, "uuid": "73efa3b3-b543-47bc-98cd-908171bc0e64", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910471, "uuid": "4746b0b5-ad7f-4e55-9918-64524024b390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910471, "uuid": "fcaf9c5a-bedb-4843-961c-6d5454862fac", "value": "PO--New RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e48838-b91b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RevengeRAT)", "timestamp": 1705923787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923787, "uuid": "da126912-3ad2-4d12-9e2d-862c606bb3b8", "comment": "Malware payload (RevengeRAT)", "value": "a0bcffca5a758ec7355bf8029d4c01ee", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923787, "uuid": "3429b6ca-6eba-4aeb-bfac-91c1cb60860d", "comment": "Malware payload (RevengeRAT)", "value": "4bf21363ac7b93c59eb95d9a3211b0e35dbccab003bdde1a90a69e844289a395", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923787, "uuid": "50705a81-33fd-4408-8bab-dfe98b6f4660", "comment": "Malware payload (RevengeRAT)", "value": "a29c38218e14a456a812dec912c0be62826fd7f3", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923787, "uuid": "58fd1a4c-6a0b-4c54-ab06-d4edcd984f1f", "comment": "Malware payload (RevengeRAT)", "value": "112957aa9b1ba070ba4b1d86fef8b4c68ac231270d9c0287d8f63ea051da8257ed69e10d04c715e4655185b0dba88a0e", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923787, "uuid": "748caad4-b725-4823-aa71-28ef5230906e", "value": "T12A622B09B3EC433AC1BD07BC0DB242256371E5A39A62D71F1CD890FE4992BD55B60BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923787, "uuid": "321cd537-57ab-404e-abae-68188f0540ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923787, "uuid": "cda5e62e-b33f-4a64-8dd2-955dbdb4eb9c", "value": "192:y+8C+EKS0O9ejYTDG8bcp4Ll3SnieXubWyD9JEBkGxVXCqoNqCRJo:yNVjYTDG8gp+ZeXTyD3EnxxoNql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923787, "uuid": "706f59a5-f5b8-4869-a03b-945b86e6d09a", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923787, "uuid": "e0273037-c729-4d09-81a6-a93fd61028da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923787, "uuid": "6a66a343-9af3-4dd3-8689-d50c9b37acb5", "value": "1705923785cff2635fa98b41644f63490b17d604aeec7301ced829f75981244eca3efb3834387.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2389e2-b900-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705912412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912412, "uuid": "22f44e2e-8274-44fc-92b6-28216181151b", "comment": "Malware payload (QuasarRAT)", "value": "5d93b7f3a4c9ce4c09856f416d564b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912412, "uuid": "a311ced0-6e4b-403f-940d-24b47cb3ba95", "comment": "Malware payload (QuasarRAT)", "value": "4e6e48275b1f3412edc045e1a81d509ddcfe360c06bdd4483fcd5b4fc77b7ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912412, "uuid": "3fe29691-4c21-4519-8b35-1a270ddeb991", "comment": "Malware payload (QuasarRAT)", "value": "7daf1e1b38741f4bdc9f9b4cef8b249fb8bd8422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912412, "uuid": "e6055eef-704e-419c-abf3-a5e98a4cc78d", "comment": "Malware payload (QuasarRAT)", "value": "e35998999788139a068572beeab4cc926466771ed72bd990b34a0745dc9bcdde00de878a19e417b4096eec5f3f6f92cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912412, "uuid": "ef33a4ea-b7d6-40bc-8d9b-26ff2c91bb21", "value": "T1AFE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912412, "uuid": "eb2b092a-6f4f-4ed2-b579-0b14188d14f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912412, "uuid": "270eafe3-4d5c-4d32-93e8-24bb593cc647", "value": "49152:SvyI22SsaNYfdPBldt698dBcjHkIRJ6kbR3LoGdfCTHHB72eh2NT:Svf22SsaNYfdPBldt6+dBcjHkIRJ6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912412, "uuid": "080c6c49-0af4-430d-8f10-1deea76c3347", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912412, "uuid": "f8d6aa9c-ff47-459b-8d0f-971bd3c02c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912412, "uuid": "a9e11e36-3296-4399-9f5c-98ce22d8f940", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3668708-b8e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705901658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901658, "uuid": "cbbbfb88-6ce2-48ff-86fb-d3c22e367127", "comment": "Malware payload (Socks5Systemz)", "value": "5166f9b205ed054940df5a814ee1bde2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901658, "uuid": "5f4d4257-ba0d-4bd8-ad6b-0ec6a7f3a5d0", "comment": "Malware payload (Socks5Systemz)", "value": "4edd2dee20edbd7373b88bdd8e9195e2fb973573fd98f8786a29bee0fdcab419", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901658, "uuid": "35a2d310-396d-4b56-b617-59fed177f314", "comment": "Malware payload (Socks5Systemz)", "value": "becbdae43f6c7e09b3498f77c6d9eb0d93e59849", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901658, "uuid": "cfef2ef1-b905-4d0b-935e-5fe70a476ff3", "comment": "Malware payload (Socks5Systemz)", "value": "f6adad071e3f4f50e1ce7b80397ac15e7a763d142c67f4881ae262bdf2ddf7ca4f143a7af92b4b658eb338ffdccb8815", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901658, "uuid": "b12802bf-13a0-4b62-97e9-523c10345dae", "value": "T1301633213F816B23C603A7B19CB3B324DB31FE4C0692A1172C5AA5DA6C617D69DF53C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901658, "uuid": "2712158a-50d5-4a37-a981-cab0798e9c3a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901658, "uuid": "c6af5964-41d2-4088-8e9d-f0814547e14c", "value": "98304:61ntAqLPw3/pP0x6cNp92fFe9uTlznzyDhnd358:EtAqjW5cNpd+0hnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705901658, "uuid": "9e7c6b06-dc3f-40be-a1ab-d17e62e4cc6c", "value": 4400316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705901658, "uuid": "aa8d413a-3255-4435-96bb-25f490658801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901658, "uuid": "2a179bf3-f8bc-45cc-86a4-69f6e55b56bd", "value": "5166f9b205ed054940df5a814ee1bde2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd8a5c6-b8cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705889814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889814, "uuid": "149ebef9-2ff3-4821-ae4a-f9c8b5d736e0", "comment": "Malware payload", "value": "28e81be0993b7bd1faf2722037de1162", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889814, "uuid": "69da20b1-5009-4c08-b56a-9336b990d414", "comment": "Malware payload", "value": "501894866e35ec0d1af7c13f09121a34ed22fbb86f98144e7853ba9ebbd49eb0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889814, "uuid": "de1d3ab4-9449-4b26-8787-9729b5ba20f1", "comment": "Malware payload", "value": "43ec91455e8496c63c9196fbb88516d673a131cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889814, "uuid": "d264ad76-f07e-4c74-aded-1db6541e70f3", "comment": "Malware payload", "value": "dc4fe15142cdbe8fad842205322e811b84dc0d2999e12c604a6d52b3ecd911b14651b3bceffd9baf3003cdce858e3678", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705889814, "uuid": "18ebf8ad-b161-413c-a770-e023b9350726", "value": "T13403A303BF4DD06BC8954970B56EBB60BB70BCE65E54E38E3AD545B90F8A3940A237C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705889814, "uuid": "1bd4778b-5f88-4335-8712-a15a7284ba69", "value": "768:eDAR9oNCU3UPenTL9zX4dSTw6Y/oZ5HNw0:0rUElTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705889814, "uuid": "5c64fbed-f2b5-4896-ab6d-421a1ee39fda", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705889814, "uuid": "093004b2-88c8-4e32-80d3-a5e7dc7c9937", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705889814, "uuid": "96aa55b8-aff1-4812-85f0-ad3089943fce", "value": "501894866e35ec0d1af7c13f09121a34ed22fbb86f98144e7853ba9ebbd49eb0.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade41b23-b8fa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705909729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909729, "uuid": "a4b04bb5-01de-4d6c-9276-3205072a8369", "comment": "Malware payload (AgentTesla)", "value": "95904233bd7fad313585af6d5a1f9e81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909729, "uuid": "d16ecc58-52ae-4ef9-8862-aacb47b13c4e", "comment": "Malware payload (AgentTesla)", "value": "5072d915c53f5acd44d4c91980c3efa7754c8251f405f302967c897fe89328f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909729, "uuid": "abd5fd3d-334e-4d4c-851e-9f3b63e09c2d", "comment": "Malware payload (AgentTesla)", "value": "42f91c64588310c3dabad887114d419742156da1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909729, "uuid": "2891f2ad-45b9-4ee7-8b0d-46b444969718", "comment": "Malware payload (AgentTesla)", "value": "c576bb4e8fd1070de8cc3fba91bcf4b726674c8b92f862e18624fa563374b588764e97229b7264aa7b1323665443df4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909729, "uuid": "f05700c3-790f-496f-9587-512eef990a88", "value": "T1D2D4338FF70D6343A3D2C5489772C45A5087FCC62836065EC47179062FEABAE4BB196B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909729, "uuid": "68898e2d-7c4d-4e67-a757-c0394ee15be8", "value": "12288:JUNKGA2i29s19Obt3f6aAjcZJ6Ntg6+s1W1mdQCIcrakA:6A2i29Es53fmjc6NK6+stQCT/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705909729, "uuid": "71bf721b-6429-4298-978a-ad0821a47655", "value": 613998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705909729, "uuid": "889df841-086b-42b6-a9ce-2eea4be0f573", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909729, "uuid": "937369bd-58e7-49ac-b4d2-30c81f2e59f5", "value": "SHIPPING DOCUMENTS.PDF.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd4e26f-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923365, "uuid": "694d245a-8505-4ef9-9132-6232a396247c", "comment": "Malware payload (AgentTesla)", "value": "893e3899da83b0c31e01b70d1f3c8e72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923365, "uuid": "dc05ef87-1d11-4d3e-a6b9-998fa863e716", "comment": "Malware payload (AgentTesla)", "value": "50d414576bf441cca754e6e3b96dabdf35fed443ecb98f865dc89e623bc2f0e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923365, "uuid": "d5c6ad18-d621-4578-8a6d-c79c04f68549", "comment": "Malware payload (AgentTesla)", "value": "5a59f2ef0e4b7adbc0780748063d5cee64f8a1a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923365, "uuid": "5f159c4b-f2b8-4bcd-abe3-fb23678d777f", "comment": "Malware payload (AgentTesla)", "value": "16e6293bc40f9fec5afdbd5175705e3f50db210e0fe9cfe1159d4c26199e2e1785dbf2bc61488913088ce10314f2fa99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923365, "uuid": "b43b684f-e014-43e1-9775-622b15ca1a20", "value": "T1AFD42340A6E4A5C568FF5D86F35E97264047F3229E21D23F10690D9C03B36EE7E18DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923365, "uuid": "724cb22c-d056-420e-ad45-ebf1a2b6985f", "value": "12288:uKAttFRSip1hgzveC3EZeJHvQuc+9gpHGM/cV9MzFeYpFJP4n:glUzp3UIPAICxHvan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923365, "uuid": "17d7b5bd-bc03-41ff-b630-05302c23d839", "value": 599681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923365, "uuid": "5d72c71e-f7ca-41d7-a901-a22e3cefb7e8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923365, "uuid": "f6d32c2d-fc8b-49c2-866b-ee93ec1cc900", "value": "nComprobante_00643233352_Monex.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6aa3f23-b93d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705938493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938493, "uuid": "2e0d549f-24a0-47ce-b478-faed74348947", "comment": "Malware payload (Socks5Systemz)", "value": "81a7005c156238470c7b5dee478c5ad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938493, "uuid": "14f68851-dbcc-4d4f-a28d-da285dc095e5", "comment": "Malware payload (Socks5Systemz)", "value": "516b52b27add09e4dec3575274893768a568a6ae6384e886faf705fc7ee3e8d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938493, "uuid": "dda04585-bad1-4dac-a737-0cd34ebf33a4", "comment": "Malware payload (Socks5Systemz)", "value": "ce99f9c7294e3a1454b628ce25df400e4b596957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938493, "uuid": "4e7802bd-dd4e-41ab-8a71-10bbe8b8beea", "comment": "Malware payload (Socks5Systemz)", "value": "c1287588cbae1fe99bf1f2fe05a09a67f58700fc70745fb2867ac8216d72357cf6befaeb61495db6dcee0897d46e3176", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938493, "uuid": "35bfa069-2b5a-48cc-bd01-1d63c443dc85", "value": "T109163301BF4056A7D3459A38FCA2B224EF3AFD4C2A161617355FA2DA1CB63D05C763E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938493, "uuid": "a56191f0-ad55-41e0-abaf-d2390710c216", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938493, "uuid": "6bacc190-f375-4b48-bba2-bddc0d60dc12", "value": "98304:jftdU+BOTBDPbBBKcYNp/oj0kFQCJYEHOY3DLfd358:ZbBO5PWfNij0kFQIT7zLfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705938493, "uuid": "a2a11064-fa68-4f1e-91e8-a57d7523bca8", "value": 4202812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705938493, "uuid": "14173e13-6b22-4285-805b-ef9309a79c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938493, "uuid": "1c219c9c-b243-4b9f-90b9-80fec6d88603", "value": "81a7005c156238470c7b5dee478c5ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6676cd47-b91b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923782, "uuid": "963c6d37-4edd-448d-8629-da71caa9acab", "comment": "Malware payload (AgentTesla)", "value": "ac9432464dad09f5d0b14a6d95c9bc51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923782, "uuid": "1e759bbc-dc6b-4625-b671-283c460fea32", "comment": "Malware payload (AgentTesla)", "value": "51e4530ac795ec4e23719fdbebda54fc10364cafc814244b13fa4129eaf7b4fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923782, "uuid": "fa7c6874-6cca-4c1f-9faf-f67069d66677", "comment": "Malware payload (AgentTesla)", "value": "f5fc465bcbaeb7c2f1e9fac8a61164c052df63e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923782, "uuid": "f97cf991-b125-4a7c-a368-bbc6395b1035", "comment": "Malware payload (AgentTesla)", "value": "fe3c3794c1b2f5631618cd12da2f3ea515296a1fcc395b5e74c1264c03e2f4e230f3dbfc008dcde36158ec0242f1a9e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923782, "uuid": "d4e401b5-55c0-4a0f-8df5-3a2b6717690d", "value": "T132E4235F47D82E8CA4EBC5A0484B2D56D4124B568B645CA4E29BCC970F273FB3D86ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923782, "uuid": "5b608ff9-0b83-4cf3-9491-f9737a0a89a8", "value": "12288:du6ZT+gLInvR8L2gaB31Ebuod4E+u/Ru2ZRxzy+pLF9GpSLxTkJW:dz+ws++lEuWw2PhMgeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923782, "uuid": "74e93c01-038e-4c0a-8532-4d9792a9ad60", "value": 675160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923782, "uuid": "aaf35735-3d3c-40ee-a4dd-8f435adf12c2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923782, "uuid": "ce3bdf2a-c9ef-40da-ba61-877b9b1b3de9", "value": "nIMG-Scan-New PO #PSB-17398902, PSB-18384789.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef67e91e-b944-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705941622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941622, "uuid": "cf08d01a-55e3-4b08-b372-91348a5c1e99", "comment": "Malware payload (AZORult)", "value": "5ad5fcac5705acde3ed51ae6b3c2c0b1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941622, "uuid": "b67fd175-3c11-47fd-9aad-d36c9cf5c401", "comment": "Malware payload (AZORult)", "value": "52dd1ddf925baa01a172d0e420ec8833a10726ee7a7dcfc2a55f1e04f47c6a63", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941622, "uuid": "0509b3b4-62b7-4110-9a29-3ffb4e32acf9", "comment": "Malware payload (AZORult)", "value": "77a26b80323ac8e1f172d8ce980120454ed53939", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941622, "uuid": "7126a9d3-9875-46b3-b594-120b3464e749", "comment": "Malware payload (AZORult)", "value": "154a7a84f38d7c9dc2bee43736392e35d12ca8f81b0a0ba138bfe19094f8e65df621087bace231879f03e98067329eca", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941622, "uuid": "c02abc94-64bd-499c-8ed8-650ddfb38529", "value": "T11794E0003750E55AD5ED1A744CBFD2FE1E74AE432E61820BE380FF4E3972AC1B949669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941622, "uuid": "8f238986-f79e-49f8-ae95-bcaef6db9929", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941622, "uuid": "11146485-2e78-4c81-8e6c-797b8bd0d959", "value": "12288:3kvqcSBHwEbBn+mDZVKxRu2GfWLpcCoJt:9wOTZVKbgWLCCat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705941622, "uuid": "508582cf-c500-4c62-8a40-1bd86d36571c", "value": 411480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705941622, "uuid": "428fdc41-8bda-4ad4-8da4-42a01f408d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941622, "uuid": "e440249b-195e-4a8b-97b3-616aa20078ea", "value": "DOC6010038709-PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c160f8-b8df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705897926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897926, "uuid": "b69a32d6-6dfb-4c9f-b7c2-238dedf98aac", "comment": "Malware payload", "value": "719cf0eb1b86d3b97b5aac7344602bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897926, "uuid": "76ca148b-47b7-41d4-8baf-a38d11c32f79", "comment": "Malware payload", "value": "538feb0fd8b8dd46afd6e3eca6b274e4fd4b1fdc7614caf6f167e304bd454481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897926, "uuid": "6f2cab4d-25e9-4894-8028-15134f2ad5c5", "comment": "Malware payload", "value": "48d32d18449440712a4f44742b7e28494f0fac15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897926, "uuid": "ec027e8b-2ed8-4b38-99ee-d3e5e6a4003f", "comment": "Malware payload", "value": "89665887407a79fe6b465000952144fea452777fc7d226291ecf63c6acfb8b34e2a421c80de993a0ad21dafcfaffa0c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897926, "uuid": "e8a2d598-744f-444e-aa3e-c75e6311a0b5", "value": "T1BBB53326DB829964C1D071F78117D3DD0739EB923A3B8F8E4E183E08F519993BD788A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897926, "uuid": "f821981c-e809-4ef9-b347-c39db6ead714", "value": "5aa94c7fbfc01c9462c4d62e06efe88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897926, "uuid": "056d98b2-859d-4667-876a-ec70caa5768c", "value": "49152:xktZ7o/JQexmvpIYYnOAaXeJG0mFvykqT2XtvVJKbmtmr:x+Z8iEmRIYYnOAaX+VKD1PSrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897926, "uuid": "ab9351a1-906a-408f-962b-0ac4a1726470", "value": 2310592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897926, "uuid": "f0718f05-dd3e-4be0-b3da-ec40fb89d6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897926, "uuid": "eeefb051-5e03-4339-a3b5-3bc1068c3e5e", "value": "SecuriteInfo.com.Riskware.2144FlashPlayer.4830.16315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bbc91c-b8f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705908970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908970, "uuid": "4842e616-5419-41a2-a8a6-32ec833f9e7b", "comment": "Malware payload (AgentTesla)", "value": "750d8597f6f489ab975aac5eb24d3001", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908970, "uuid": "f6e4160b-5e56-44f6-bc33-f86dafc95859", "comment": "Malware payload (AgentTesla)", "value": "53bd552dc69158354ad5adf227f5db313859f5357b418847cd43364edf3b9214", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908970, "uuid": "4e9f8366-4178-4cbd-a493-f7f3b5a2dc4c", "comment": "Malware payload (AgentTesla)", "value": "33c955a6b394708c19593c9a2c55e21ac08c7d47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908970, "uuid": "10668ea6-fbb8-4c08-91f2-ea4a05b79330", "comment": "Malware payload (AgentTesla)", "value": "c3ee8aed4b3aef1c1cb4cfb226011185d909ec1b330d3addc138c6c09f50d27c36523980a0e38c26c53c86c83b47ba02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908970, "uuid": "89b50eae-4320-4643-a639-d37c1c5d1052", "value": "T1A8D4237837179CF28DA79EBC8FD1A484A06D39170E531A204E2B691C9A978FCDD4DC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908970, "uuid": "efda6241-b9eb-49f2-80e7-1725f5887a0b", "value": "12288:ZXMXmYZ1UHt4BIeGy2sxMuPh7SfwRhF2kQJ1Mn81Mlnk+wjQHYuA:5MNKHOIihigU3SiMVk+yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705908970, "uuid": "b5e62fd1-a33e-47d2-97a5-0fbaee5edd2f", "value": 606712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705908970, "uuid": "f4e8f45f-2bde-4aff-bde2-4fac0cf33909", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908970, "uuid": "1bfe95ef-b529-433d-a080-d41d8fdcb1b9", "value": "Spare Part and Service quotation for S9 and T300e.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f5c4e7-b913-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705920351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920351, "uuid": "7e127419-262c-4d32-9485-5c91704b467d", "comment": "Malware payload (AgentTesla)", "value": "24a60b857ff0e9575fe194a956047820", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920351, "uuid": "9e831d80-489f-40c2-87ba-251b94997c77", "comment": "Malware payload (AgentTesla)", "value": "54bd2e31afb0fb4c86e21837884aecdd7b045986e2e6e942c0a835f62c73f6c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920351, "uuid": "84a134a8-d30a-4263-86cf-95513a6ffba4", "comment": "Malware payload (AgentTesla)", "value": "e44b0bd147a392a6bbf23e9ca5acef0981dae5f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920351, "uuid": "4c1c4d96-9ce6-45a1-9445-bd86c22d1f9e", "comment": "Malware payload (AgentTesla)", "value": "72a7e5a799d407ec0bc165f1e0c39c16a92332f5158ab8a783deabe3bd873dfb2823eea1cc52dfb6bc1ef616b7489186", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920351, "uuid": "1a0c7392-29e4-460e-aa3b-a99cd5c5e279", "value": "T1C855AF02339191A3FE9BD5328F9DE52115F93E6D00A7D21E12B91E35B6F02A0216DFD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920351, "uuid": "dad4ab64-2ace-403a-bd0e-8c0c826725a5", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920351, "uuid": "59b39332-503d-48d1-a50e-a8030bbdc149", "value": "24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8aeVu49WyUdcU47XjoJ:ITvC/MTQYxsWR7aKu4gvcUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705920351, "uuid": "ed904294-e864-4c70-80d8-f1ae7bb52fde", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705920351, "uuid": "c390ce49-8d79-411f-bab1-a0962d93248b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920351, "uuid": "c9254ecd-1e24-47ec-adfa-937d48f9f32b", "value": "DOC9000377E8-17893903090039.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbadf29-b90e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stop)", "timestamp": 1705918157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918157, "uuid": "15a0808a-75b0-4567-a1da-711390c180d3", "comment": "Malware payload (Stop)", "value": "6f0e5ad311936054a33eb7287c594521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918157, "uuid": "4e186cf4-0141-4f28-a824-ef9e7c6e7b0e", "comment": "Malware payload (Stop)", "value": "54ee98582d3733d200040666a41685a51467de8ed0f6e06bd076fb94ee7ec1a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918157, "uuid": "19a82772-e233-47ce-a92c-63cd4fd12f8c", "comment": "Malware payload (Stop)", "value": "c973d47705660081bcbce5a99832c5f035168776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918157, "uuid": "567e1930-5fd7-4a7f-b3e1-1c41efefd31f", "comment": "Malware payload (Stop)", "value": "a6d619aeebf590a2faa4846829ab2e76e5f7d34adfaa0ce2425e7d1817a7b665e9c1115b5fa455e017858d704870e5e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918157, "uuid": "05ec233b-4022-4e52-9860-50ac552a2d87", "value": "T13EF4F19392E23D95F6364B328E2FC6E8761EF2608F593759521C9A1F00B01F6C6E3719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918157, "uuid": "57e8d4fd-35b7-4aa4-8c25-9b0ac99c4fe7", "value": "c52f363ae887f7e2b622bb07b5377eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918157, "uuid": "8a3a8353-0e66-4462-903c-6c4ce1441f53", "value": "12288:heZ8Ft+DSpr3jXVtrw2iiIhzKW8jZv+U6da6dLMpzecpMa007b3MwERN6WG0uy+E:he8thTXg1TvOZv+U6dJpD6WSfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705918157, "uuid": "9fd63369-b875-44a5-aa77-4e069bd60401", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705918157, "uuid": "08544ad2-3199-4af7-8757-a2e96b97c2da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918157, "uuid": "c8b5f8c7-f13c-4617-bcee-1d157868cac7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdd7133-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705917404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917404, "uuid": "4281e243-b65e-48e8-af79-fda60a4f1678", "comment": "Malware payload (Smoke Loader)", "value": "2258b8632788b8648769925348a84019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917404, "uuid": "dfc7762c-1aae-4060-9d03-28f16757568d", "comment": "Malware payload (Smoke Loader)", "value": "557facc6d550d157ec4a360af548ccc55d617bf2c5c24ee622272d4843b2f693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917404, "uuid": "800ef3bc-46c3-42db-b8a8-66b7b84bfa09", "comment": "Malware payload (Smoke Loader)", "value": "f375c2854e96e55e9e30ed702d7dae6aeb7c8ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917404, "uuid": "1257a6d9-579c-4c0e-a089-22a50bbe7239", "comment": "Malware payload (Smoke Loader)", "value": "eeb4f00afc53592be1c376efa5c0b0df7c2c1714f92769690e63f7047e86bee42ae93943706de06bd2720bd0c5db679a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917404, "uuid": "a645a6d3-72a6-49a8-8be4-ec5823bc69e7", "value": "T127345B93D2E27D90FA364B329E6EC6EC361EF1518F597769A21CAA1F04701F2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917404, "uuid": "88cf734f-fa14-4988-affe-698a36dd3059", "value": "c52f363ae887f7e2b622bb07b5377eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917404, "uuid": "cc57ff49-d82a-4504-8938-8e16a8c12748", "value": "3072:I2hh7/LwvwGXK1TDthMkASbxBz94Ptz5mkPMv308r5gsx:I2hd/LwY6KdthMnS9BR4P7rP432", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917404, "uuid": "fe4e3cac-1300-4da9-bc75-e46d15e7a36f", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917404, "uuid": "d32cf851-2ada-4806-a14c-93f6dd323cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917404, "uuid": "6be70dbe-b15f-4914-8372-d4abe5b59546", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eb8734-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StrelaStealer)", "timestamp": 1705917358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917358, "uuid": "c2bfca7a-cf9e-4f74-a9d5-646d2b4d4e4b", "comment": "Malware payload (StrelaStealer)", "value": "c7007617a4e91a9f1b490fbb8f0e15ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917358, "uuid": "b16428d3-be1b-49e9-aced-d047392551bb", "comment": "Malware payload (StrelaStealer)", "value": "5617211ce8d0e528f2925c78a778ade44a8296f10a318c03ec094d655cf2ad3c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917358, "uuid": "bdda2eaf-2e9b-42a7-b712-e1d92fa5a4be", "comment": "Malware payload (StrelaStealer)", "value": "2ada1b92b7d98090c80c6b0f44c477feb9629e35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917358, "uuid": "258a5848-96a1-4f1f-935d-a1bd36c578a2", "comment": "Malware payload (StrelaStealer)", "value": "b6b4fc1176ef3b504c080ddc8f8b18f687941eed0b1d88e3cebcf2a729bacab7e698f3f3bc5d5821e33d1402b0d9942d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917358, "uuid": "7aea1f96-6501-44f2-acc4-0da8de9659c2", "value": "T10E46F9E476E077D30FB5690DB3CE40B23D64B857F0EDAD8612890E1E928435999FBDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917358, "uuid": "2c8c188e-3cf1-4fd8-a264-5f01703444b6", "value": "24576:pKS6oCq9Ro7ymA2JJn22s6aE7qwdEKyn3ygDO0PodOk++pL4T03M77t/1xxXJn5i:5ncYe/Q5idwhpUbUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917358, "uuid": "59885905-f5e0-4ae9-bb17-6fe3fff72867", "value": 5543989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917358, "uuid": "8148e3a6-c640-4a54-995f-b6b4f3dbcd2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917358, "uuid": "ca1d1eee-e0da-4e86-aad5-08bfa62671fb", "value": "INVOICE_23690_262531821.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a387e3d5-b909-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705916154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916154, "uuid": "cc6ef1ab-a465-4850-8094-b2a04e0929bd", "comment": "Malware payload (Mirai)", "value": "114aa9dc167bcafc47676d5fcdb01d00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916154, "uuid": "9ea3e0fb-ce68-4cdd-85ad-79b8e2b7cb97", "comment": "Malware payload (Mirai)", "value": "573d49e4a9a160d62ee89d9cc5a100c77ab5ec5c0f52764fdc0fa230e522a22d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916154, "uuid": "ad29ba15-f077-4071-bef6-436800b49daf", "comment": "Malware payload (Mirai)", "value": "cb45b6fe23c82d021366ec7e48e61dec64379ab6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916154, "uuid": "2688f3d8-2184-48cb-9ead-6b26b2d139e2", "comment": "Malware payload (Mirai)", "value": "efacc53cb4e467ff852573486d1179ff483120d4be6b0637b37b7b890d8b944699430165764050ecba9ec597ef9e9bdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916154, "uuid": "2e4bb77a-fc75-44b2-8739-3dbfb8deb152", "value": "T18E33E8527DC26A2AC2E0137AF9AE81CE332167E8D1DF7257CC211B0476DA55F0DA3B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916154, "uuid": "57caa884-6eb0-4d45-9596-aa9f26ca9b2e", "value": "1536:hCqZI1iDUguHppKKOxgPg6osAvH3Y09WZoh+fgh8i:XZeAPD9WmhA3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916154, "uuid": "a076d6c0-eb8c-4f62-afa9-e0113c118063", "value": 52144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916154, "uuid": "2bed9761-3386-41a3-a157-6c1abcfb3140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916154, "uuid": "285cfa02-bef2-4c5d-ae67-4cbf551a4c31", "value": "114aa9dc167bcafc47676d5fcdb01d00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800fdb52-b929-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705929838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929838, "uuid": "2e41157f-6c1d-44be-bb46-95732013822c", "comment": "Malware payload", "value": "ad82165fe2e529e8d737e71e15428d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929838, "uuid": "bece4acb-8243-410b-a8fd-f6900ea79c95", "comment": "Malware payload", "value": "57f36b4f4e23bd4aebd0f483ee4cbdf0a887fa7df84f6d8de6e84b47b0d08628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929838, "uuid": "b2f863ba-a58a-4bb2-b49f-63048d9cd0b5", "comment": "Malware payload", "value": "8adbfd5c97bce230c6c57d05e9ce8b10651f6905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929838, "uuid": "cead30e3-6df1-4bda-b4c9-b02675926230", "comment": "Malware payload", "value": "a1dd4798bca9acfb005fcc4aa452100b28094c2cf620f979ceea43c47adb67c334468cf3b3dfeb674abebbdaac26386a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929838, "uuid": "3907853d-1b9a-47c0-9975-2230273c712e", "value": "T18FE69683576D4657FEC8403ECC9E8F75791678E4B524DEF123A06F7DB422207A42AA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929838, "uuid": "6c5f7623-6cd7-4a22-8621-475221b27140", "value": "cc5428ef6e6c61797b7c1fc530aae5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929838, "uuid": "f3c43c17-9d4d-41a7-8299-b868d1659f55", "value": "12288:yGxJIdRcLooOanW2x092H+jQZG/pb0b3dvA5:hdfOanNY2H+3+3dvA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705929838, "uuid": "b2cde0a6-59d0-4535-894a-2fec7bedf179", "value": 14228480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705929838, "uuid": "ff69bbd4-06bd-4e3c-af1e-7d915e090f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929838, "uuid": "07b1e7a2-28c5-4cef-a0ef-f929a2fb23ce", "value": "SecuriteInfo.com.Trojan.DownLoader46.45829.1621.8868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2b5e9a-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705917514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917514, "uuid": "725232f8-af0d-41a0-8d70-7ed2b0ba6ad1", "comment": "Malware payload (AgentTesla)", "value": "dde6e773ee25de015aa829a3a24e55ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917514, "uuid": "bf634e0b-f279-4d47-a432-94cd9de09a8b", "comment": "Malware payload (AgentTesla)", "value": "58924b2968d04cc20ff58b4d0c4c220f7109eefb13db6b348aa2754293fbfe85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917514, "uuid": "7017c286-e39f-475d-a276-dd6a3db2bcbe", "comment": "Malware payload (AgentTesla)", "value": "b55763486cc5c3c43dee87598d96954e7ab17446", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917514, "uuid": "849f6a9f-d996-4f4e-a988-b1c788b49c24", "comment": "Malware payload (AgentTesla)", "value": "917991df0d5c8671b177610b8a5ec55a2134fdb12aaae3a3d5e582ceec5667ddf3d3275e9a35a615000217dfb3b0d38b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917514, "uuid": "51dce39a-a65e-48e2-8875-2bde1ec67817", "value": "T10DD412DB33BD8F7BD0B987FC4822254187BA7A1A8D69E64C4CD720CB4872F954660D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917514, "uuid": "1de6f797-af9d-4c74-b290-50f592bdaf5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917514, "uuid": "819a72dd-5af6-45d0-acff-3c2578637353", "value": "12288:Fkf+QkjQwfWk7H9EMajfjAV5fYL91uCFPEzo90dUC:K5kUiWk7H9EM88VVYLTuC92i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917514, "uuid": "334426f2-5196-4f94-8116-6de88b0b5538", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917514, "uuid": "8bb1a384-b201-40cb-9471-fd154791242f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917514, "uuid": "de1c6fc7-4d70-48cc-ac28-4e8ec70f2ff5", "value": "P.O 2320505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181d08f4-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705911625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911625, "uuid": "30ced68a-e61b-4486-985f-2b26ae7ca157", "comment": "Malware payload (RemcosRAT)", "value": "8e2f08deaac5bddbb57f3c5d40ea8bd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911625, "uuid": "eecdda6e-0ce5-4af2-a749-e11f9c92e5c2", "comment": "Malware payload (RemcosRAT)", "value": "59559873eaa5a5b25f029c6768a22d3e84b03b7467cc764ea5f081edc0bfeb58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911625, "uuid": "7a480d0e-1ce8-4a67-b005-083c68b8498b", "comment": "Malware payload (RemcosRAT)", "value": "be7842f6e42e7ec89285ef2c65f84952ffebdbd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911625, "uuid": "417a9530-beee-4cc8-bac9-216fa80fd2f0", "comment": "Malware payload (RemcosRAT)", "value": "d63eaf083cbdbde7b9dcd750a5be1ab0e830d8c63ebd0cb24218d1df6a0c151520965488b2c1815f3b13cbf25cb97ffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911625, "uuid": "f01903fa-9bce-414c-9fc0-79e6fe13f0e4", "value": "T1FB051288AA54D053EB6C4A33084ADEB65E376C637594263F63B03F3F65323915F9A01A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911625, "uuid": "0228f87b-35ff-4970-b68d-07d61f948d79", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911625, "uuid": "bbce7736-512c-4d75-b1f6-8a68c9c57016", "value": "24576:3fLMW38ZStHH1tbAKovtn2X4nTFu8EG4W4:voJZ8HH1tPovtnc4TFcG4W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911625, "uuid": "c9b6abf9-3b61-4685-b6d3-2d3bb40f24f9", "value": 801344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911625, "uuid": "e1a04d17-052a-4dec-a031-6981f8a2e5e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911625, "uuid": "591b7380-3fde-4255-b128-bc2271d7b4a1", "value": "Invoice for Return of Excess Amount (Temmuz) .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22526cb2-b924-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705927534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927534, "uuid": "6a7c6711-a1cf-4458-9f54-e0bb8e55d01f", "comment": "Malware payload (RedLineStealer)", "value": "4dc62aa51086843a31d87236c87f21e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927534, "uuid": "d5e2b7ff-9d7c-4796-861e-492902433a76", "comment": "Malware payload (RedLineStealer)", "value": "5a1a04657de632f044fcf0f4b089686de18840fa979a8265d8f9978f4feb5d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927534, "uuid": "5c6b784f-ff55-4995-b277-ea140350820f", "comment": "Malware payload (RedLineStealer)", "value": "c7cdc373668dd8f7373a433ed0f3703843b67c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927534, "uuid": "6fe2ad46-e219-48c9-8934-b9586170bea4", "comment": "Malware payload (RedLineStealer)", "value": "009fad2a06a7cde15a94b2a66fb5af05517a7d41061799c139098188fe81c52fe28ee81e1162328f881cb7c799351016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927534, "uuid": "5fc1d3cf-d91e-42a8-a1a1-a383706af7ac", "value": "T193841212B6DB1372C04D81B690F3A4288BF5B3436E77CB457E4A82969E417D9CE86F4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927534, "uuid": "de61c540-39d5-41f3-ba74-1d44cbda73b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927534, "uuid": "da53d521-8648-4036-83a3-2cd5db885d95", "value": "6144:4TDPRqvaD9nM07ZX1SpbCVHfBwoxHdHylxT8MSe1YpWEwuSoh:W9nP1XIm/BvxcxlSOw8uSoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927534, "uuid": "fc0b18b0-96ae-4cf5-aed3-f6af914255e3", "value": 393184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927534, "uuid": "e175b5b0-6cb7-4d10-92a7-2f16e4baee09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927534, "uuid": "ceb02104-def6-455e-9347-d7c025cfe7f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e0eb79-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705915834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915834, "uuid": "d0b68186-2cf5-4fcf-9ba2-a6a37cdf197e", "comment": "Malware payload (Socks5Systemz)", "value": "ff97ddcc352ffb6609816679e4ba5468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915834, "uuid": "bbdbaa49-9e6d-4a75-86a0-a1fb5ea0d86f", "comment": "Malware payload (Socks5Systemz)", "value": "5ac704060ed9716d8b6774e82e6f8cad20e41ad9c4dc8bd57cab9550aca4f4bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915834, "uuid": "3c20f5a7-842d-470e-b606-62fdcff47655", "comment": "Malware payload (Socks5Systemz)", "value": "e3309e5ec41e8cca61a3ce7a8ad1c7115aaaea5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915834, "uuid": "79bcb2ae-d1bc-4b2d-bc44-4d59999433b8", "comment": "Malware payload (Socks5Systemz)", "value": "bb364fec564901df0260a875d5f55dae442e83d652f1c500c54320b9a65ef6c2f59dfdf4bb59d94c6acffd9e43ce6877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915834, "uuid": "490de4f7-3b6d-45bd-a18b-d7488d2b3145", "value": "T15D1633217F105566E38057745CE3B38AAFB2FD0D2651691A3EAFD2CA0D683D21CBA3D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915834, "uuid": "854b4f9b-d35d-4573-828f-6585b4be75ff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915834, "uuid": "fd4f5740-9fa0-4f3e-8b75-918c66831a7c", "value": "98304:6lO2xpcfh4qDhQErZ3AlRYrdsrBi76QO7oMzBAq0Pd358:yDRqmEVdgmqEt7Pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915834, "uuid": "541f499d-ea7a-4e8e-a026-8b8f6541492e", "value": 4381207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915834, "uuid": "d725cc21-95e6-42ab-8a8b-ee3d4cd97638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915834, "uuid": "4f3da00c-75e6-4e77-97a1-757f38024f38", "value": "ff97ddcc352ffb6609816679e4ba5468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fb4090-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705910357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910357, "uuid": "c73bb22e-6485-43db-9f7c-b9c489fbd8be", "comment": "Malware payload (AgentTesla)", "value": "e3935df8197effaed959e76d56156e18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910357, "uuid": "8f9e391c-e070-40e4-91ff-5a0c4d5e0b0e", "comment": "Malware payload (AgentTesla)", "value": "5b17813545c85a10c81e81610c7ebf01d2316f80c8b02b89bb747c31a8c919e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910357, "uuid": "04416629-6c43-4e9b-b64b-5eddb5dcc598", "comment": "Malware payload (AgentTesla)", "value": "d42e1f7925dde11a7154277ab79ca7c23d3a5f93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910357, "uuid": "a0813fdf-12ba-46e5-b098-7969a9d1b0f2", "comment": "Malware payload (AgentTesla)", "value": "3fd019941ab4a4f5fd8541683f8d8c0fe365bab2f0862bc38e37c3987d7ac8d5649a08921924afbc337b37676adbafae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910357, "uuid": "8dcb4be1-a848-4caf-b441-5b266239bd89", "value": "T116D4120073EC9BA3E6F29BFA166190505BFA752B717ADA4C0CD275CE5876F408790B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910357, "uuid": "c59871d9-11f0-4ee8-a3f7-7878a19006e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910357, "uuid": "b76b35a7-232b-4333-b270-6b8872904900", "value": "12288:NVSGo+p/37XXvkYXHtltr8jpMZKr1QydUQQt5spkqQd/C76nrS:GGN/DfkaBkr1PlQnspkZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910357, "uuid": "75306692-7921-4f18-af4b-b8a60d446031", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910357, "uuid": "e19537cb-b517-4a06-b689-b11afa52593c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910357, "uuid": "df1dff9f-93d5-4735-be75-89092930d9b6", "value": "Spare Part and Service quotation for S9 and T300e.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7b5f12-b95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705952059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952059, "uuid": "73e4383f-6bee-44c2-9bf2-7931334dc8c4", "comment": "Malware payload", "value": "627d146f44e901aa1bcd48effb3b788f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952059, "uuid": "417f235c-fbd2-4307-97ad-888823f63a7d", "comment": "Malware payload", "value": "5b45188cebe24c4309d3d884cb92bc5d9466e9dd8fa57f670b0008931e18562e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952059, "uuid": "085b3620-cb03-4227-a676-58dacb69ac2c", "comment": "Malware payload", "value": "8964f3c422dc04d0e71c7fe8439df4da708eeb3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952059, "uuid": "1e64fb54-9674-42b3-b3ec-2ab56819674c", "comment": "Malware payload", "value": "5ab9414fb6f30598d85abda283c5e3b6f0d866f7ba0f595c3983deb5c11ccc094c47d7fcbe1a8c31cf4f9ba70c2cd067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952059, "uuid": "ea0d1b3e-1f0f-4ec5-af7e-608b9a63f71f", "value": "T1FD93D74977E52524E0BF56F79871B2404F34B4871602E39D88F219EA1A33AC44F99FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952059, "uuid": "ac85741b-be3e-4315-97b6-782533a73b75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952059, "uuid": "9d3dceb6-8dbf-41df-950c-54c15a956139", "value": "768:lY31Um/o9eUVTsZ4E+rLDPQmJ/ewL54lLdJXn5513Sr2YxgXxrjEtCdnl2pi1RzC:yUeoZp/eM4LvFSrdqjEwzGi1dDcD/gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952059, "uuid": "fa7e176b-a7a6-4465-93c4-ed06d72ba41b", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952059, "uuid": "721bdf5b-b7bb-49fe-bcf8-143b60f757f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952059, "uuid": "69cf4fee-81aa-49ad-865b-6ca5bc8ef228", "value": "5b45188cebe24c4309d3d884cb92bc5d9466e9dd8fa57f670b0008931e18562e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd93764-b924-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705927523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927523, "uuid": "1987d5d5-309f-4f06-a378-d79f7a73117c", "comment": "Malware payload (zgRAT)", "value": "88a1669cf7aeddae3c96cb9512ae9a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927523, "uuid": "25600004-2758-4c0c-9a4a-7c77a1fc41f8", "comment": "Malware payload (zgRAT)", "value": "5bc7282bd88dccc0ac5e1c63456078cd7a59605dfcf3dd362f36b31b6b518332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927523, "uuid": "92e81163-a595-4c4f-9391-ee469d665898", "comment": "Malware payload (zgRAT)", "value": "d8d934b2d7eb85a744012458e742d7616d7fe63a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927523, "uuid": "d077e89c-98f2-4050-8936-42be41bd138c", "comment": "Malware payload (zgRAT)", "value": "adadeee5de608eb625208bbe40b14a43c5a67b7a88d20c8aac68879e9567c89e63e4c606d42b8cde6ce5d6c41d2253d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927523, "uuid": "f2c8111c-1eb5-4756-9dc8-3cd1997cbcf8", "value": "T15F569D03FA94DE41C1596633C5DB601893F5D9E12327D70B7EDA23661A033AF9C8E6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927523, "uuid": "5d61292e-389a-4782-a230-6acbbdbf8466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927523, "uuid": "96a18ec0-a3c6-4f01-9741-4691166e78c0", "value": "98304:2SFTYOwBL8oXJPTYCHL9Psoio2RwyYUseanix1U2WPo+:2SFTYOwBocplD4ROneaniwo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927523, "uuid": "2555bb9f-30ae-4eb6-9749-a8cd51fba1ef", "value": 6399488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927523, "uuid": "63229b36-a4b0-4e3c-aaab-f0f7a60d8824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927523, "uuid": "af4076dd-a799-4291-a2f2-6b659971d92d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21e501e-b933-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934244, "uuid": "3a3bb128-ad43-489f-b0f9-99c96769d3ea", "comment": "Malware payload (njrat)", "value": "5597e3fb1ad69bca48268a6b14ad14a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934244, "uuid": "f8e0a1d0-43cd-4789-9f44-a0ba1a9e77f1", "comment": "Malware payload (njrat)", "value": "5c860960d17857c3262dcff9423f73b10f106df317d3d7e392d0cb1735be42de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934244, "uuid": "15e05729-1dd6-4f6b-8f9f-ddffd4d33166", "comment": "Malware payload (njrat)", "value": "c3fd636aa39ae14cc8c2980ccd5de77d7c0035e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934244, "uuid": "bdaef08f-8222-410a-b49d-7fa89a99402c", "comment": "Malware payload (njrat)", "value": "5a84d68e798e8dceae80a00bc6e2413c6587b2fb59d23b0b8818e5416aa1b5ed7c89e08950c1794141e6e21d859018a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934244, "uuid": "bc7829da-6610-48e4-aa21-0b59a6c6f156", "value": "T144F22A5D3FA08162C5EF2B744AA2D72142B2D1075A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934244, "uuid": "2ac86388-f091-4299-91b0-fef2f282f5b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934244, "uuid": "8e960a54-bf2a-4b4c-9892-162f10914cf9", "value": "384:KLd2LzreBCAuKiEZePC4SQY2OzRLTm3yilqr6LgbvOvGj:UizrecPEZeK4SQssPvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934244, "uuid": "fe298dfe-753e-409d-8654-f8fb291897b9", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934244, "uuid": "ef803708-d3ee-42c8-b0ce-93e9a18a4279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934244, "uuid": "f256defb-52cd-4b6f-86bb-2d13ca2af788", "value": "bTbO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4875588-b932-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705933765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933765, "uuid": "f4bd0065-3e14-4be9-98e0-ce5289ea489c", "comment": "Malware payload (RiseProStealer)", "value": "409437e27f2772339c538b62414f77e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933765, "uuid": "a27bff61-0d29-4aae-91f4-643d7b5b036e", "comment": "Malware payload (RiseProStealer)", "value": "5d4bb89c53bf6c45abb10c641c73117092833d2ff7bad7a8869fb7e56b4963ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933765, "uuid": "5ea8a329-1d6c-46d4-b81f-796559ee41a3", "comment": "Malware payload (RiseProStealer)", "value": "8dda645075377d64f79cdba50aeff38e90810e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933765, "uuid": "711740b8-5b2d-4b27-9395-6ebe3b38a76d", "comment": "Malware payload (RiseProStealer)", "value": "7b9f9968daaee1eae04400b229acb172ac502d941db4c65f1ab3bb4877b5254cd338f5ef5571847cdb08d4059310e05c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933765, "uuid": "6a62caf6-6656-4df3-89c4-30acfa67c111", "value": "T1EF4523D769BB9643D03337F550A20AD897A37DCB5402A84A621AFEC90FBD0BE4711D4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933765, "uuid": "ef0d9cb2-cef0-4ca7-b4bb-00a7e93d01e0", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933765, "uuid": "ab5734ae-c731-4f4f-8434-563f52b2efa0", "value": "24576:0v7bGL9aWfhsruuwQZ6icoECXMeQCUOhzw:o+L9bfhIlooEqpRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705933765, "uuid": "d0c23902-7f37-42e9-ad57-160dfa9388e8", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705933765, "uuid": "09a01a89-d048-4e62-9ed4-b91f52afc814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933765, "uuid": "a3518aca-43b2-4f77-92bd-1cab043cffbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47952008-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705917288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917288, "uuid": "1bda1f33-e0ed-4af2-8a35-f0525b21acb9", "comment": "Malware payload (Smoke Loader)", "value": "56e06dabdbaf0a37cca99f1b0fa53704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917288, "uuid": "7ff05a2e-cd64-4935-8733-1c942a99fffa", "comment": "Malware payload (Smoke Loader)", "value": "5d55a06ca16a85c8189e1a25891c431bd8e36a7a007b804b94a2f29ddd69707c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917288, "uuid": "53fb4bee-7386-4373-a342-3b06454638f4", "comment": "Malware payload (Smoke Loader)", "value": "8b94d457015decd442649fcd214ca0c270a36903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917288, "uuid": "af280dee-d47c-461f-9186-8b96b1205a7c", "comment": "Malware payload (Smoke Loader)", "value": "bf94eec2bf9c980b808ad9eed7bc1d9e6f5fdc3e97f03a1d7cb8bc5c87464798fe9209af0dc0085b621156caf2231062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917288, "uuid": "ce4ad212-792a-4df8-ad13-c6733ca5877e", "value": "T13A345B839EE27D94FA674B728E2EC6E8761EF2508F59376E521C9A1F04701F2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917288, "uuid": "77ebbfb3-b024-40b9-9e4a-03ffbce620ee", "value": "c52f363ae887f7e2b622bb07b5377eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917288, "uuid": "91949664-6c9e-4b81-91ac-63f19da77e81", "value": "3072:kvhh7/LwvwGXKuj1b/3SY0pr3EabhPsuLP1hnL52+5RKx:kvhd/LwY6Kuj1WY0prUaFPLzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917288, "uuid": "d6332e3c-db90-4e40-b3e0-7bada8848985", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917288, "uuid": "dee2c11f-1686-479f-8bf1-f11d0c15b5aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917288, "uuid": "ed4dc2b1-0f46-4675-942d-2cb172e1f13d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c1a65e-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705917574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917574, "uuid": "45dbb260-38fa-4635-9dce-b3b62c72ee38", "comment": "Malware payload (AZORult)", "value": "bfa3832346460edd9e3c6d500ff362c5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917574, "uuid": "500b3e74-9809-4078-8699-125b470a7ef0", "comment": "Malware payload (AZORult)", "value": "5de5eefbec6be9cf392e7dde9cf48df6e20e8b7896f311519b0713976ae6674f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917574, "uuid": "e08ac6e2-6e64-49e0-bd03-5ce934a56f31", "comment": "Malware payload (AZORult)", "value": "215cf2e028db2fbb1a85bad4f9ee4159c33058c8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917574, "uuid": "03a8ea93-3f9d-4969-b7a6-7cd5dd88e04f", "comment": "Malware payload (AZORult)", "value": "41932bb02c7eb034f52597efc8a10bdbdc0431402e40c34900c7e82f4cb96973ffaf5261981558645102a7ba85d81ff7", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917574, "uuid": "8b74e0f6-1119-4b25-9d9f-4c56d7f33e57", "value": "T1FD94EF147790E55AD1DC5B704DBFE6FD5E64AE036A21460BF390FF0E3972AC0B84A298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917574, "uuid": "1284720e-d36f-45c3-846d-b0a227ee5077", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917574, "uuid": "13a68dd0-1fc1-488c-8c96-16c5633cee03", "value": "6144:84t6Lsvq5WSBH/AijRpRaVxLr5Ec/4JhgKwpXcW5og6cjmSlJeM:8kvqcSBHYibK1Os4JhgKycpcCoJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917574, "uuid": "a85e62b8-dbe3-4f07-a8d1-140e0566469c", "value": 423696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917574, "uuid": "a15fb6d0-b013-495d-a0f5-c84fced4d1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917574, "uuid": "9e3ae7f4-d29f-4323-8e65-17f4080a50ca", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2f2c3f-b902-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705912949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912949, "uuid": "ee700e83-2b84-40f7-bf01-33856ac3da70", "comment": "Malware payload (Socks5Systemz)", "value": "0cc30e36cc637e58388f36d4dfc19066", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912949, "uuid": "8e8138ee-9a97-47a5-a8bd-69e101be3d8b", "comment": "Malware payload (Socks5Systemz)", "value": "5fb04dd2f4c026af1ac7a9ec258f029367eb227c8e0ae8e854f33544868bf0bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912949, "uuid": "71c7519c-30ab-47bc-8535-0b0bde3eacf1", "comment": "Malware payload (Socks5Systemz)", "value": "8dc797ce82391e6be9036b7bdf6abdb71f31bda0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912949, "uuid": "875502ae-d8e2-40ce-956a-1e8516dc66e7", "comment": "Malware payload (Socks5Systemz)", "value": "a7c150943fff0ae8ff7b966b15964aa2c03fe9128c4f632f7a8a3f599cdfd6207184ec1222bba07aa9017a8e435fb8b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912949, "uuid": "022ee5ee-de10-498f-8aa8-197a1193e4cd", "value": "T1E02633027F106623D3A147359CD3B318EE32FD8CA6039205286BA5DA4F663E5ADF5BD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912949, "uuid": "fcd139c5-c14a-4d09-aec5-1c87aa6b80f7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912949, "uuid": "5937fda8-4d9a-42da-842e-ef49fcf301cd", "value": "98304:6KGKGPFNLCqekaL7MGNd3xOrvJB4cFpq0VsUto+EDZQshEaIn7wd358:WPfLCqyL7MCJxUJB42oVZJdInMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912949, "uuid": "9d96802b-9756-4eb4-be1a-e5cf20d28c1e", "value": 4440298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912949, "uuid": "94cca606-aad7-4d81-b597-f4aad25af286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912949, "uuid": "de99df03-ef2e-4e15-acda-cde6d7d4f01e", "value": "0cc30e36cc637e58388f36d4dfc19066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e531a9b2-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705915835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915835, "uuid": "3518a913-42f3-41c3-b6d0-60443401f94a", "comment": "Malware payload", "value": "84132b6ff67a2edc0086641076cbe74c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915835, "uuid": "a11bc556-c2a9-4eb6-865c-3e97e62b7271", "comment": "Malware payload", "value": "6061e0a08600cb5beb394bffd3ddfecd1699406f6709c7413962cb3881d845cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915835, "uuid": "bc6e0e57-25b5-4724-bdc0-9a7939c52090", "comment": "Malware payload", "value": "82e5b836b6003635fb2c98a4851789ab093dfd30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915835, "uuid": "b8e404d1-8212-4c8b-b87f-08f9b2935488", "comment": "Malware payload", "value": "650cea25d8bdd132414deada0c20c3bae0d7c7fd7fb2d0bbc969d24b3b2602a9bb020dfe7ba85d5076db1c66274f0aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915835, "uuid": "c7003801-e01b-493d-8666-a37ba0f37450", "value": "T1A9B2299A77D509D9F027903CC2631A27D1B5F8952F21A7DF1BB2613A0E772E0AC32A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915835, "uuid": "29829b77-4534-4f27-a2ca-ea3126f055b9", "value": "cc6fa07d0e4df53c30a4df553312ce2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915835, "uuid": "23ba9185-b516-42cc-a861-a9198545ee8e", "value": "384:S+rxKBZKoRAykBzCZqcqDhq9LArzjsQivINOX10agNx3V+GDB:SySSzmArXs/IgXwx3Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915835, "uuid": "95547831-5e6b-4c48-a89d-47a42852a4cd", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915835, "uuid": "72d3d0c5-76e8-42dc-ab4d-bb8618f9d44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915835, "uuid": "40e4b515-3b27-44f9-be93-7244ab80cc6f", "value": "SecuriteInfo.com.Variant.Tedy.471276.24775.15961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07959d71-b8cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705889264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889264, "uuid": "5876469c-b4b5-40f4-870b-b137dadaefd2", "comment": "Malware payload (RemcosRAT)", "value": "9b61da2d8f59052fd0af93c1cdea0140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889264, "uuid": "bb4db45c-788b-4f71-a7b8-c6a09feb48d5", "comment": "Malware payload (RemcosRAT)", "value": "60baa67ddc14257cb00f965efde95d2df191f827a4da9fbf10722c95e01b0922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889264, "uuid": "4e4d85a2-8cc5-481f-932b-8de3505ada2f", "comment": "Malware payload (RemcosRAT)", "value": "e1a4e0c6c436c16931ae845eed3383140e5a0509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705889264, "uuid": "07c4e8ee-799f-4b2c-865b-c100b534dc66", "comment": "Malware payload (RemcosRAT)", "value": "dc3b4849a33635d0048b9661863ce864cb23768365a4085edab100b133822e25714ba166c78dd9b3b6d98a663d560350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705889264, "uuid": "3098d125-132a-445e-9e4b-7b3f1c231854", "value": "T1523412A82F67EC65F2C090F49401E1F072DA1C661EA7264D07E4BF57BC7E550BA96063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705889264, "uuid": "ad408038-8c46-473f-8202-9cc5e5ea4a9d", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705889264, "uuid": "acda56d0-93ee-42e2-8436-f0079ee81318", "value": "6144:cmvl3n8iOiB4RBucKa3h80tK2gBWvADGGw6j1:BvlX8i8RB5JvADGGnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705889264, "uuid": "caeb8d36-f9c6-41fe-becd-17dfd06a747d", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705889264, "uuid": "3132dfc7-f200-49a2-963f-eec45a3cd0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705889264, "uuid": "7f5e912e-8f1c-4b3e-8408-fd0e2abfeb50", "value": "bTea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2c143f-b934-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934447, "uuid": "74dea242-eb46-4897-9dfc-46638c800b84", "comment": "Malware payload (njrat)", "value": "15c643ee1f546c01e685dba30164489f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934447, "uuid": "a7e896af-1eb6-4bb7-ac35-58ad8181a698", "comment": "Malware payload (njrat)", "value": "60cbfe535b119b3eab86debda5188f2b6bb3eb0c4e86cbadde4fc8971ef21ca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934447, "uuid": "0ec99656-c4ce-4c64-835a-9d90bca5e8bc", "comment": "Malware payload (njrat)", "value": "7b13974fcbd21edcfa0c910d25d27ba1eead8a43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934447, "uuid": "bf1ba98e-2523-4ed7-a916-4885110baf7c", "comment": "Malware payload (njrat)", "value": "da04ddc69f9060cc7b68c95d0cb270f4f06c779bb7a0199454d97cc246fa74285138eccab8f029899e3d4c1a7b61aa9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934447, "uuid": "99e67756-7464-4858-9464-ce016134a704", "value": "T15CF21A5D3FA08162C5EF2BB44AA2D72102B2D1075A23EB5F8CD844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934447, "uuid": "104b94e8-87d0-4273-a147-871741098f5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934447, "uuid": "11092073-adf9-4ef0-bc08-4ddf280deb82", "value": "384:GLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6L1bHyvGj:gizrecPEZeK45SssovGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934447, "uuid": "50d7df15-1817-4a8a-9d2b-f2d9e4a91a65", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934447, "uuid": "adc2f33a-b682-434d-93e6-64d82dd08add", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934447, "uuid": "9fca6bbe-929a-429c-8512-c0406042b7e4", "value": "bTdU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f51ff2-b932-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705933521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933521, "uuid": "ece36e03-e920-41d8-9090-250c6fed6f0b", "comment": "Malware payload (DCRat)", "value": "95d77abc7fcc0adcc0e1e14f92628d2c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933521, "uuid": "753fa222-a7d7-41d0-ab6a-b1038aee77f0", "comment": "Malware payload (DCRat)", "value": "610fcf9f81cac31fcd0ef2569daad2a4fd8a989d9295e663442a3049739f3395", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933521, "uuid": "3c85221b-53a9-47b6-b7ae-5b5dcda869a0", "comment": "Malware payload (DCRat)", "value": "ff01b31a3e3c0ee13b60d6ace94f22dbc34d4548", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933521, "uuid": "804f45af-4acc-43c4-8e79-962d4d521c3d", "comment": "Malware payload (DCRat)", "value": "37d83b93c563bdb8da4b6cb8f0d47a35fad1323b5e3a1bf0c01a7e68d3425fa0c549ab6fadb0c5d4994b7b54c917a6e6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933521, "uuid": "501ebf57-2106-4501-a18d-09c16ca5678d", "value": "T1F006F10AA1D24E36C2A4173145E7063EA2E0D3623916EF1B3A1F54D7A8477F18E726F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933521, "uuid": "1e0bab76-1afd-43f3-b9b2-a2c9d5b25d3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933521, "uuid": "0af64047-e6dd-4c85-885a-c7eb96820378", "value": "98304:twP52OwKRqyG3efsj6CGf2oP0xt+OtzWKUnVN:twPOws++oP0T+OQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705933521, "uuid": "f272c372-24da-4a98-92ce-7f01d2105226", "value": 3770368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705933521, "uuid": "10b2bed9-177c-44f4-9239-e7dd8d2074d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933521, "uuid": "77681b6c-89c8-4612-b28c-000f14362d9b", "value": "95D77ABC7FCC0ADCC0E1E14F92628D2C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d6db1a-b914-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705920612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920612, "uuid": "183076e1-ab35-4269-b611-5f4038d9ab78", "comment": "Malware payload (RecordBreaker)", "value": "2800086d1e1bc2bfc3fd70f888baa391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920612, "uuid": "220ebbe0-35b9-49ed-ae3e-710217ec1ddd", "comment": "Malware payload (RecordBreaker)", "value": "61487917009bbcc5f0dac7840265060f070adc22139fbab964a37cd68b7779c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920612, "uuid": "4c421f93-f302-4460-8613-507cffba127f", "comment": "Malware payload (RecordBreaker)", "value": "ace5ca715f0279a9290e55c4ebc0988457446d6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920612, "uuid": "01ac2871-2e6a-47ab-a5df-4ce4c7828c66", "comment": "Malware payload (RecordBreaker)", "value": "d3f2c0e8e73e6e185da66c1b55a214b1a07470d0cbcd93256497be590e7273373cfc012491f6fc44df4aa39b090f4cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920612, "uuid": "fa5be834-e3eb-4d30-8bd6-bbd840ef7a6c", "value": "T1A775BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920612, "uuid": "f7597003-ab6b-44da-b42a-d9fe7985e983", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920612, "uuid": "62240754-c6e7-4c2d-af1f-4e8c89220a2b", "value": "24576:s7FUDowAyrTVE3U5F/fcdKic6QL3E2vVsjECUAQT45deRV9Rq:sBuZrEUmKIy029s4C1eH98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705920612, "uuid": "cdb132df-970e-4269-b2ff-cc8beb1184cc", "value": 1671997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705920612, "uuid": "f192d204-1a4d-4c9a-88ce-c609ab1715d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920612, "uuid": "cb87ab5b-c7b2-4d23-960d-5ed0de081d85", "value": "61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa4a4e7-b95c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705951868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951868, "uuid": "665312e0-dd65-48d1-a45e-13302ba90282", "comment": "Malware payload", "value": "e40435c6df1a16aad70fcb8582228bc3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951868, "uuid": "ed72f373-af7d-435d-a67b-61d7d3389f9d", "comment": "Malware payload", "value": "6148afd882ab17b41c7e5d92569d55426ef18bec0c45335529ca66c0ae19efdd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951868, "uuid": "51bbd3a4-f5ec-4074-bc2d-6e090720b061", "comment": "Malware payload", "value": "8d5a1a1213b6680cfe3cb59aa0383ae8a91d5141", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951868, "uuid": "fa23c2c9-5811-43b4-93bd-9056ee39482b", "comment": "Malware payload", "value": "e4f1c2c3f98e11273d67e408f1a4f34cf45a2817692d46878c80c1d30f452c0824d2156ae56996ca72cb6944b1e2bde1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951868, "uuid": "e3a3669d-2e9a-4db6-9f52-969349abfe91", "value": "T197535B003798C966E2AE8AB8BCF3550106F5D5772112D61E7CC410CB6BAFFC64A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951868, "uuid": "1a34680f-6162-4b57-bff2-222bc761da37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951868, "uuid": "61300aee-2675-47e7-b52f-e7ce4d22a68e", "value": "1536:UJ/t/dSJYUbdh9IM1b+uFg6CinpqKmY7:U3/YYUbd3Zg6Ci0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705951868, "uuid": "61c3150e-417b-4f9a-9f32-70e8df390496", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705951868, "uuid": "8282f718-5d64-46bd-9cbd-97125fd9153f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951868, "uuid": "bcf6925d-1902-417d-8d35-f838983491c8", "value": "UniAccChecker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c0d2bc-b95f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1705953148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953148, "uuid": "ac5ed3e2-4218-406f-9f28-df6ff69c49fb", "comment": "Malware payload (PythonStealer)", "value": "225f0256ef50aab5c935499df55437ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953148, "uuid": "4733c46a-deeb-4a39-9165-9c77e5353f46", "comment": "Malware payload (PythonStealer)", "value": "626d8f4358194ddba886b240b5c7a63cd851dbf2b9bea1917d61c98fa0e68893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953148, "uuid": "bdbf1830-c5cd-4f89-b0cb-fde7d7738c93", "comment": "Malware payload (PythonStealer)", "value": "35f51718d7ae3722334535e452868bf0e83520c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953148, "uuid": "298bdc73-4de3-4434-872d-abbc364b6c91", "comment": "Malware payload (PythonStealer)", "value": "b054002c693def65eb4d58acc5784368e0414e0a6534068eb73bdc0e509df1d451ad09d92484b706f28d5cf3ee7181a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953148, "uuid": "46cb88df-19bb-47b8-88ea-83ecae9b6775", "value": "T1FEB63339D5A34CE4CD63C1F0679B39B2E52D69281640D4AF6340A5BC8F5BFA0279CB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953148, "uuid": "0a08d955-5aca-4ada-919a-33d4edc59c30", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953148, "uuid": "734ca1ea-99b8-4860-b9ab-10c1da9ee9b8", "value": "196608:E3qcMiSSZwkhb3t1cISM4SBFcJNd0qx9Uf8OcbfZ06hB:MBMiSSZ7hb3PdlBwSwef8ftH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705953148, "uuid": "efb5c3dd-c02c-41be-87d1-4437173e6b98", "value": 11201024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705953148, "uuid": "164181e2-13b5-4a5e-ac90-53aa8a92b0d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953148, "uuid": "55f7c334-ce74-4b64-a2f3-cab906085b68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688bd4eb-b91b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923786, "uuid": "6712bcb0-b700-49be-a05f-defee4f49263", "comment": "Malware payload (AgentTesla)", "value": "f7d956dd77ca0f804fe7d9ac55ed0782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923786, "uuid": "b25879dc-7b90-401a-8ee3-1b6c497453b2", "comment": "Malware payload (AgentTesla)", "value": "638b2076b8254e21243ba434a06b1c96bf451af3566b3e624dc5af8904eb3a7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923786, "uuid": "2adb20fb-ffeb-48f6-811e-15f22aeae220", "comment": "Malware payload (AgentTesla)", "value": "2e7a30be30696744fc09a91260a0bc741c6c046e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923786, "uuid": "ca89e4db-85cc-44e1-9752-647a6dc0a460", "comment": "Malware payload (AgentTesla)", "value": "61f2d4de790ec8b2b57fbfc14ed30255927cfb926c3083705708540afd3a86a80f77045beff689d437b50b41c7f385bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923786, "uuid": "6ea6096f-c7de-4278-9352-0a9bca313833", "value": "T1CBF40192F26CAF85D92693FC4820F02063BABB6B412DD74A2EF270DB14727C21656D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923786, "uuid": "5cacd3b7-139f-47d1-a52f-d1755537b50c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923786, "uuid": "73e74236-63ad-40ad-a991-be6cad658137", "value": "12288:Bm1emkVhgjjN2iN+X6YJSaZkWYCDAgJaPCFAmAooeY7TZGgxLYWjmVGKA5FPX:Bm0DgjjN1CFSEaP0bBQ7F1uGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923786, "uuid": "fd72f2f4-ba97-49f9-81bb-8500ec45c1d3", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923786, "uuid": "e7d6dada-fe75-46b1-9ecd-3fb55645faf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923786, "uuid": "8f107133-2a89-44ef-b41d-bffe68dfe3d4", "value": "rIMG-Scan-NewPOPSB-17398902,PSB-18384789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d735e52c-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705917100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917100, "uuid": "e50bdb60-6c69-4e9c-be3a-0252d792bc05", "comment": "Malware payload (Formbook)", "value": "65ce097d95fd69fe7620cd1c0781f174", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917100, "uuid": "8cd2fe13-2008-4190-8e11-e496e250cc61", "comment": "Malware payload (Formbook)", "value": "63b5960f8fec3830f836b5d05064a82a544c3473f4cca1f7159235016fcc594b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917100, "uuid": "b6771170-ea6c-4820-9935-af95b44be164", "comment": "Malware payload (Formbook)", "value": "7d73c82a2b7601379817cd94942b43ad4f081153", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917100, "uuid": "b0df7164-f630-4e49-8b75-412f68bd4344", "comment": "Malware payload (Formbook)", "value": "f16d1dbbda1fa1f12229b817088bb316e29b354ec44d98346d0ed4418ec47004a96bd2940af6df462e7fe0b667b4fe2b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917100, "uuid": "13fb800c-e34a-4faa-b14f-fb491940c6f3", "value": "T17AB4234A35EAAA7FC1C344751FE782DA0645FC226B05E5A778F4BB2D0978B80C52335B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917100, "uuid": "6dce713c-6b0c-4ec5-8dc1-8234420df5a9", "value": "12288:NSN2BC6uEkrQpozwjTqCfg2dpI1yv3aCW/NkoA3mydPf:Bw6sRWWCfg271v3g116myhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917100, "uuid": "c623186a-3948-4f6c-a663-490b239a844f", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917100, "uuid": "b4c278d6-6808-47b5-ba8e-d1cd88c8b7ed", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917100, "uuid": "d3b12002-c01b-406b-8a59-73da5a67ef82", "value": "Quote.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bb31c6-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705915839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "dfb36983-f01d-4318-b9af-54c5375c604a", "comment": "Malware payload (Socks5Systemz)", "value": "81b313ddef00609ce6641638de0f9edc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "71a12a7f-d0e0-4355-90ce-c7fd1dd34eb6", "comment": "Malware payload (Socks5Systemz)", "value": "664f6822168d8f727b5454f08436423497e68fdbc0794eac2ceee479cdafa162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "c8001ae7-d5f6-4543-93de-9500e40a8e5b", "comment": "Malware payload (Socks5Systemz)", "value": "0ffb24956c812cf3e512e62d8091ccd7bbc83d4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "7d194471-c994-4880-bf86-38328807a017", "comment": "Malware payload (Socks5Systemz)", "value": "c01ee116c078837c1ae9669edac99355512bc07fb0bce434e58ab598156494a415763192ebe1ed1166497e28e2496044", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "32e3b887-6c2d-47ff-945f-f7b176ef0f82", "value": "T1DD163321BF805637C344CA34BC867394DE72FD1E66125607AA2BB6CE2D607D19DB93E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "df3fb417-03fd-43fb-9b05-e078625d8160", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "cfad1bdc-defa-467f-b6c7-23128c798b97", "value": "98304:6SG8WF9Zj+uOebr83L1fxr+ZBh4AfRby3uPUtYRzFpAd358:VG8WDbTbrkBR+Zj4Af8OUyRJKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915839, "uuid": "97595de7-14e7-4f8a-b166-b03d03ab6c66", "value": 4156156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915839, "uuid": "4beb4260-7bb0-409e-8400-905809d02f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "75679078-944c-4248-965f-036f58d0a0b0", "value": "81b313ddef00609ce6641638de0f9edc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb129536-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705917482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917482, "uuid": "03765d84-188e-408c-a61f-bfab42f3c32f", "comment": "Malware payload (Formbook)", "value": "2d95b8d3a985b14415096eb1aca093e1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917482, "uuid": "8864fd39-9c58-4169-9d13-d65bca78f430", "comment": "Malware payload (Formbook)", "value": "66ebf028ab0f226b6e4c6b17cec00102b1255a4e59b6ae7b32b062a903135cc9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917482, "uuid": "60d6e45c-dbc9-4b24-aac8-83a6b45d6206", "comment": "Malware payload (Formbook)", "value": "a9977b3ac94c0c7446dce767ba211517a05525d6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917482, "uuid": "74bf9dd2-01a1-4cc4-ba23-3779ef16faa0", "comment": "Malware payload (Formbook)", "value": "b36ba0765c8a7d96adf4c9dca2cf1c2dba430a272b25a3c8f9793b80b56f925cbb7b94a9b5d7f5fe565a0e118b93e6c5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917482, "uuid": "5f13c760-040b-4dd4-8aea-e6f4afc54035", "value": "T10D057B40D1C9FCA9C00A11B69838F538751DF79D917BCC6A2E6EA149A0B7393706BF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917482, "uuid": "f8079b15-5ad8-4a34-8ab8-182e3c688605", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917482, "uuid": "020bd962-6df0-4b17-84e0-6da346278b5d", "value": "12288:OWp+RJg9K4VefDOtUhA7LOzjV2/iKh3aMEepi8/ouYAeUmP:N0Jg93VShA7yzjE9KUpYJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917482, "uuid": "9de11af5-c161-4b32-aa64-bdf005bf6c0e", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917482, "uuid": "20e9125e-dc6b-4d8e-9f81-91eb179fec3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917482, "uuid": "58238c07-6f9c-43bd-a5db-603eb142fdcd", "value": "PDF.DHLinvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c128abf-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1705917000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917000, "uuid": "9978545a-4d29-4214-af9b-0e7ea262269f", "comment": "Malware payload (DBatLoader)", "value": "e159bdacc804fecd859ee4751c654052", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917000, "uuid": "3cb61e1a-1c3b-4865-a3f0-3417f98862a8", "comment": "Malware payload (DBatLoader)", "value": "671f8af9acc3ec534821b1fd018c7726daa235e21df1092193056d95bfb54777", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917000, "uuid": "5015791f-c394-4339-9413-a7a3aaaf5ab9", "comment": "Malware payload (DBatLoader)", "value": "eeee14bb8c6477988b4a8da8583e32d45c4cd7ab", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917000, "uuid": "b733b129-0d44-4c05-87dd-b94b8322cf12", "comment": "Malware payload (DBatLoader)", "value": "748a238e9c79fb31898119c5c84e50ac9b3bedc4d649eb1e683e98e804863e7d3ec10f92cf0cabdbf7b04c4df0d8bfbb", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917000, "uuid": "de2dd078-ef22-48db-ae85-5001c50bb5b5", "value": "T1C3D5BE014F7CB8B2FCD4C936CE677364AB657E31AD60899232A978DCD976E9D702C012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917000, "uuid": "78e215d9-f2b8-4634-95df-f9f027778838", "value": "02e3ebe88b2a6296bb4b034e0bd03814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917000, "uuid": "4e600cff-7dea-4506-93e0-f2a8f19041e4", "value": "49152:xDWu2Avcfk5wAQaEOsA7M0enZFOZrABL:xyu9uFI0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917000, "uuid": "e59ab7a2-795d-4122-9d59-c26960b6d0c4", "value": 2774016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917000, "uuid": "198451ba-59bb-4370-9c8a-7cc0bcdb53b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917000, "uuid": "ba47515c-9f2b-446d-8051-d5149866e2ec", "value": "Znokqyctuubnie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebc0f1a-b8fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705910750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910750, "uuid": "a4ade707-6dcf-449f-9da5-4ce4e52af236", "comment": "Malware payload (RiseProStealer)", "value": "b2069ae7c664ec87fcdcbe3b4dd80d75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910750, "uuid": "91eb05d8-1bf3-49a0-a23a-9fa82992fe5c", "comment": "Malware payload (RiseProStealer)", "value": "67fa234fa7ad92293b2e79b1a7fca85e17c2fcdd699d84ca5ff5f2678806f3ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910750, "uuid": "266d4857-5821-44be-9487-1ba3a8be344d", "comment": "Malware payload (RiseProStealer)", "value": "b6fcf1d3c48e76ecd12046ae1d6750dc7f888d56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910750, "uuid": "87763838-d979-4d44-855f-cb91b676fba1", "comment": "Malware payload (RiseProStealer)", "value": "4b467d3a584ec0b267c64da40927b7cf91eef9bbca2d33e7aa23f1d697b5ea3e958663fbb9286e5521c0d8dff655c057", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910750, "uuid": "42d17b84-9829-4b66-aa8f-f4c708878e04", "value": "T1B74523F898BB6990E91383B541CE15D50487BD975288622D258FF58B4FBC0BEB3C1F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910750, "uuid": "a98b817a-848d-4c60-949e-5819e7b5a489", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910750, "uuid": "ca465316-751b-4f6e-a45b-9d57324c0cab", "value": "24576:j83TLCF6WjCIpjTrtjwQWiyIakELWYJymxO59YuJ:8TLC6WjCIJVlTL8Wvm0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910750, "uuid": "191a7565-3e28-46f2-a701-ece99ea6d4f2", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910750, "uuid": "4d7fa427-f2d0-49dc-8975-149ac6125b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910750, "uuid": "73885d4e-bc7d-4931-85d7-feab6b6e5e97", "value": "b2069ae7c664ec87fcdcbe3b4dd80d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fdbc70-b90a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705916633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916633, "uuid": "75ea2576-4191-4679-a526-289a10598003", "comment": "Malware payload (RedLineStealer)", "value": "df44df4cd65c0b0909ee7dcfbb8dc4ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916633, "uuid": "30c74538-d3de-4454-8ae7-778e80ca480e", "comment": "Malware payload (RedLineStealer)", "value": "6812d2c704a12a02c87a5b7152ebc3294d71f31262460115a23a4d8b5e4cb5b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916633, "uuid": "824f18fd-0cc2-4e00-904e-7b4291f38ea6", "comment": "Malware payload (RedLineStealer)", "value": "8d8c88430d7a43abb1b3772de1e5ba7093e46697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916633, "uuid": "cec42068-953f-45cb-82d5-caf153395e8c", "comment": "Malware payload (RedLineStealer)", "value": "6b7bb225047ebc8a5e7cf8a1f3d883fcdde6fc3a1084526859c7b613d829dea6c57f9cef5ba35c98fcb15e34582fece5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916633, "uuid": "2c7f37b3-d84b-4861-ab2a-ee4f8acdc985", "value": "T16256339ABA41CD75F8077275A4F51E0287E509250FB83F4DB34CB9B23A32323955BA72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916633, "uuid": "25803fc0-5202-4823-9a42-0f0b2b1d0c7c", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916633, "uuid": "e90fde7b-ef72-45a8-9c80-0820e5da42a5", "value": "98304:CcCD7LKIfR0cxqHXetqlxyAR8EH7xdOBsk/zA9Q+zrAD5b/nCNJkF3NVg9OrfDt:Cj7LV09XetqPvKE9dY7A9QcrADxYJk39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916633, "uuid": "d0e19b48-7c1c-469d-bfba-92eb617b784c", "value": 5886794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916633, "uuid": "06e3b781-d8de-4d73-b5d3-af1240af4aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916633, "uuid": "42a78629-487c-4a2b-bafb-23b6f2b31025", "value": "df44df4cd65c0b0909ee7dcfbb8dc4ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ca804b-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705915841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915841, "uuid": "b927ff27-7b01-4e47-88d6-1177974bde11", "comment": "Malware payload (AgentTesla)", "value": "810be44fe1d406fc4e81da28128fab90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915841, "uuid": "d6aedab8-4f92-4ef1-b0bc-9c6e6c28c563", "comment": "Malware payload (AgentTesla)", "value": "68496e0690ed21e7c23f7de67927eb0b6549ce85866d1a7d1c53f2024fd59532", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915841, "uuid": "28a73007-04bc-400c-9ddd-3765af497d77", "comment": "Malware payload (AgentTesla)", "value": "f778d975402d5e7878acf18aee8a29876c34fe60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915841, "uuid": "099da039-7cea-4749-ac6f-b3fe70d0b3f0", "comment": "Malware payload (AgentTesla)", "value": "dbc8af8d38b4a9005a627b783f257f5f3de132890afab65fe8ce88fce1c7a4211495e44a6765916d2c39070a7e2b24dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915841, "uuid": "ccf61bb7-1e87-43c4-823c-bdf3f11e5366", "value": "T1B824566DD34F0169CF525237AB570A5542FCBB7AF28512A1306C437933EEC2DA2252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915841, "uuid": "caf7befe-83a6-4aa5-994f-b1acf460b33f", "value": "768:Z7wAbZSibMX9gRWjtwAbZSibMX9gRWjR7Lz1p8Ct2qvnGeubF+11tx9zy:pwAlRkwAlRuLzXt2qvGeW+11t3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915841, "uuid": "91d4cb79-b0d1-4590-b6a7-b0521d7f541a", "value": 216608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915841, "uuid": "2ea28ac5-b813-4189-becb-dac267788ceb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915841, "uuid": "ca8a4c4d-d3d3-4309-b73a-332d8694b933", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.21985.13905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de40bc80-b902-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1705913246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913246, "uuid": "69f96e9a-0806-4cc3-ab11-05c4288b51fa", "comment": "Malware payload (Gh0stRAT)", "value": "471b2fe37c91bb020e7907897587099e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913246, "uuid": "fa52812b-210e-404d-bd14-32f4939781b2", "comment": "Malware payload (Gh0stRAT)", "value": "68abafd00ce80bf87b40ac64359794d75bedc8799e787511e6bd20f6a88295d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913246, "uuid": "fdf6a5b1-5493-48af-bce1-9689f2309b4d", "comment": "Malware payload (Gh0stRAT)", "value": "ea6a00d337032eae6538f0baac968c27f387c10c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913246, "uuid": "21b1ebc4-2c56-484b-89e4-456a8bbf446a", "comment": "Malware payload (Gh0stRAT)", "value": "d36b70306d98764dca17911238474e3e7b500933ca255701d0487f1541de4c7f7d6edd55ba3adfbfbddec4acee7442b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913246, "uuid": "f7bbbdd7-1bb0-419a-a520-da6386c89acd", "value": "T1454559691BAB4256DB553BB9C8B6929409190F531F28C4B16E310D1EBD2724FFC23EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913246, "uuid": "8aec1808-29ed-44f3-b751-30af0ce2e52f", "value": "de6942886ea1706308de6a5dc748b51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913246, "uuid": "b3b548c7-d44f-43b2-99fc-3cc7ba0055ab", "value": "12288:zcWl26g/UBlRn5DzZ3TTP+5WkOVHK/H7sx117ksgSh20RUTMkzVSleJHcT/rBMS8:gWgHN8kSszVSlMHcTDBMGr9chBMvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705913246, "uuid": "e7ac3d3a-8ee8-413e-9be6-dfc86762113c", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705913246, "uuid": "0fc68d69-0d18-40b7-9b7b-50bc5b503cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913246, "uuid": "38cad20d-3ee7-472b-8c99-03f80b7760a7", "value": "471b2fe37c91bb020e7907897587099e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25911b5-b8de-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705897791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897791, "uuid": "3318ca61-8421-4463-b2a2-64739f4dd8d1", "comment": "Malware payload (Mirai)", "value": "5c195f6c9b408fb2af2af50d6f242c13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897791, "uuid": "d1c46b32-8fd6-4559-b54f-74099f8bbfeb", "comment": "Malware payload (Mirai)", "value": "68d6a5a5fc41154a693501ddd988a25c7ef32a1c0435b48f98dcfd0f7eb26a65", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897791, "uuid": "8ff85f53-90b7-49d2-95ba-39e9b87fc599", "comment": "Malware payload (Mirai)", "value": "8b0b85de50b208a16ed3510274c610bbb970d195", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897791, "uuid": "ca3a3f26-99ef-426e-a082-1ff2f34aae35", "comment": "Malware payload (Mirai)", "value": "d55259a4f0c1c97369c37faeabf952449ceb80ece97123b34ee2e0dac261b739e2b750cdd25767fd2aa669820ea80929", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897791, "uuid": "61ec0158-d852-464f-9e84-b71a14f630d5", "value": "T1A9F32A46A7418A13C0D62779BADF42453323DB64D3EB73059928BFF43F8669E0E27606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897791, "uuid": "8a409e09-33f9-4719-bfcf-1ff40899726c", "value": "3072:R8yXC/SZJewHauYPfeO9IEgKSS39BWKTlbW233M/9UEW0NJEjZ:R8aCKZJRHauYPft9U5StIKlbRnM/9UqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897791, "uuid": "c901aa3d-a563-4631-af69-e81d7a11494b", "value": 159299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897791, "uuid": "5d8174a0-07be-4d26-968d-bf60ce464bf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897791, "uuid": "10c337aa-8995-4c5c-ba46-08353ad1a2bb", "value": "arm7.nn-20240122-0429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa1d5dd-b903-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705913508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913508, "uuid": "8e61aad8-aa90-405b-b266-2c73044918bb", "comment": "Malware payload (AsyncRAT)", "value": "f48eca5efc6303dfe034eecc0f1b114a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913508, "uuid": "e5fa34cc-9ffa-4314-a318-b841b073895e", "comment": "Malware payload (AsyncRAT)", "value": "69fec7559c7d4651616695612521684184eaa7e02d474e36e5db2ee58230ac71", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913508, "uuid": "dfd8cf6d-8ae4-4cff-aaff-fd1c36de7841", "comment": "Malware payload (AsyncRAT)", "value": "b571473d3114bcaab7b99ae13ebde1e872bcfdea", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913508, "uuid": "96d5656b-dcf6-45f5-9fd0-4bdbda912c8f", "comment": "Malware payload (AsyncRAT)", "value": "3bb912f964b9358f9f1e2aba391924429fe68d2b42911fc7b81d9d92909eb98573014e50b32a25fa9373120dfa8e4776", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913508, "uuid": "9e629608-276c-46e9-bb9b-bee2290a37c2", "value": "T16214234256B9950CC24B89BCBFB9F78A8C55CB08913037BE009BAE9E3DC7551D6BE143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913508, "uuid": "853cc2ca-c66d-4814-abc0-00936102dc88", "value": "6144:u0XicBk0bx4bt7QUYzboB3eEDXDw2VLTUv:bRqox4btEU4c9VDXD5VXUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705913508, "uuid": "035ce70f-b2b5-494e-8805-f25f7f8188c1", "value": 201228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705913508, "uuid": "b922416a-ad14-4f20-92b7-4efce766a73f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913508, "uuid": "a123b135-42f8-4023-9976-bc34d61ec7d4", "value": "f48eca5efc6303dfe034eecc0f1b114a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb401b48-b924-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705927871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927871, "uuid": "4f1cb9c2-4909-4320-aa70-fe6a6ba32f3b", "comment": "Malware payload", "value": "e6ae673e82f3d8e01ec7dad9010dbb3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927871, "uuid": "bf8b7297-40cb-43d9-a9a8-36b4883e6125", "comment": "Malware payload", "value": "6bba3b38ad8322712205375ce5f90e8877a518e23a6eee6a63f54a8f611caef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927871, "uuid": "2bebc251-c9dd-4ebb-9ba3-e21deef2c4b2", "comment": "Malware payload", "value": "c31cfc384af3c031c538a674b7f096238b4555da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927871, "uuid": "5b7a4c4e-901e-41b1-8458-2b0fc7f0671d", "comment": "Malware payload", "value": "49303544bbba217c3e09ceaa59446f4710c94f167d2fe782cdced3bea9695ff2ac7cd65a619082d79e8df0913f9f3f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927871, "uuid": "0db1e684-1a45-412c-8c2e-d72fad4bbcee", "value": "T12D14454DE3A2ECE9F966033864B104137F51BC5A62E925AE218CF6353D322525077EFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927871, "uuid": "a4b1cdb1-7bcc-43f5-ac6a-ed6184305353", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927871, "uuid": "af0b8792-568a-4945-aca7-69d2dcbc59c4", "value": "3072:KMobR7ezAjLOZvmX195vpKJP7w2pvhzd:XeR7eammONdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927871, "uuid": "a739304f-64f5-4e99-b465-6829102cd0b8", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927871, "uuid": "9e26592d-5ce4-4c86-8925-2a19ea4aedd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927871, "uuid": "e1e911ad-3934-4ba0-bc77-e553c4a07861", "value": "WEXTRACT.EXE .MUI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719cb104-b943-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705940981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940981, "uuid": "9cfc9594-1531-4400-aac1-1085db199145", "comment": "Malware payload", "value": "7c710b77491bda03eafe1bbd197f4966", "object_relation": "md5", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940981, "uuid": "a511453a-4da5-450b-9e74-e12809136925", "comment": "Malware payload", "value": "6bd6cd1c6bcfe0790fc8f5d50afa96c0b0d300c823952d98c68154e178bc5083", "object_relation": "sha256", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940981, "uuid": "148c4ce2-4677-4597-a62d-487a407492bf", "comment": "Malware payload", "value": "fd9df1ce396b6c9d00afa344fae50ffe10b242c8", "object_relation": "sha1", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940981, "uuid": "0661de92-fdee-458a-a639-2cd8d50676df", "comment": "Malware payload", "value": "42b1265ac9b1914d43daa611f18a50a6d2f99887f64acadaf1c97f79288f290f46525dce5db729edd06d21c8c942283d", "object_relation": "sha3-384", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940981, "uuid": "0b94aac6-5951-4388-b4c9-57a6d7d70f73", "value": "T1A406337D518231AD6F11F274CE920408BC31CB7FF9FEB5B218E5749B96560DA800AB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940981, "uuid": "61b73f70-2942-4c21-8b1c-7e769fb603ca", "value": "98304:uv4+b3c1H+2UaxB8IX/8CoTBIWLUY12EBq7X:kc1eF68CoIg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705940981, "uuid": "16664a46-b063-47db-9c0a-9a03debf7256", "value": 3866506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705940981, "uuid": "80e8e1a0-ecdd-4485-9fde-1ce0325bc407", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940981, "uuid": "11de9e0e-20bd-4ad6-b3db-73e040e121f9", "value": "Setup-M\u0410nu\u0410l_Inst\u0410ll_2024_-KeyPASS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6641bb0-b91d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705924776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705924776, "uuid": "c51c9626-4bb1-41f6-8232-e3d006bd7f33", "comment": "Malware payload", "value": "a111a94e70256944843fd99486bca3ab", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705924776, "uuid": "1bbb39d6-fce8-4ce2-828c-d9f9ace35e3c", "comment": "Malware payload", "value": "6cc02209a322c0c0a0cac3531623364bc8c468dbc5978663ff97d1f225c4f36c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705924776, "uuid": "f1992399-edfe-470d-965a-71b97c5b29c7", "comment": "Malware payload", "value": "3af4ca76c540b40557d64b2a97fe5fe1abf4b6de", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705924776, "uuid": "9dcf5a73-b117-4762-8869-66dad2bd96d9", "comment": "Malware payload", "value": "18fbaa44812386cba204ed45f1d9bac198a006ab2b40d6929abd4a5f295ea7015e465b9ef338547be158c3d0addba870", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705924776, "uuid": "847e39ae-6c9b-4d34-9868-d33958a861ec", "value": "T1F21466651ADE0ECEB408B577EF43A7D31C46DD3ED0A920DB947776A9A840A4FF18B120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705924776, "uuid": "6d4c47a5-1a5d-4f12-8f55-f595265922c2", "value": "3072:qjsnO3ThAMEUazu57MAG6C/TkG39e2yhbA4LG8EZhYt6cd6l5c0+PC2Zsv5:g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705924776, "uuid": "703e1913-4c29-4ea9-b2a2-b431c6296560", "value": 203501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705924776, "uuid": "55a243fe-0be0-4eb6-a9a6-799f1701ce90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705924776, "uuid": "98a251cc-1014-475f-8077-200c5fb680da", "value": "Wrath20x.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1af5f8-b934-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934427, "uuid": "8a22ca38-19cc-4b8d-af1c-5882c8c8fd9a", "comment": "Malware payload (njrat)", "value": "ab2f3cf9dba5a0ea3c2b2e415fbf8a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934427, "uuid": "45d87aa0-59c1-4793-a6fa-1dd08ab4efc0", "comment": "Malware payload (njrat)", "value": "6cc9741b9067326cd599c5054f120022e5ed7b0e9799fbd122460d51113da461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934427, "uuid": "047a5f2e-1eeb-4018-b706-9d2baa1f654d", "comment": "Malware payload (njrat)", "value": "e53c79db3524570e8b11120b9ed24a02a5baad4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934427, "uuid": "bad122b0-4d22-4b08-88e2-ee2ca8d7c1b9", "comment": "Malware payload (njrat)", "value": "03466bc92337b5b7d6644189fa142a8dc2abf662598f4fc1bf7bd52e4d452bdcf3aa8111ddba55508f99d9f159bc934c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934427, "uuid": "2fde8596-3fd1-46db-a529-23731f58e30d", "value": "T18CF21A5D3FA08162C5EF2B744AA2D72102B2D1079A23EB5F8CC844FA6B777D14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934427, "uuid": "d1057f71-c3a1-4eb6-8c1c-b7ec3eef800d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934427, "uuid": "ed5c3381-b6f9-48b8-afac-e5f3dbb70584", "value": "384:gLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LkbUyvGj:+izrecPEZeK45SssyvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934427, "uuid": "5457927f-daa3-4f26-a7d6-fb93de0c2c27", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934427, "uuid": "c52027a5-3aa7-4105-ba83-726eb679acb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934427, "uuid": "9fea5fd7-250c-4802-9d24-a56406aba57d", "value": "bTdX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa40b6c-b959-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705950606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950606, "uuid": "aa7f7cd1-84af-4579-9de2-1ff9f7fd5218", "comment": "Malware payload", "value": "9530a4b5c2772de4edb6005f057c0405", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950606, "uuid": "922afd27-d1c4-4475-8d9f-5304a14ec79f", "comment": "Malware payload", "value": "6e94f38fee814023e77c4f2f3f718fd0bdf456974fb7742c03ee17dd2054050c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950606, "uuid": "8e88c228-32e7-4e68-9152-973f372382c9", "comment": "Malware payload", "value": "f544295bc15e8c1f69e9c2939acc88decfe404c8", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950606, "uuid": "f612f855-9a6b-48f0-84b4-c0b49f3dc1c8", "comment": "Malware payload", "value": "0624c9e054b9bc64741e021e6670b2964a088d9893253fe7e94efe771c8fd73a47bc6cea764640a487becfab7dea2655", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950606, "uuid": "f05682da-3db3-4719-80fd-4a2531ad78c2", "value": "T17C15BEAC765075DFC857CD76CAA82C20AA516CBB930BD203A04735AD9A3DA97CF111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950606, "uuid": "dbd5adef-d84a-48d5-950f-474910c9f07f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950606, "uuid": "03091e2e-f83e-4c4d-bedf-09af88507f52", "value": "12288:8SGnBbC8IABQRIVa8Tt5g0IhUSIw28Ph0S0NrlhjT2E6JbkpjPJaGbrKHaYl18/d:NEC+BVTUZX2HjTz6pmddYl10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950606, "uuid": "d5f80140-c357-4647-8a29-dc1283a3cd5f", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950606, "uuid": "8f0756d7-ec36-46cc-bde0-412441f95b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950606, "uuid": "72331093-c11b-443a-85e8-74fc0a77e715", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5485d6-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705948082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948082, "uuid": "fc280c3d-c0a3-4f8a-9211-84f64d22b6df", "comment": "Malware payload (CoinMiner)", "value": "839f4bc2474268279f0f6c1a17ffbe2b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948082, "uuid": "12596592-2bcb-4516-a332-4dfa7c884e2a", "comment": "Malware payload (CoinMiner)", "value": "6e9fcfd94b394637080f11b5a39b52b9270e2da52209169c309dde4c701059dd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948082, "uuid": "e105c1d5-0a92-4921-a2b5-d155b73ec977", "comment": "Malware payload (CoinMiner)", "value": "6396e42797da03bf476d4387d070b0246227e651", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948082, "uuid": "95064a04-35e1-4e03-9625-6023e02500d1", "comment": "Malware payload (CoinMiner)", "value": "07bbcd1683f11a16ab78b8561aa82a9e2bb60cac10e0ca5d462d160fbe0be5ab789849d2b70cf31e680deae9dc04b8d9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948082, "uuid": "388960f2-ad3f-45fd-8353-ca7d2f5e3637", "value": "T150163325DBA94DB6EE76687C425319ED1233EDC480524D22333E3CA4C83B19AD86DDB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948082, "uuid": "2bf3bcf7-83fd-409b-8ea9-1f32b2fc19d2", "value": "f61687272ede04042da2ed03fc12db7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948082, "uuid": "85453d1e-3d35-4804-8c3c-ce5931790fbc", "value": "98304:XRbj92scwqfy6aBXjDtqFSRfBl0GoNjgwDY7SICUFjhFvY:V92sc3fyjagcVuNHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948082, "uuid": "77b7ce93-08eb-489b-bd4e-b87cc0593668", "value": 4138496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948082, "uuid": "79d55d01-d56c-4c87-8cea-44dc5cdf461d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948082, "uuid": "49001b62-a1f0-40f9-9396-49186b1cc520", "value": "SecuriteInfo.com.Trojan.Siggen8.10580.8878.1764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95d76f0-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948081, "uuid": "1dd539c9-7147-410c-8b0b-6445945c9b08", "comment": "Malware payload", "value": "91157209ad82927373b6974bb6a1f70a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948081, "uuid": "3f015b4b-396d-4bb1-92bc-3bb94b57d66d", "comment": "Malware payload", "value": "6ef1dc9dd7a71e3588c86e9f51059413bb5ba8cc7ededae06d57150e9f31f0ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948081, "uuid": "78449070-218a-4d4c-b4bd-66e5e9e3afa4", "comment": "Malware payload", "value": "2110f85d2637343e45a167e36903e7534c7bbfa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948081, "uuid": "f64dc3e3-e464-474e-8d9b-6d594504ef88", "comment": "Malware payload", "value": "cf8e0842bfcd7d9c9929b48e78ba9d874bfb5ec029f32525e84dde0b43872add2c79b4a18d735c488f9f55cd00b8b368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948081, "uuid": "3bb52948-b51c-4896-a92d-cff0803e1ad8", "value": "T1B0C6330266C34C78C4A024BE9603EAA85BBF5E859F789CC77756620BE51C7C6C772B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948081, "uuid": "9094fde1-08c6-48bf-a522-5ac956cf9138", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948081, "uuid": "c818227f-ffc5-4754-b3b4-6ef3afcfe1e1", "value": "196608:Ogj0I86pP/a3A3lAWDh6NtNPc577Iy32d+M45RkydnBpPA:OgjZ8mVAWDuN27IWk+dgCnBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948081, "uuid": "adc1e562-2db8-4a56-ad10-4d65620fc9c4", "value": 11559134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948081, "uuid": "cc1f1924-0ff9-4067-888c-eeb7e395bd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948081, "uuid": "89346feb-cb23-45ca-ae0f-652e9d3719cf", "value": "SecuriteInfo.com.Win32.Malware-gen.27257.31327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaddc22b-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705915844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915844, "uuid": "9509483f-b5a4-4b61-865a-2485d5c025be", "comment": "Malware payload", "value": "76be39bf7a0b93d8e988d6f1ef941b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915844, "uuid": "e17b510b-d1a8-4c9d-8d60-3c3b0f030002", "comment": "Malware payload", "value": "6f3473241549a0d100354bd8bd6eaf087a0bb2b706dd5af757fed1dd0126faea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915844, "uuid": "0722d1ae-729e-4914-9ded-3400c637997f", "comment": "Malware payload", "value": "a770475fba4e60a01547bb5df0bffdf35eb869f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915844, "uuid": "60e95893-f3e6-4762-9dca-739eed3db3d2", "comment": "Malware payload", "value": "14a1dad108b2c63088c8c9a2996496ac5348aa84d91de9ee63137b5f3dc604155f04ade741863e20ecd99a1724a49478", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915844, "uuid": "7318417b-f720-48b7-a669-fbd8c9fd335f", "value": "T174B22A9A77D509D9F027907CC2730A27D1B5F8962B21A7DF17B2613A0E772E0AC32B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915844, "uuid": "c9e98920-950f-4f4b-b0cb-79d3537bd207", "value": "cc6fa07d0e4df53c30a4df553312ce2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915844, "uuid": "320754ce-8ada-4d63-adb9-bc227161870f", "value": "384:a+rJK4ZKoRgykBzpZqcqzxq9LArzjsQivINOX10a5Nx3V+GDB:aaZyzDArXs/IgX9x3Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915844, "uuid": "a363baa3-2fe0-41fb-99fc-debc8328fc5e", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915844, "uuid": "c1cbd43e-19f2-4d0f-84e9-0bb9f4c583d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915844, "uuid": "be2b80b3-e06f-4cbd-9fc3-a6d6a0373450", "value": "SecuriteInfo.com.Variant.Tedy.471276.19837.32095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9c6fae-b8d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705894426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894426, "uuid": "20930115-85b3-4e0c-91fe-2ece9266a608", "comment": "Malware payload (Mirai)", "value": "ef89a14943e0be503ca106db9f9928c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894426, "uuid": "613dfab9-7c06-4d31-8346-8f237c48546b", "comment": "Malware payload (Mirai)", "value": "715f02d543e80ad0012ad285b4849c18b94829091b43ed6570ba43df4e26d2eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894426, "uuid": "db97ce55-c2da-496e-950a-02b1602d2448", "comment": "Malware payload (Mirai)", "value": "5358f2d3d66d8a8446ec91881e2685e4fb3d5ae6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894426, "uuid": "51903bc1-b2ff-459e-90e2-1cb158715de9", "comment": "Malware payload (Mirai)", "value": "57bb7ff78fd83bf3f4c9b4994273853c54bc6dedfe8c83b0f1c2415863840f90f3ead48e6ca5e84d8b9d692f085b39be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894426, "uuid": "d6e7fb61-3694-42bd-9c3f-6968d337a0f7", "value": "T194F30946B8819F15D5D256BEFF0E128E37131B78E3DE72029D245B307B8A8AB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894426, "uuid": "6c470473-a394-4f90-ad86-28fd7a82acf4", "value": "3072:18WIhalFU4jXk+WfzzMaLz4eY2QCiAzO9CjYTir:18WLnjdWf8aIeYvAa4YTir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705894426, "uuid": "19ad9f1e-c1f5-4258-a40e-04d6e8208569", "value": 160508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705894426, "uuid": "a56b1d4d-c56a-4eef-bb22-2fda4f4ed1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894426, "uuid": "7ac96837-ac9a-4be6-ab58-10d10147d2b0", "value": "SecuriteInfo.com.Linux.Siggen.9999.5961.16998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7b25ea-b8ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1705904977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904977, "uuid": "31ee52e7-4744-4c8e-9308-c0f32befd730", "comment": "Malware payload (AveMariaRAT)", "value": "a3f119126467007efece97b7c10eef72", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904977, "uuid": "88f653e8-4e49-41ad-aeea-8f05ec09e88c", "comment": "Malware payload (AveMariaRAT)", "value": "723b662d2e2310934a0ee26a0b1b5bc790d80b13ce7db9970a0abc8d294c9496", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904977, "uuid": "4fa7235f-6c13-4bdb-be55-51476cd59b1e", "comment": "Malware payload (AveMariaRAT)", "value": "b1c60c3e5aa31438d8eab02577f0ef2ae2928848", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904977, "uuid": "5c22dbdf-184e-4ef0-8849-f6422fae8df1", "comment": "Malware payload (AveMariaRAT)", "value": "07cd32ba4cfbcf7c7a8ad7ad5fff8f6120a8287755611ad6ce3504cbf811b1ad2987c68b5e3c8c95386f7cde223b6386", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904977, "uuid": "dc0d9c2b-a1f7-4006-a86f-dcb026d201de", "value": "T145C4121A33BE6FA3D639D7FCAC32345403F2BA5A5A44E3884CD270CB5478F499A4195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904977, "uuid": "c570a339-ba70-4eb3-a7c0-d4895c6d49b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904977, "uuid": "5ba6695b-ac79-425c-bd2d-c0a42a743ba6", "value": "12288:Whm+BgnuZAeBhwZO1Dg45sTG4Gk2Zii+PZzCTPPmy5RN:OuuZhBhf1Dg45sTGdoi+hz27n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705904977, "uuid": "18f195ca-1a00-48e6-ae1e-d400c8c14f1d", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705904977, "uuid": "6ca28b60-d7cd-4631-aba6-bc51a39e20c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904977, "uuid": "e09a5bf8-c8a6-41c0-8368-456a9608a68f", "value": "SecuriteInfo.com.Win32.PWSX-gen.5180.2031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b39e239-b8ee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705904490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904490, "uuid": "577e1dd5-942e-465d-9ddc-1d240ed468f4", "comment": "Malware payload (Socks5Systemz)", "value": "3d18891fc6f1483ac64db34269aa64dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904490, "uuid": "6ad91256-9fa1-4e3c-8053-602a373a5141", "comment": "Malware payload (Socks5Systemz)", "value": "72536a513320c7d6924294491a1c379c8729b5ec164060453c958afb20b739b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904490, "uuid": "0f8faa6a-125b-4008-a20c-b2b08571b92f", "comment": "Malware payload (Socks5Systemz)", "value": "eada007632797298dc00cbda9b193240a68d1484", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904490, "uuid": "cefe8881-be66-491a-9f12-f72b857f1577", "comment": "Malware payload (Socks5Systemz)", "value": "ecf4cf56ad1b5809b55e5c543a5ec9156ec1d8b4dc2228339e578c740b0c7fb7c38e887535520e729f7dda34d2cfb5f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904490, "uuid": "7ed5118b-6f80-4df9-8eca-21d86f1b15dc", "value": "T1251633267F11522BE3431A34BCE5B315DE71FE8D5A53020A2A2B82CD1E197D61DBE7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904490, "uuid": "c3967b14-0fb7-4528-b0f8-f6f07970edbb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904490, "uuid": "929a5bd4-75ee-4904-a745-8937e0597af8", "value": "98304:62QT1ppjgR0LJO/eeQytoC+PGsVM34aK4J/+7EMZd358:81ppUyqenVlO0g2w2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705904490, "uuid": "dcd2e57e-5877-4793-ab33-868afedce860", "value": 4372373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705904490, "uuid": "5ad46229-354f-4c59-a206-55d969e020bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904490, "uuid": "652b49c7-b02e-4ec8-aa5c-aab287b12ce0", "value": "3d18891fc6f1483ac64db34269aa64dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07d2dfa-b916-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705921840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921840, "uuid": "b8952bb8-5d3a-4368-9707-52a5f4bc50fd", "comment": "Malware payload (Stealc)", "value": "f130e4a4f64bbffe656628ddc2b80c80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921840, "uuid": "33df2a47-6f3f-4052-b814-7f4075af30eb", "comment": "Malware payload (Stealc)", "value": "72b5f66f50d67f0594debb5617ef420fc42f465ee2b4e5320452786f7c022ad0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921840, "uuid": "3b52d62f-fed6-491d-8449-dcd194486d5f", "comment": "Malware payload (Stealc)", "value": "ff9ff84439e489529ccc5d1661e5f4fe321a0ac0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921840, "uuid": "aac83003-b8f8-4013-a50e-9ae35c841c40", "comment": "Malware payload (Stealc)", "value": "f1b4ef5a58e1aba0314fa699349ea9f575713295fc75f3f2dd28af232f0970ca4c22eeb3748a3a34e79d1899eb5b5501", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921840, "uuid": "25a38902-99e6-4747-bc4f-46c3ce9b64aa", "value": "T190344B9392F23D50F6668B728E2EC6E8369EF151BF593769521C9A1F04B03F2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921840, "uuid": "e76f61d9-024c-4707-a566-c7f20d7bcc80", "value": "6772a34575cedb2362e5464a0a60f25f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921840, "uuid": "7e5a3ef4-0f9d-401f-852d-226c170707f0", "value": "3072:u9RuLJ597qR5RfcKDMQNxr4VmMw6VVIjLOuNxPkD/Nx:uXuLzpqRvfcIMQNxr4VJRVeLOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705921840, "uuid": "636337d5-f0c3-429d-b9ae-9762041fb108", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705921840, "uuid": "62718e8a-2a17-407b-a5b9-a29c2cb47899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921840, "uuid": "0fe0a0d3-0fa8-4d2a-936d-b52dfdc0cf2f", "value": "f130e4a4f64bbffe656628ddc2b80c80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5a699a-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705950743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950743, "uuid": "bc08f187-b459-4576-87a8-c152e0be8658", "comment": "Malware payload (AgentTesla)", "value": "8c875d369c064056d9107792c6ec30dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950743, "uuid": "3d13da10-0357-4102-b4ad-a5eb3c4ca72c", "comment": "Malware payload (AgentTesla)", "value": "730932451281bdcb34fd32ac3aeaedef8f0a919492032944bffaa5852b85d4a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950743, "uuid": "6b98ace2-cfa6-415c-b6d0-c8e17a7ed84f", "comment": "Malware payload (AgentTesla)", "value": "d704ea072c162c293c361fa312e10d227112618c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950743, "uuid": "2bcde3bc-e7c1-4194-b2bd-4bf0aeaf5d4a", "comment": "Malware payload (AgentTesla)", "value": "f38346c79ee686f4c690c9450bd4c6ee72812107be0b23a0917f14305d7f5c4e3ebf40a8d734b1ad1910c7a7f6db11fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950743, "uuid": "a918a9c4-d8fe-4f4a-a5aa-84a13f2d9b5f", "value": "T16DE4238E4E90B7B6D67ECFBB4A4740B00BF50C29167ED54B0EE5E29A27325409F93817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950743, "uuid": "ebc5515f-1b61-472e-962b-dcb4537d4ccd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950743, "uuid": "ec233a7f-5c7e-48bc-b126-7c0450bc4f35", "value": "12288:FePFLVoq3FxfAyz5MuwkvwXREX7wX9Q3rukF0CNcEPa39dECU/3ai:FePRVoMFxfAyz5M1GwXRg7x7ukF0+PP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950743, "uuid": "07d12bbf-c8b9-497d-becb-49f50cffc654", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950743, "uuid": "5a828a54-6f43-4db5-b398-c096b46bc3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950743, "uuid": "88e1405f-d04c-4e42-b70d-a6de1cf90ea9", "value": "PURCHASE ORDER-288424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2a1440-b8cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DroidSpy)", "timestamp": 1705890160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890160, "uuid": "9d1feda3-1a80-4274-a3e0-9a454767c159", "comment": "Malware payload (DroidSpy)", "value": "2639c16f107c74b6d5e1415c51bf7fd2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidSpy", "colour": "#58A145", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890160, "uuid": "ab97078c-af3b-4fe8-98de-998ac4861210", "comment": "Malware payload (DroidSpy)", "value": "73a27b8b13e8ba34dd63f6e318fd37d6562a54a494591ad40e5ce3f72554ec22", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidSpy", "colour": "#58A145", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890160, "uuid": "2c68d4a9-616f-41e5-a967-cdb8baee1940", "comment": "Malware payload (DroidSpy)", "value": "26d3916e998e4823f04ddf2d4db98b1dbb22d2d1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidSpy", "colour": "#58A145", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890160, "uuid": "3ede02bf-e828-4734-984d-4f35202b074c", "comment": "Malware payload (DroidSpy)", "value": "43ffedcd2139e215023ed8131bcdb93465c97020e8ec16b0aed65e25643c27d2bafb6e7ebf7f92ebedf7a6a9e7163633", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidSpy", "colour": "#58A145", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890160, "uuid": "50b8bc71-0c4d-46d9-9ca2-655d6ba3c7c5", "value": "T1B335E086A349A427CC73C83A4AFE4B6B97458C504957E31719A1B61C8EFFAC04E94FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890160, "uuid": "b368b445-06a8-4aca-aa56-feb34fd9c61b", "value": "24576:GD28+F9QnIUfzBBNtCYoegH7LyLjOXqcUZfnl3aGzn9XX:GS8RnIUf9BTCYoZFacYfLzn9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705890160, "uuid": "0c3883fd-a2f5-4496-aab1-74c9741cb6ef", "value": 1098195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705890160, "uuid": "8425380d-8862-4f68-b743-97032e5fdec6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890160, "uuid": "d7912daa-25f2-43a6-bfec-f6c7c5060ad1", "value": "Ultra.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bfa685-b967-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705956453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956453, "uuid": "628a37e3-0605-46a7-9ec9-b7d4bcdb96ad", "comment": "Malware payload", "value": "d67fff4c20ad2a48ae853d2a3b1005c1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956453, "uuid": "eba46ece-9f2c-43e7-b0d6-b8795f179773", "comment": "Malware payload", "value": "73f07fddafeb8be4938a1e7323aa17db0ab2375bbc5f6af1dd585ae8feb8e28f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956453, "uuid": "bdab5903-a337-4c58-9a03-6072ad1125c3", "comment": "Malware payload", "value": "b83ffe7c9fc98f1cb04a900d5ee1a50e1528a3b4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956453, "uuid": "a03330be-813d-4c95-b732-4afd7e9b371a", "comment": "Malware payload", "value": "6ca672ff021e1c0c2f5f468901a6417f1f7cb40e66857fa238cd1bd4be47ca50e9017b129a6f6ecd6c51c6b3fe6bf067", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705956453, "uuid": "a8047585-9b2f-441f-bdc2-c1a3eb2687c0", "value": "T16FD633C07CC73907DB68DCF677D1CAEE6C2A1859347999C1AEB446C1B282BA33742563", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705956453, "uuid": "5c1ef66a-4de8-48cb-a9ac-9ca04d80b5af", "value": "196608:l2p5Plow8yAyZYVTSB87kbV1Hp2pxJBYYZ0J39gx1ovfsSKIWCHVDzbYF:APlf9ADSB6647d0J39gxmvfACHVDzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705956453, "uuid": "edc02bcf-2fce-4b34-9e54-e02533af001d", "value": 12968377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705956453, "uuid": "19726555-dffa-4d4d-a037-22c65b448d5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705956453, "uuid": "f7392d92-cb65-451c-bb62-f3a1cd7fe843", "value": "VespyGrabber.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5988cfa2-b929-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705929774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929774, "uuid": "19cfc203-cf92-44c0-a6ea-0760328f3af7", "comment": "Malware payload (AgentTesla)", "value": "a6493518030fe79b5ad85ead54d34ee2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929774, "uuid": "20f02cad-27de-434d-a773-5d93614468d4", "comment": "Malware payload (AgentTesla)", "value": "742acec0823bfaba32387206e5b3734689706e7012c4117390e7cfd059079bd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929774, "uuid": "910e369b-409f-48f2-bda4-361a0b32259d", "comment": "Malware payload (AgentTesla)", "value": "fb8d15ca2473ab4a4777a194543ac59a4d7843b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929774, "uuid": "c8ea3b65-0b42-4447-84b5-201a4350f2b8", "comment": "Malware payload (AgentTesla)", "value": "8c4cc309b30820d79fa401559f5794ebbcdeead5d80434aeaa2f804409282e0b57f49cd2ca5d85abb64e72e560a83382", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929774, "uuid": "b4d76fb0-c6b5-40b3-a652-3a2f9877bfa5", "value": "T11E05F008AF938219DAD0B6F448A1D59963727FCA55F3C6087A9C3099DF23B0FD980776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929774, "uuid": "934357ab-ff4a-422f-bd89-0ca0aa69d01c", "value": "12288:Idt9M+61GBQyUgXmNgjThH8j/RGPiObez+k57BrhJaMSmAaNk6:Idt9HIGjFeRqiDz+WBdJd9AaNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705929774, "uuid": "0bfa42af-fe17-4cae-a022-98077fac907a", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705929774, "uuid": "2cba2764-447f-4aaf-aafe-fd3d523a814d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929774, "uuid": "97a909c4-48af-46ae-9984-164613301c14", "value": "nORDINE 01-005919_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82881ae6-b8de-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705897630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897630, "uuid": "9bebcc60-3b71-4e05-b6ea-face2eb230e9", "comment": "Malware payload (Smoke Loader)", "value": "f73e509c71abc1b5c789834510e117c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897630, "uuid": "edb59533-f003-49a6-8b3f-fc56af7a73d4", "comment": "Malware payload (Smoke Loader)", "value": "75bcc7144c36d2931b31364db4d3b3fc44b1ad803790ea1077f228efc715bb6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897630, "uuid": "62dda6e7-50ee-4771-afe9-28eeb6289ff8", "comment": "Malware payload (Smoke Loader)", "value": "de658fac7257ed1c10b11c1b96cee672ddb41277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897630, "uuid": "77990378-81f9-483e-bca5-ad3b504c988f", "comment": "Malware payload (Smoke Loader)", "value": "6ea48de3b0de424d6869877d81c51072c725c269e6afa6bc6d8d817754562f01bc6d0cc47433ec25bccc68ad036e208a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897630, "uuid": "20d6b349-48ee-4e47-b1b7-c2a96100b3eb", "value": "T13F246C203AF98031E3F756304A70D7A50EBB78937A7156BE0A97137DEF346928A60717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897630, "uuid": "b24f3464-7a88-40e6-b2ee-b1e3c3af1dd4", "value": "78228cc34ce8e71519a98f0987233e7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897630, "uuid": "1d13f46e-29d3-4ba8-b9da-80bd78f44358", "value": "3072:/VAVkKKz6bqDShp/wnMBy7twMMZ5IQbt6POZ5GhdAhgMXEfpF:/V123pj6yNt6UGH4gMXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897630, "uuid": "07e72ae5-7c96-436d-a159-5fb57b75f7e7", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897630, "uuid": "2500d8d7-63ca-485a-867b-806518c0e3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897630, "uuid": "c8ea6830-e2c1-4f7b-a7e1-53958ffc2bae", "value": "toolspub1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b726310-b900-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705912248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912248, "uuid": "8a5bccdb-c7a4-4356-b854-5038a929a183", "comment": "Malware payload (QuasarRAT)", "value": "dc98281c3cb10d3bb8d095d14dc0f437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912248, "uuid": "145d4e83-acb4-4ea1-9e07-d24719130e8d", "comment": "Malware payload (QuasarRAT)", "value": "76079fc2459713c786108c1543f5fe1eb33f8dcc3500ab5a575a4807c9cf7dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912248, "uuid": "caff2ffb-6f09-4b5d-b634-eb824e708f8f", "comment": "Malware payload (QuasarRAT)", "value": "5692a08cb97cacfd65bb0907a6ba53b947c19537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912248, "uuid": "6fbea503-2b65-4860-a07e-6145ba108a0d", "comment": "Malware payload (QuasarRAT)", "value": "012a18f731bde9f6d990ebf3fd9cf7db256c19fcb943f07f12fbbd7a6e6ab000a2f1f2e4535c6d664eb94c3de20adcd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912248, "uuid": "244ff864-f10e-445d-a387-08f166a21554", "value": "T153E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912248, "uuid": "c7cf0048-599e-419f-9477-769c400822a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912248, "uuid": "baebb795-e7ee-4179-b6dd-e3fda6b9aad3", "value": "49152:mvGI22SsaNYfdPBldt698dBcjH7kRJ60bR3LoGdcqTHHB72eh2NT:mvL22SsaNYfdPBldt6+dBcjH7kRJ6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912248, "uuid": "e88b6deb-4955-44f1-9721-3ed1e5b167cf", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912248, "uuid": "6c663b3c-94de-427f-8acd-ecbc2d5ee4f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912248, "uuid": "88274959-e922-4e15-bf75-6f4b9b82ea35", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dace5220-b961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705954042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954042, "uuid": "6bbcaac8-2b97-4806-aa28-9efb6fd76cf5", "comment": "Malware payload (njrat)", "value": "75e7abbc617cf3dbcb68b2bd43d03115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954042, "uuid": "20af1fd6-2841-4e3e-8d93-f12c0c6a8161", "comment": "Malware payload (njrat)", "value": "77467ced122704b311807b5da3c575217a903e2434bf04c47c0ebf00c19ae474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954042, "uuid": "c10a25e1-14d7-498a-8114-6e5331debcd5", "comment": "Malware payload (njrat)", "value": "182af2e118f11a3a50bc3eec4deb70b22e4faed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954042, "uuid": "bdb1d679-5a05-4dc3-849c-daada63f30dc", "comment": "Malware payload (njrat)", "value": "e937f6d65d5e2c929dd32cb209af03bf84e0ef9a3b53fec555746b1105913daeec8d0726d0d1fa149d1479fd9cdaeffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954042, "uuid": "75979586-343c-4542-868c-092050f224e2", "value": "T117F21A5D3FA18162C5EF2B744AA2D72102B2D1075A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954042, "uuid": "21f4e747-b9ca-461f-a5d0-45130b2f894b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954042, "uuid": "fe42016e-9c43-4075-a4b3-45d5361da91f", "value": "384:CLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LUbOyvGj:cizrecPEZeK45SssIvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705954042, "uuid": "f237ee2d-8c4c-4c72-97a6-4bd49d94f068", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705954042, "uuid": "fa5d94fc-7c1f-44ea-be23-0fad5d15dc0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954042, "uuid": "163ba9c6-64b4-450e-a5b1-42517d9e0d79", "value": "bTfk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762e6b6d-b959-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705950438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950438, "uuid": "55c7b13f-1824-4281-b7bb-cd20a17c2335", "comment": "Malware payload", "value": "42d7e743797608f3ddeab80cca8451c9", "object_relation": "md5", "Tag": [ { "name": "1111", "colour": "#D9EE85", "exportable": true, "hide_tag": false }, { "name": "23012402", "colour": "#2CCF25", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950438, "uuid": "0aeed60b-b3ab-4a44-9c96-b07bb50817ec", "comment": "Malware payload", "value": "79a250df58822ab3e3e96d6f276524078cf35d873c15ca24d931fbde4e72c801", "object_relation": "sha256", "Tag": [ { "name": "1111", "colour": "#D9EE85", "exportable": true, "hide_tag": false }, { "name": "23012402", "colour": "#2CCF25", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950438, "uuid": "d6384eb9-4cfc-457e-a0b5-f3ad4574b6c9", "comment": "Malware payload", "value": "6ac81c9c232a925b3e7ce9f834c9e8dccef3774a", "object_relation": "sha1", "Tag": [ { "name": "1111", "colour": "#D9EE85", "exportable": true, "hide_tag": false }, { "name": "23012402", "colour": "#2CCF25", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950438, "uuid": "a85b1dd5-c90b-4bcb-92eb-1d15baac1cef", "comment": "Malware payload", "value": "1cf322880b627be171f2d6cf6d2e34b652cc1d82752e5046151bf4d5793005b612705f35311cb1edae0e014c879e399b", "object_relation": "sha3-384", "Tag": [ { "name": "1111", "colour": "#D9EE85", "exportable": true, "hide_tag": false }, { "name": "23012402", "colour": "#2CCF25", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950438, "uuid": "05cc5f13-3c2a-4afd-bed4-71157a14ddd9", "value": "T13ED633B27B45B1D7144D624272A202DC7E32DEAABB4A7A7C7C8531268CED750BD4C3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950438, "uuid": "bf780fa8-98e3-48a7-a590-a11794fd46e1", "value": "393216:n9aPAxQJ4qjTi5E7SRlQvEael23qbMhz2:9aYcx29Risa821C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950438, "uuid": "ade35b7f-5e70-4fe9-a0c9-592107e172c8", "value": 13612177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950438, "uuid": "2d149c5b-06a0-4e16-bf82-735d3129d8fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950438, "uuid": "16a3c82b-dabb-4d5b-b8a8-8506f55b5a60", "value": "Apply___23012402__Passw0rdsz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da184272-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705917104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917104, "uuid": "7de85393-f842-4807-8066-dff1d84544e2", "comment": "Malware payload (Formbook)", "value": "0016f351a1b6d698ccfcb74757a28cca", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917104, "uuid": "b6de85cb-3f06-40af-93b4-3940dcb51263", "comment": "Malware payload (Formbook)", "value": "79ac3fe2128c0112a909595d7fba42fbe1b98511527c39fc43b0041e53165292", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917104, "uuid": "4102a6ed-f2dc-4c64-b417-c3be1d97832c", "comment": "Malware payload (Formbook)", "value": "4037ce0f3c5fc2dd1d7380b93e7ad3b8645c4d20", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917104, "uuid": "fc12c211-42c3-4f57-a8a7-ec972add94a8", "comment": "Malware payload (Formbook)", "value": "60f7891d39a0cc2168713a972c5ac1031cdf43a41445495f16ac5cb92102fb6054af441d8700917bb9db00fe89b364a5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917104, "uuid": "824c5ba7-14e1-4935-8f40-e6725a3f3c3c", "value": "T1F9C41210368DDD5EE28356F9ADA1B48F900CBD7236D1A5CB6E98B30E05B7FA38917502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917104, "uuid": "5498deb2-9cbd-4aaa-bddb-6390be7b9025", "value": "12288:nasqZWQmmme6v3QLQuEhQpozwjTqCfgpYsAQ3FvjfSmaj/w:yWQmmav30xiWWCfg7RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917104, "uuid": "e012eac4-a698-423b-9ee4-ad0645224bba", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917104, "uuid": "335b7c15-688f-499d-8bf5-04046b5f1448", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917104, "uuid": "d92a2a5c-c57e-4bd3-b8b1-3de0b6db4d88", "value": "PO_88874637463836483.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4217e9a0-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1705916849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916849, "uuid": "3b1e0d85-10b8-43a8-b5fc-412cff7db4cf", "comment": "Malware payload (DBatLoader)", "value": "e16d9f6939ca70a5f5e6f931e441cd0b", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916849, "uuid": "dc2cd859-c14f-4447-8506-f6b1f8d70ff6", "comment": "Malware payload (DBatLoader)", "value": "7a1d7fbf822fa236aa166c6c6e58160a7b793715a6305c57fba1a44464f4e65b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916849, "uuid": "59ae3ac1-93ce-463d-bfea-d7a45510c3ab", "comment": "Malware payload (DBatLoader)", "value": "f817958f3d190b036dbcefde3bf408f014df0bb9", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916849, "uuid": "b52c219c-a074-4119-923b-2139f4f93d2e", "comment": "Malware payload (DBatLoader)", "value": "7b0a495f0cd4e27d4b742c8a24277152096c95a3c59a97d0efd15442713ef6622110805ddcdca62ed64b26bb0a95db2e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916849, "uuid": "ee812ac4-79a0-4c6e-9de7-d4530e350eed", "value": "T137D5BE015F7CB872FCD5C936CE677364AB653E31AD60899232A978DC9D76E8D702C022", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916849, "uuid": "c78a7209-9d4f-4dd5-85c7-7fa0b76f7eab", "value": "02e3ebe88b2a6296bb4b034e0bd03814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916849, "uuid": "98d71ccb-2625-4027-9ecc-becbe7c27925", "value": "49152:xDWu2Avcfk5wAQaEOsA7M0enZFhZrABL:xyu9uFJ0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916849, "uuid": "f59b5eea-e586-4a74-af63-5b694729b601", "value": 2774528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916849, "uuid": "1dac8b28-8b94-4773-86ce-302dfd1e78d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916849, "uuid": "5d5f80b9-a3e8-4bf4-840d-110bdc795bb1", "value": "3002918291829182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebb0728-b909-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705916173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916173, "uuid": "8e2978b1-be83-4295-bdd5-6bea4c336650", "comment": "Malware payload (Mirai)", "value": "900245941e43a1a9a58694706f0548cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916173, "uuid": "dc0134ab-2084-4f77-a7e9-61cd881188f1", "comment": "Malware payload (Mirai)", "value": "7e168e3e15fe743f7a38fee0da7f4efce2bf13836fa51dac2f5091f504707176", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916173, "uuid": "ce95759e-aa5f-4765-8d85-eb4a24455b0c", "comment": "Malware payload (Mirai)", "value": "c115e319b551498153bde49ff28ec2b408d15698", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916173, "uuid": "278e87aa-befd-4d64-8345-269f6aa17cb9", "comment": "Malware payload (Mirai)", "value": "71efff1a1919b6a1a7a29b2556bfa9786f56472587a2f085db8abd57601e1fcad1855d013a50f716d1cd7fd35493b187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916173, "uuid": "436baaff-51bc-4cc1-bd5f-09721f766018", "value": "T17D63189678C19A12C6E423BBF96E01CD332563A8D2DF321B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916173, "uuid": "eef5e432-9b7e-4657-9f78-79ad5b388634", "value": "1536:E69UvD15uu1q7+pIVF5fiJZyqpRTw7tmcahWMUql4g5f9/e35mE35:E6+ZlRgtmvhTUgy3f3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916173, "uuid": "612ef407-a708-4934-8900-076e83d07d11", "value": 72196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916173, "uuid": "8365e2b9-0068-4d36-acae-ba9ea5908f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916173, "uuid": "9a93f263-a95e-4c6d-ba41-6228251ab6ab", "value": "900245941e43a1a9a58694706f0548cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d78079d-b8d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705894427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894427, "uuid": "46ad7b62-dfea-4d2c-8690-e4fa2cc96aa9", "comment": "Malware payload", "value": "a107d180560efd8f0e5a1dd2af8d7de1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894427, "uuid": "5129c251-122d-4f95-ad54-850852cb320b", "comment": "Malware payload", "value": "7e8ac43b243da809b7589976adb4f33906e6ce094fd78b61e8d79453fb4b36ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894427, "uuid": "c964d01c-c199-4509-8355-add28a12b176", "comment": "Malware payload", "value": "ecbb60873933051ea767e50db7b940056e951170", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894427, "uuid": "90054521-cb0c-4a11-ad84-08a622b9e791", "comment": "Malware payload", "value": "4ddf438d0347109bf482daac3312f302fa24e3b26a48fe0201fd2dbe36399ffe87f3df9cc2cf7fb2b01d2bc3de4dc31b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894427, "uuid": "50ad0bff-c385-48ef-bc69-26063289e385", "value": "T125B38C217660C832D0DB253D586AC7725A7FB83197B854CBF7A40ABD5FB02D06E3934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894427, "uuid": "2bcf06c0-8b9e-4fe5-a046-7689ecf8ba86", "value": "9a3792aff0565a5387303270c11c4e6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894427, "uuid": "ef2d8ac7-6016-4930-bb04-ce869cb80b87", "value": "1536:pLzXF9S71HAfYoMv/BfPqSynD4cz/s6oN+BeOnEtKX6tkyn05K8GYX5zg:9bF471RPqSynEczkUfEtMtXX5zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705894427, "uuid": "52b90f56-a6bf-449d-894f-892eb8d0bb00", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705894427, "uuid": "b659cc7e-c130-4522-bb21-88a983fb18d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894427, "uuid": "e26af927-66c1-467c-88af-b7c7278cc31c", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16979.32761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea4726d-b8e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705901972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901972, "uuid": "29377dca-2791-4390-bf65-edd88370d2c2", "comment": "Malware payload", "value": "c49490eda6028f4169eba29b9e3ad3bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901972, "uuid": "391d7ddc-5d6f-4db5-a4ee-27dd7965026d", "comment": "Malware payload", "value": "7f16fb59fb0bd2bc31b1db1387281b7f38608101fe7dc210b3479c7b54ddecf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901972, "uuid": "c2992f2e-351b-41ab-9f7d-e0f9bf573541", "comment": "Malware payload", "value": "73e13987aa43a458e651dc7ab906c99ae35b1a5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901972, "uuid": "6c3c8b2f-e75c-4727-ba6b-6fa33c89ef4a", "comment": "Malware payload", "value": "76207b260bf5432e0ff3ae7f216d24cfdf2683fada4b1d93a4ffacd19fbe28d15d7410f4d566b10c1967c578574c34d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901972, "uuid": "c7a8110b-e902-4af6-a4f2-08e3c1daf223", "value": "T1ABC4935F9D0BC5F4F2AE2EF29CEBDD481159AD6463145EAFD33022BA0E07601652A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901972, "uuid": "8de6339d-5e05-4f51-9b08-45d97ddd0972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901972, "uuid": "3cf0a0e5-02b6-463a-ad41-780554b4bee3", "value": "12288:WHKr5L/TITKIPrePMfklXWyz/U+n8KfW0KtCetnnkHn0cQx9jFiIEk95NkttyfW:yKNTaePuyzPnlWk0lRk4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705901972, "uuid": "283331b7-2a36-4f13-9903-c0b29d09c507", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705901972, "uuid": "6d06ff32-6bed-4d6a-a91a-7bb3734c6855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901972, "uuid": "d4594746-f94d-45fd-b857-8a235343c512", "value": "c49490eda6028f4169eba29b9e3ad3bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35f8165-b8bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705884451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884451, "uuid": "07decb07-acfb-4830-9031-5a422b2e336d", "comment": "Malware payload", "value": "f72a9d8f15b5de6debaeb15837ccc168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884451, "uuid": "74a2270a-6c40-47bb-96f8-a88dd1495c07", "comment": "Malware payload", "value": "7f77c8e94aaf8e5da9977104c0a6e5a36b6d1af4172e3fc38f39877c15b5654e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884451, "uuid": "fcc8d086-d83f-4870-856a-761900287736", "comment": "Malware payload", "value": "b49c2a5972d303cfee1db3545bf5c8887bdae35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705884451, "uuid": "58558b92-b8de-4707-99f9-24d52dca09e2", "comment": "Malware payload", "value": "3da4eaa1ff52c613224920a005de6b8309d57ac2f40fd7a2d176533511fe7e5dcd7ed9be5d47bd7d9e396851eafb5239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705884451, "uuid": "b432013d-053d-4b1e-94cf-ffd917670ef5", "value": "T1FC533C04B387A761C7694AB5C0E3E51503F2A75B26B3DA5E7DC412C54E12BD2CE83BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705884451, "uuid": "6da99387-4a78-45b0-b49a-5837c5edf533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705884451, "uuid": "019aae6c-a8b0-4e28-ac1f-73de1be8c532", "value": "768:WvOW+CB0bVvkKJ0x36B6MbnpcUtgGTZvAlZxvRw0f8xwpsbr7mul4tfIHY94Qq2C:gKvS+sdZiyiUKm8kS+DcJyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705884451, "uuid": "c3de6841-58b4-476c-b448-229e22341773", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705884451, "uuid": "bf8625f3-1511-4ae3-b48d-799c815b8a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705884451, "uuid": "3dcfd9ca-cdde-4b11-b047-4599263b79cc", "value": "SecuriteInfo.com.Win32.WiperX-gen.1696.8619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb85a4d3-b952-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705947655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947655, "uuid": "7069c9c6-1369-46db-806b-8e06b3d22b16", "comment": "Malware payload", "value": "ebd6f7a6cb7aa2c1f16389618828dd18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947655, "uuid": "77885538-fe03-424c-bbc2-f9347e41d1ce", "comment": "Malware payload", "value": "80b7f795cac71ff494d915f171bca9feca53cf6d9c6d5b87b2c773ea8266403e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947655, "uuid": "3ee2c4eb-afed-4b86-adb1-10ba653cd961", "comment": "Malware payload", "value": "6f0ab3eae5a5c4ed3383ac48a4ac067294c87728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947655, "uuid": "ef138353-3bec-4f4e-9586-01d023638112", "comment": "Malware payload", "value": "45f3b15db49cef7ce88ba6a6970926be5b710c8a39bb710b22c75b7e6149a2c3b629dda939a1b575883837c18725f4ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947655, "uuid": "6996be26-2b20-4662-b7e7-b051e46ef24e", "value": "T16FD48CA125934CBDEC829E713E24E40F953FD47FF8A58FE47A02B2A85D52C909A54FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947655, "uuid": "ab5a33e2-dc52-4616-b10f-1a1d288aef49", "value": "06eb4d13e1bb2dcafbe526f4a64db1ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947655, "uuid": "48791117-57b2-409c-ba80-171d10e8bd3a", "value": "12288:JCSDOO8L2MZgq1c3MYUH0aQMjrthsADyAEFFndjiHKRPpQHPVFHMoq:JCNa4gCYW0hcrgL3nRzVkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705947655, "uuid": "44b948f1-2734-41f0-ac9c-5f7406b48af4", "value": 597657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705947655, "uuid": "904092fd-0f2a-4ec5-920a-660ee0e2043e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947655, "uuid": "b17a491e-3b1f-4495-aaff-d68da50f2f6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d186e4-b92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705932313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932313, "uuid": "00de6334-e202-4089-9f43-6637d611ef9b", "comment": "Malware payload (AgentTesla)", "value": "7c2601e83099eb52de258a9d02001d47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932313, "uuid": "627105c7-cd4b-4449-b0d8-d7e20b91c845", "comment": "Malware payload (AgentTesla)", "value": "81e7f10e3da2b0ae2e6785fa2126c3e76c3d11007ded45f88fd08390a25e7e69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932313, "uuid": "248c7ff1-0d51-4e60-a778-71e391076518", "comment": "Malware payload (AgentTesla)", "value": "ebb77457d4a60db72da49faf7418eb37c734cb6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932313, "uuid": "7f5e5700-f716-467a-9c6d-4c177cc3de84", "comment": "Malware payload (AgentTesla)", "value": "15d11f7f31a761ec26983165a5a7c4af7eeb0ffb8a0cce0874154e1b255f568523ad4165553da7a9858f3024f1733df1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932313, "uuid": "26b91411-8e54-40a3-ab5c-1df0811e4296", "value": "T1DFF40261F2282F9AD42A53F98D71B0242BBB7B9B426ED7461EF271CB14727C31206D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932313, "uuid": "17381abf-e309-4eb8-98f2-c0502beb391f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932313, "uuid": "0e14b2ac-a352-49c4-94c7-91476922b471", "value": "12288:fm1emsgjjN2iN+X6jEKOfzLbercKV4NKaLvVLHfEvXByFeEa0+c2pbKXJYnyqPH:fm8gjjN1bO73eoKVQTVL47EdWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705932313, "uuid": "03ea88a5-7082-49c5-9885-25aa569465c6", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705932313, "uuid": "5cf91368-ccf8-4844-8760-20f5587dda8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932313, "uuid": "e8de38b3-f338-4134-a711-357caeb7c3a2", "value": "103_TT_USD_7145_19_0548019437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca0168a-b957-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705949724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949724, "uuid": "8bdacf1a-4753-4332-956c-db0863dba2ec", "comment": "Malware payload", "value": "23465ae32813e08cc54fe71ca79f7f60", "object_relation": "md5", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949724, "uuid": "77d67a69-3245-4109-845b-c978a67491f3", "comment": "Malware payload", "value": "82ad9db1b6ccdf6f85bdc034fad8f512547954144f42d6ebae0ef003d9b6e2f2", "object_relation": "sha256", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949724, "uuid": "83fa33dc-76e6-4a45-979c-d751dd56ed35", "comment": "Malware payload", "value": "e49daaa783678f0c3cf26e9c1f89fa092793bc89", "object_relation": "sha1", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949724, "uuid": "9c31a245-03db-4e82-9114-b3787afd965e", "comment": "Malware payload", "value": "162e91e275072085c25722f1235138e6901072361b45059f8f39e699bca71115b7b2c3c69072e179898c44a9ad076b24", "object_relation": "sha3-384", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949724, "uuid": "567e8f15-e21d-49c4-93e9-1b860b7ff2bf", "value": "T1BCB6338A39D84F01DD0BF77E1C9AAF742BA49E244BBAC5DF6218B421D13A7BB5133414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949724, "uuid": "fd102660-0b2d-4666-bbee-21d5e8346f65", "value": "98304:7NYe6M0+DuBCWOQ/6lmbOxUS3+Ng/lKPEk3MwUxPSZ6T:7NhhXxlmbOWqKMESv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705949724, "uuid": "fcced7a1-fff4-487a-a0a2-48b27031182e", "value": 10514432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705949724, "uuid": "7d45b7e2-d5a9-49c9-a0b8-4695fd0252f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949724, "uuid": "376e3f44-b93b-4298-8728-a59fdba05ec4", "value": "82ad9db1b6ccdf6f85bdc034fad8f512547954144f42d6ebae0ef003d9b6e2f2.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f6bbd1-b962-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705954122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954122, "uuid": "fde2d927-a6d5-4696-9c47-02d9c5e80b3a", "comment": "Malware payload (RemcosRAT)", "value": "d2db828942b57a1d8b75297e3f493ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954122, "uuid": "fce03983-2aa3-4faf-8144-782640a0c84e", "comment": "Malware payload (RemcosRAT)", "value": "82c88b986554a1a6d92da142508fc764872d62f70770903d406a32b6b19ef9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954122, "uuid": "a2f93a31-02ff-4cec-8c84-55e0d9a3b033", "comment": "Malware payload (RemcosRAT)", "value": "ced1bae10b6c0129dc66d39be471f4cbc203c118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705954122, "uuid": "92862f95-0da2-4b40-979e-1e5577a9b5cc", "comment": "Malware payload (RemcosRAT)", "value": "b2db5ef544c0335c3ce0ad8abe3f5cd83b124e8e55fd695260aca95a2110be8e24417d8e3444683ac9dc90dcfc7ab967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954122, "uuid": "adb190c0-86e9-40c0-8016-118f173eb186", "value": "T15925BEAC7650B5EFC827CD768AA82CA4EA1074BB930BD203902715ADDE4D997CF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954122, "uuid": "83baac25-932e-4802-97d8-4023a09ce073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954122, "uuid": "34bde559-5416-42ca-ac09-4cab9ff89242", "value": "24576:61WrlW/jEz79gKyKssByl+gNzETBDNuHtCHP:61Mw4zlyl+gNzETSHt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705954122, "uuid": "459da08a-6c02-4b29-a461-2f0f66beda40", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705954122, "uuid": "51bcf62a-29f1-49dd-84cb-c9a5221a372e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705954122, "uuid": "91c2dd48-e7a4-43d7-8631-db9d5addad57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4839d80-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948073, "uuid": "e77c1541-c834-42cc-9c8b-1ad457e13873", "comment": "Malware payload", "value": "13f377dd0e67abcdb266bc2433bccaca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948073, "uuid": "59aa2991-d8d3-4f10-bc8a-ba2ace7efc2d", "comment": "Malware payload", "value": "8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948073, "uuid": "c1370e7d-b70c-4994-9f6d-c37b105c924f", "comment": "Malware payload", "value": "ffeb81b2270cabd47a30719c2c6b6a824878925f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948073, "uuid": "d12ea5a3-e01b-4bc4-9028-098f4fecb5ac", "comment": "Malware payload", "value": "da001cc6eefc62c03af83c86d645d2ecf1cbe3bf2a435ce9d37a230a0179b345df8ed1a377c4f8707baafc3de1699a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948073, "uuid": "79b8dcbd-03c8-44cf-8c89-857ab261d3d9", "value": "T14185339657E09879D2611E3148FFF9343A37CD414827F7EBBB784F3120A2597AE2A814", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948073, "uuid": "38cf09db-294f-41d1-b722-e31e4166d6eb", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948073, "uuid": "29aad3b3-ecd7-4dd6-b2b2-4a7e037e43cc", "value": "49152:Pc/OpzSXnBOxfAnyv3TnYZVKVC6mE8vN41AboWe:U/iinBOxGIcVjv0AbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948073, "uuid": "3ed9b0fe-8aec-4807-8d17-fb757ab49d8d", "value": 1759099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948073, "uuid": "4285dea0-9927-4a35-917d-d50d2869b8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948073, "uuid": "39890d36-1a24-481b-a795-3ffde8fd1060", "value": "SecuriteInfo.com.FileRepMalware.12587.20006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b228833-b922-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705926797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926797, "uuid": "1bec35d8-5504-4b97-a4ff-fa138054d6e9", "comment": "Malware payload", "value": "3137bbf88d80a164b35def3024ef152a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926797, "uuid": "3a06d773-f1d4-4bc2-9fdc-5a203230bc01", "comment": "Malware payload", "value": "83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926797, "uuid": "aa615114-3a6b-455b-8a8d-5ae0a29284fe", "comment": "Malware payload", "value": "c0bab2f371cdcd7bd53fd1cff6cadcd3505c4fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926797, "uuid": "cf8882c6-face-467b-a856-ba0f203aef41", "comment": "Malware payload", "value": "c84ad0e3baada4e0bdf8f6f761be57676a35f0e56fe79727944b71cba474476d47ac667c3e07f48b653dee80eb7af0c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926797, "uuid": "7ed412b3-96ba-4f6e-8de9-e6d8ccf30bae", "value": "T18F0612FDED039F67CC4CF9B482398475779068410D18116EA185F6EAA7B32A3D7B234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926797, "uuid": "971e1cdd-fd7e-4d3d-b855-526280b7bea3", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926797, "uuid": "68c73472-51c4-4b39-a33c-f8f696e1f3dc", "value": "98304:uHLi/kJwZwPb9L/0rQq98ZU+LsXCKqRkMccz2938N:XYwgVqWjwCKibB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705926797, "uuid": "122865bd-d0fe-44c4-a686-4e2e1c0f6363", "value": 3884096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705926797, "uuid": "a53bce0b-7cfd-4c6a-a0ed-df7eea90b624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926797, "uuid": "7cc7e2ff-0d05-47df-9230-776fad9655d2", "value": "SecuriteInfo.com.Program.Unwanted.4468.24384.5290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc0e951-b8e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705901679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901679, "uuid": "ef98f1f6-736c-4253-9e20-bd748f5de959", "comment": "Malware payload (Socks5Systemz)", "value": "4508ccd3d34ec49e4b4d862af246a0d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901679, "uuid": "988a9c47-7903-4331-a652-1215416bd7b7", "comment": "Malware payload (Socks5Systemz)", "value": "83d85859a5c64caf407816eeea421be327483de6798ae2cdcf0fa87713afe5e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901679, "uuid": "b586d705-72c2-4bf3-a2b6-69ae1cc9fa69", "comment": "Malware payload (Socks5Systemz)", "value": "dfe24a11810fad66d142338f0d05586f95e99ae9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901679, "uuid": "84355f64-eeff-441a-a4b5-5001f90664cd", "comment": "Malware payload (Socks5Systemz)", "value": "e85e625a93c3aadc2ece07ed0795da73050ea296903c46c422bd61eeddd544ded962704554dce3cc0a52971c2840d0f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901679, "uuid": "a3f9bd4e-69ab-468a-92fe-9e4a922dbc06", "value": "T16B163305FF448636D2508738BCE23315AB21FC4DA633570A395BA6DE1D6A3E60DB63D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901679, "uuid": "e69c3436-a65c-4a90-a50c-8444c1f78e12", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901679, "uuid": "9dd1b9c9-7640-46ec-b8ca-d896fc7f2cc2", "value": "98304:6uI3d9Kc04huUK0+BUVA/QEwgn8COmkPbTYcJRqod358:C9ZXhu5XBUVKXLkgc/lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705901679, "uuid": "56f17c0c-810a-49a5-947b-f9af5d60cb19", "value": 4208346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705901679, "uuid": "cdcb5904-f9dc-414c-86bd-a63dfb134e27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901679, "uuid": "b822c5b0-f0c6-4a36-a726-a9a26b735323", "value": "4508ccd3d34ec49e4b4d862af246a0d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1a2ad9-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705917484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917484, "uuid": "3212af4c-666d-4c9a-9cdc-c5fb07099ced", "comment": "Malware payload (AgentTesla)", "value": "4412e29e56ed28ec47ce977eb6be9b75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917484, "uuid": "e5040df2-268c-4673-b718-a4cc5b8ac559", "comment": "Malware payload (AgentTesla)", "value": "83efcd7bdc166e214a95995e1004c2a575f58b4324947ca586c0f959751e61c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917484, "uuid": "a4b34100-ca82-41f9-878d-6ca7e1066a8e", "comment": "Malware payload (AgentTesla)", "value": "770ea1ebf351cfcdb595a0cc9d7f5791adf5297b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917484, "uuid": "32a0ab51-e3f3-471c-bc47-dc0ab2e94765", "comment": "Malware payload (AgentTesla)", "value": "5a392619f85e1dfa6bce5261a9f04295dac770982feccb468ea67bcfb6ea4e9df2347a15f1559d593bb39a137df2c157", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917484, "uuid": "65dd07ea-3c83-4395-99cb-e0f43957fe27", "value": "T14CD41293327D6FA3D6B583F89D3265964779796F6E40FB884DC620CB4024F0A9C42E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917484, "uuid": "f0659cd5-5320-46d2-8ab3-c2fb6f1c49b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917484, "uuid": "15e59e01-7a9c-48a0-bd86-4130e1c11a09", "value": "12288:8tIj+wcXRH+UBHY6CJ26tW9YoEOnneQaOrY6CfnhQtD6k2lY2aAKBX/CD:eI3MBHIJtaYhO+eY6s8WXlYjA6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917484, "uuid": "6b41f51d-2b46-4c5d-83ce-55309d9f5976", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917484, "uuid": "7fe37b44-544d-49ff-a7c8-c4e15b4ac7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917484, "uuid": "0fa48c26-93bd-44cb-b483-f6127463d27c", "value": "DHL Receipt_AWB#62698098713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c11e12-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705910443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910443, "uuid": "5da36d7a-d216-4c44-bf40-b9fa7ca99df3", "comment": "Malware payload (AgentTesla)", "value": "f9e5bd7487180b2ce758733aad86040b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910443, "uuid": "536af076-28f9-4d98-a951-ae67d905eed0", "comment": "Malware payload (AgentTesla)", "value": "8450b093f12a16ae8beef65c25855f746157881351aba20be881dec58bfde7aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910443, "uuid": "f1b02ca2-03c2-4db7-bf25-662c109045d3", "comment": "Malware payload (AgentTesla)", "value": "2ddc5b8d22e0f705cdc5502a3b840aa233fee3d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910443, "uuid": "f1f9b40b-b9e9-4b61-9a6f-16765c0ecdec", "comment": "Malware payload (AgentTesla)", "value": "935450e482c5cfba2956f022a07a2c881857d3309369cb35da70b708eecc52491e2caaa80c529c079bbddca2a9e932c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910443, "uuid": "822dcfe8-f308-4646-bd83-d94b6bec22af", "value": "T149759E53B68491A1FEAA8E73D70BF273063A1D764123911F53D43E767AB0873463A623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910443, "uuid": "6cc06ab0-affd-43a6-8ba7-6a9d24c50791", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910443, "uuid": "e88cc01d-2e83-41e3-a08e-08d1460a06fe", "value": "24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8af3SVkctXvDfzd8t+:rTvC/MTQYxsWR7af3tcZvjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910443, "uuid": "c3895b0c-a3c8-493c-89c7-59975d966310", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910443, "uuid": "05b4076a-d5f1-4c23-a52c-107c51609a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910443, "uuid": "3891f5f3-74da-4bf8-b1cc-f5f67b6dee34", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b66926-b95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705952041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952041, "uuid": "90c71538-af63-44b6-96ab-f9bb679452f5", "comment": "Malware payload (njrat)", "value": "d0c3e7b04033acd95ef28afbb67f88fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952041, "uuid": "8bcb6744-c765-473f-8b3d-56e1df9b48dc", "comment": "Malware payload (njrat)", "value": "846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952041, "uuid": "eae3a2ad-ea1d-45bc-867e-5005c7b23c80", "comment": "Malware payload (njrat)", "value": "c5c9d57e77969aca2e42d7b644f776be17be27fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952041, "uuid": "ec44bf84-a7a3-4789-a5a5-7cfa5d7b7d26", "comment": "Malware payload (njrat)", "value": "37bbf34f2f5d6591154fc9d6ec42bdd1ba59639e1029e6ab7216603afe359033654d90812ecdc119798a69b4010e085b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952041, "uuid": "8657ff87-173a-495c-9f80-d44d8d47d42b", "value": "T19D032A4D7FE18168D5FD067B05B2D41207BAE04B6E23D90E8EF664AA37636C18B50EF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952041, "uuid": "1591f8a9-72fd-46b4-b9ac-812e708b90c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952041, "uuid": "baa86db7-41ab-4062-abb9-abefcee4611c", "value": "384:g0SvEiTbTvpWNcZ0y8fvCv3v3cLkacJEJrAF+rMRTyN/0L+EcoinblneHQM3epz0:jS7TZ38fvCv3E1cUrM+rMRa8Nuq1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952041, "uuid": "1c54d494-1794-4c33-a078-728954f24e72", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952041, "uuid": "ed564034-f142-4e9b-a551-56c56852495f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952041, "uuid": "03671a44-fbcf-480c-8748-475d1ade6356", "value": "846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6106b9-b903-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705913515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913515, "uuid": "b9f0ee1d-5ece-4372-b34f-48c97aed9524", "comment": "Malware payload (AsyncRAT)", "value": "055537218e2e991ba08c147a9653db29", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913515, "uuid": "0296b28f-5225-4535-acff-3e34b4100d80", "comment": "Malware payload (AsyncRAT)", "value": "8497d888288f09131e497dc34b86d1456ea47e50503a4e42fa9b6a7fb8f09b61", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913515, "uuid": "13d931b8-318f-4eff-af76-037dc3cdd316", "comment": "Malware payload (AsyncRAT)", "value": "2153dfbff9ba9df405590273aa57affe1bfc60b1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913515, "uuid": "007dadcb-5695-47cd-a993-cedf6173ea0f", "comment": "Malware payload (AsyncRAT)", "value": "beefe3a035fd41fc9238d4f81e056fd622e69adf4aee72cffa84714d1fa1440be77117ca5530dad6a20177e1b6b68480", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913515, "uuid": "5b8f79d1-908b-44f2-9c15-e970a98cfc75", "value": "T1B724124CE2F74410FC97AEB64A63A2DD3A3FBF2C5A628673DD6071E135C9A500F1650A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913515, "uuid": "60c9fe9a-ce59-4e0e-93a9-58fd7ecb8bdd", "value": "3072:Sbnfignq4qIR3o3LtsHvp3E8kXaXO/wq5pGou71crTEOt5r9Sl7qgo52pLVU:Sbf7npJ3o3LSHR3E3XaXHos108+gtp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705913515, "uuid": "119149da-2dbd-4ee6-8dd8-43114e6839d4", "value": 221777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705913515, "uuid": "c1505a55-fd7c-4ba5-88a1-eda43179d4b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913515, "uuid": "9d4c5deb-c3d7-48a0-9915-23ab9f48bb22", "value": "055537218e2e991ba08c147a9653db29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a56427-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705910438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910438, "uuid": "7c4ec7b2-13bc-4ad6-87c7-e7790b1a512f", "comment": "Malware payload (AgentTesla)", "value": "5504601db07ee0f82c0ad8322bd19f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910438, "uuid": "c13e6321-ba98-4198-99df-49ed0b093ea6", "comment": "Malware payload (AgentTesla)", "value": "849a9c0d0b1958cb821fe9c52a87fdcb847d02d0d840ace32ece3af8f61b124c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910438, "uuid": "47db09e9-2974-4445-bfa1-c1653f15ef42", "comment": "Malware payload (AgentTesla)", "value": "5fd279c4be4d4851957b0b2aa286fb5d0ff73a25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910438, "uuid": "34c6b6ab-e2b1-4358-9ef3-ed72302ba430", "comment": "Malware payload (AgentTesla)", "value": "b61358ff8c973c4add85eee276845d5ec678ef296e0956402eda5dff143f92a2229269a2bc7adb843f59ecfe8282c2a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910438, "uuid": "8bafe23c-266a-454c-8154-dc5d8c6c68fa", "value": "T135F4236DA30F480595B24CE6948FCA7F3314EA11D671EA2B6293784F31BBEAB1D77050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910438, "uuid": "10c130ae-c504-4a66-a7ca-7eaba6f7a4ca", "value": "12288:M9YAleesBbhrDK7IX3pCqKcTTWwD5DD2H4ErUQA8iwqu6eyrsY7di2a:MmAleTd8qpCLcTqy1D2YErUQGwquC77G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910438, "uuid": "bdaac08c-1271-439d-b9ab-5b4ef91ee396", "value": 752768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910438, "uuid": "bd5913f0-a818-4609-91b2-b93edfe54d14", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910438, "uuid": "a1b42c07-eef1-45ce-9127-a5819fd7abe8", "value": "Request For Quotation.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e17abd-b8f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705908622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908622, "uuid": "99d74811-d274-4528-93e1-c10b3c5a7b5d", "comment": "Malware payload", "value": "323abf20e1bbc87383993420027c0b12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908622, "uuid": "6f74ff1d-c534-407f-ae4e-0079fb804523", "comment": "Malware payload", "value": "84f89aea00d98ebff31e45b1dabfa278fec42988907e44afe8dd9b624464b818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908622, "uuid": "c6fa994b-af11-4cb7-b748-a9fef8342bf8", "comment": "Malware payload", "value": "291f163d93f06c11557f91a6b496ce40b73aefb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908622, "uuid": "74942213-e89d-4fbc-b9d0-7b70037a6e13", "comment": "Malware payload", "value": "d22cb5c200d81895028b9a023b7dbab2469e9ff9a714438a17653fa576c98f0487fff3e9e8f7bd83df3269ce9105c3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908622, "uuid": "a08420a5-5ac6-4713-ab0d-88d132d70763", "value": "T1BAE67593E3FE5983DD8881BDCC5ECFB475027CE56440CAF12BA0BF7E256560698A7206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908622, "uuid": "15f65971-1940-425d-91ca-a279d20533e0", "value": "cc5428ef6e6c61797b7c1fc530aae5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908622, "uuid": "606ca78a-b3f7-4a37-a5cb-33162deff1f5", "value": "24576:hdfOanNY2H+3+3dvA52ksnnC9esdyW+Og1iLbuN7O0bM2+PC2yiojPIpsigpD6:hdfOs22H+3+zmyOg4TQrop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705908622, "uuid": "bdac1643-3d15-4d43-a9d8-ca45afa2431c", "value": 14228480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705908622, "uuid": "747f0a18-323c-4e76-9c59-3804145c5ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908622, "uuid": "313c0a54-566a-4f33-8bf9-6535bf6b64f2", "value": "SecuriteInfo.com.Trojan.DownLoader46.45829.29207.22191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3083794c-b8df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705897922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897922, "uuid": "e28e40ca-f51c-4cfb-b872-78076d8a2dc0", "comment": "Malware payload", "value": "24324fa1303e8480b615c3d0cbf90241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897922, "uuid": "85cfe346-b7d5-4737-b049-eb1c1627f7da", "comment": "Malware payload", "value": "8515498bd7ad4f9aac14ba95b1b917a54aa230a3bf114fcb8dba03df58db0ccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897922, "uuid": "386c0031-e97f-46de-a459-232a0f0ff5e0", "comment": "Malware payload", "value": "150c93330f28e421e8a2b06b48a6ff6c2106a0be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897922, "uuid": "af6de3fa-6b3c-4f63-a843-d8f0a7629c86", "comment": "Malware payload", "value": "151c41e51c384035328a80ba60d2d5745ed6185af858d8f0629ede0aa2e285d4bfade9750d42601d20591e58d45b70d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897922, "uuid": "4cde516f-dd61-41b2-9ebe-f0f5373c5bed", "value": "T11FB52317D3C98A72D28175F721639BCE5330AB46383ECB8F0E46AD08F712A876DB9455", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897922, "uuid": "b9dda781-8960-47dd-80ec-849991b18a53", "value": "5aa94c7fbfc01c9462c4d62e06efe88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897922, "uuid": "21d9ae02-4370-429c-8aa5-d308a533c3d5", "value": "49152:UktZ7o/JQexmvpIYYnONzDMk7MeXSwgK9aCB7lBgdQW4af:U+Z8iEmRIYYnONPp7ulwaC9lBg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897922, "uuid": "35aacbe4-c29b-429c-9808-132ab7fdbe31", "value": 2310592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897922, "uuid": "a29af295-e888-4026-8d3f-d6ed08637617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897922, "uuid": "20f6fb47-f404-4f23-8d61-06ffbe1f4458", "value": "SecuriteInfo.com.Riskware.2144FlashPlayer.2920.22803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d6bd7d-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911969, "uuid": "af88f759-cd32-4e21-9ae6-9fc339f1bbef", "comment": "Malware payload", "value": "bbda700ff20afa71c3e148ef492ccb70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911969, "uuid": "2f96a9a9-5be4-4c8d-a9ea-979139c7ecdb", "comment": "Malware payload", "value": "852cc35c4b21b3d1e6f2bb859176716b8a06d756050b3fc8873731cde8b584a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911969, "uuid": "e49a5dc2-5077-4a5b-aeee-92413e5ef98e", "comment": "Malware payload", "value": "6da44f5273514f5e483eb5958f599560ca3a34ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911969, "uuid": "678fc350-5fcf-438d-a89a-4b8ec0414df9", "comment": "Malware payload", "value": "866ee50a5a28e7f0f2f092a85de1b2c99a17003fab2279a9caa2b676834a52d041cd7fbca62e1ba2455d8c0a2028e92d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911969, "uuid": "094b2729-7da2-480b-bca4-a41ff8f5b501", "value": "T1D1547D1AB3A508F9E9B7917DC9454902EA72BC060370DBEF07A086575F276D0AE3F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911969, "uuid": "61e8ae55-cd5a-4a07-8f5b-3f9a133ce9c9", "value": "be5f14789af8c87bf1c70a0b098875d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911969, "uuid": "349c9261-e730-48db-bea0-4cf9ab2bd667", "value": "6144:qkl4gFezQG+MUl1vym2jDnWhwAW2ohEBAIRR0r1RrB0Ze/5:b4N9+Mw190DWhO2o0srB0Ze/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911969, "uuid": "9774aec6-bd39-49eb-8328-ebc1230ebc5e", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911969, "uuid": "95372d18-c629-4700-a39f-1ce977146a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911969, "uuid": "6757a78c-d6eb-4d8a-9c79-ba24df5e9668", "value": "SecuriteInfo.com.Win64.DropperX-gen.13530.16634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918f00f9-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705910540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910540, "uuid": "5b348753-f98e-4e40-9961-acaf7b0763bc", "comment": "Malware payload (GuLoader)", "value": "1d132af69779567a3bbcdcf28891ca89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910540, "uuid": "81176493-7e8b-4e8e-8995-1c8d540e2b28", "comment": "Malware payload (GuLoader)", "value": "86de7e5b741406e95917f3085506d45921170ea9c895546da9d94c74f66ca885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910540, "uuid": "820576ea-1cdb-499f-b6a5-28766725b51f", "comment": "Malware payload (GuLoader)", "value": "3aa927d3b7474c7927b2f75fdd84e82aaab8d10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910540, "uuid": "e113f638-6859-4719-bdbc-99ab711bb052", "comment": "Malware payload (GuLoader)", "value": "632de3ee3c323c41d4534642cd99aa36684518f5adb38660fc145a1b993893420cbdc6ac1bc9ebd3587ce40046662e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910540, "uuid": "ad3bd170-6526-4d3c-b77e-361743e78490", "value": "T1F094EF117B50E51AD5ED1A705CBFD2FE5EA4AE036960820BE6C0FF0F3C76AC1B94A215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910540, "uuid": "aaa1440c-3d9c-4c50-85cb-37b1cccb5cfa", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910540, "uuid": "eb492085-654c-4b72-a1d1-7be0e4cba39e", "value": "6144:t4t6Lsvq5WSBH/zuvlHZJbMeGdLac05UkAM3JzKgcfog6cjmSlJew:tkvqcSBHLuvx/eJac05UkAEIlQpcCoJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910540, "uuid": "f38afead-9690-4ebd-b34e-53d6c7c154c7", "value": 413616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910540, "uuid": "f08dc70f-aaa6-4fd0-a655-ae93f3f7361c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910540, "uuid": "df797045-1b79-45f5-81e0-531ef99b7551", "value": "e-dekont#65531.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c541ce2-b90d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705917645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917645, "uuid": "b7fa8a14-b8c9-4d0c-98c6-b135d947e466", "comment": "Malware payload (RedLineStealer)", "value": "447e02172860bbe1b39246221d5be799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917645, "uuid": "1d9107a1-d4cf-4089-bb84-8ea000e9e1c6", "comment": "Malware payload (RedLineStealer)", "value": "876ef03959d1baad47f678791929db40fdb82b011ade633d5ea7ba58231b2702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917645, "uuid": "35ab0801-8423-47c4-89b1-1a0c97a8ec82", "comment": "Malware payload (RedLineStealer)", "value": "2b2f6c8c4397241ebc9636d0ab2d0f102be9a59a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917645, "uuid": "e10c4df1-37c3-4143-86de-a5f8bdcc778d", "comment": "Malware payload (RedLineStealer)", "value": "72d8628aaed53b6445ac382af529184eba79a0b85b60542f1e0858806f228ca269abeb63fd66c3bf6692b2624a3db5eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917645, "uuid": "30454e7e-5e90-4ec1-89c3-9b50e9f2e158", "value": "T18345CF0273C1C062FFAB95730B5AF6114BBD6A260123E51F13A81DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917645, "uuid": "f513e996-7957-4437-9f11-bb7a8ff52d5f", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917645, "uuid": "42b3fb7c-0678-438a-81f4-992afc731044", "value": "24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aTvkCD6FlPF3er3aNHr2T:uTvC/MTQYxsWR7aTv8her3aNHr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917645, "uuid": "a92938f1-92d9-4d4e-8cd9-1480d39ffc77", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917645, "uuid": "67f3d5b8-beff-45a9-bcc5-6970c87cc283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917645, "uuid": "cfd5e4dc-cdb5-412c-9c7f-c798426ec427", "value": "M.V MELODIA VSL'S PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b6e33d-b95f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1705952984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952984, "uuid": "a8385703-e03e-4d7d-92bc-12f3952a39bd", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "81a6875a92cea12ad326dc91ae5a39b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952984, "uuid": "7dd02dec-fa88-420d-a988-bde5b473e655", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "89e6e39235a650d3808d4b74722f1588c6eb4d8f31ebc6690884f5d83afa8595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952984, "uuid": "ae8cdbcc-a2cc-4165-b01d-05cf57182f13", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "4d2e3833af34f8b8487ff08e55f8c29ed882b6e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952984, "uuid": "bfeeb301-9b3a-49cf-9a43-e9602d3664ff", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "278142f42d616272ec5d479f5ab7e95ec687fc63a39cde1a39f3e4fcd2543d62e8d0bf4af73102e1b493c7f70dbd7030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952984, "uuid": "a6e863dd-0c53-4ccf-a00d-3f4c5934cfcd", "value": "T1C1C4CF83D2A27D84F5664B768E2EC6E8371EF5504F7D77A962189A2F04B31F2C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952984, "uuid": "296b48d1-7c96-4325-a9a2-58c583111aa1", "value": "e368dc091dc26b6066442b735ec875e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952984, "uuid": "c9b1c9b6-bdad-496f-83e6-2a5c046cc6e6", "value": "6144:wb+LcwOh9OyflEln0C7d/VOv9G+gK3Kc2/44GnPDbeRDdlppsL8h2oUhbX:0+ALhgMlEdfVOv9z3s/4dQxlvsorUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952984, "uuid": "7c889cf5-5242-4577-bd26-7a1488e92d21", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952984, "uuid": "8e138cdf-34b2-4d27-b2df-122e7d7a5e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952984, "uuid": "14125e94-00ad-4aae-bf34-5f0cd4363b00", "value": "81a6875a92cea12ad326dc91ae5a39b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a973b61a-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705917452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917452, "uuid": "bb54be54-2e70-43a4-bc28-56cc41517944", "comment": "Malware payload (AgentTesla)", "value": "56088b2e9ace20407c48ec4c08dee722", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917452, "uuid": "9d0cc67d-5d4c-44cf-814a-1e3a12ee9fdd", "comment": "Malware payload (AgentTesla)", "value": "8a0f73ac3d63e9ddb022faf3e006ec433d40493dedd94b3cd5dc7a92c35f41d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917452, "uuid": "4cd60104-361d-4c10-a8b5-d9ace4bbd603", "comment": "Malware payload (AgentTesla)", "value": "fb4d288cd13ae3534149f3fb54c1421a69dd6769", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917452, "uuid": "f4134fb7-2b08-47f4-b62f-e344fc0dfa4e", "comment": "Malware payload (AgentTesla)", "value": "1f3412642fdfa419e3460792f587d65472c6625f30965b1ca2bdf91f5871bd82a731994fa50b286f719d5880ef63df5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917452, "uuid": "97c256b5-592f-46f6-997a-61c937d0df3d", "value": "T194D4126237AC6FD3D4B88BF95921247087B1BC6795A4F3945CC6B1CB4020FED6A90D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917452, "uuid": "5bd21d3e-d160-445f-988d-d861aa94adc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917452, "uuid": "a524eeb0-3e8b-4fcf-ad09-8a5d84fc739c", "value": "12288:oxoH+1gpvSaydzv718peUZBNH21qHKQZf25xyqW5yxWXh7G4IpCpaD2s20+:fXSbN7KeojI8hZf6yqNWR78OaTX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917452, "uuid": "ecd0e2d8-6d25-4b43-8379-be02a22785a4", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917452, "uuid": "ad87e3ea-23a1-4eb3-8099-24a312511886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917452, "uuid": "a43376b3-3457-4ec5-860f-12383324fc04", "value": "DHL_AWB#2055760984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88602b3-b95c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705951811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951811, "uuid": "7f56f76e-2163-4879-90a7-0717431d12e2", "comment": "Malware payload", "value": "b281bb876b1fcdaa80dcd99427a2bd9c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951811, "uuid": "57fc22d5-a899-4130-a9e7-d2a7eec46e37", "comment": "Malware payload", "value": "8a7de5f2291f1e9a2601a9e2c2f899637280d5780aeb94135d60dffb474deb40", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951811, "uuid": "49f557ea-eed8-4122-a4d4-c25394c31e9d", "comment": "Malware payload", "value": "77fd2120a9ed75b5db3a8d1ddd93cdfc8fe8b98d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951811, "uuid": "66d5c335-927c-4b22-b8b4-5fc033bf01cd", "comment": "Malware payload", "value": "d486e6302167969e5353334386ca97fcaedca81e4e6e9e7fdd54b6396da75fb1e528aff29ad0e615f6bf1f960c4563bf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951811, "uuid": "3fe4338b-e1a9-493f-b83c-83cb0af1aaad", "value": "T105A5AE417E51CA52F0151933C6EF55188BB0AC1026ABE31B7DBA377E69223937C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951811, "uuid": "a05ff6fa-a79b-46e3-a356-949eddcd2988", "value": "dbf2cb41b81f26a6ac38e2a88ee28237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951811, "uuid": "8da7b2c5-3ea3-453c-8e86-a164f19f9458", "value": "49152:8bA3YaV2w7CHLjOXspMUyCw8bJpE9cToEx:8bnW7CD6Labc9soE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705951811, "uuid": "91dec5c8-21d1-428e-ad86-88fc300a615f", "value": 2164224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705951811, "uuid": "4f55092e-70b9-4c1a-86e3-c087ddaf2bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951811, "uuid": "caf0d943-bbf4-4fee-8f55-bf2f2cfe3a69", "value": "archive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b771e8b-b8e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Nitol)", "timestamp": 1705898451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898451, "uuid": "c139f2e6-fb27-42ea-9abe-8a2b942fe906", "comment": "Malware payload (Nitol)", "value": "4373d4761e8cdd9474b87bac0906d747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898451, "uuid": "ef249322-1151-4631-ba32-668bc7175eb2", "comment": "Malware payload (Nitol)", "value": "8b2e36888fb1bd712d551fdc79b803ee2f4feec199362ea5dfa1d188a809cbb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898451, "uuid": "a572cfcf-2151-4a23-879d-757718b5301c", "comment": "Malware payload (Nitol)", "value": "1cbf700538c6f5154b5d950b99a0a14472edab16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898451, "uuid": "3e1daaaa-fe73-42b4-8398-160e0713db4f", "comment": "Malware payload (Nitol)", "value": "6d9c80f0456e9f2680023992e931926ecfd1a0256a33137e059c4c21e6a272949a4363816afbcacbaea24d87110766e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898451, "uuid": "50a34542-efaf-49f9-9789-98872ce57af7", "value": "T1C9F32A57FB530482EC4B003954033B6699E6EC32F50FDEFADB9158691CBDB58B824A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898451, "uuid": "fe2cc31c-9593-4c53-9ae8-7beb99c21913", "value": "6db8353c2b6461197c203cc61d20792e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898451, "uuid": "6d34bac7-fbcd-4100-b680-59bcd7d59f1a", "value": "384:+BdCJAKQDuuOFZyUVpULCgDb2prxVTw24I+6Al6zKyXmKDglgTlkgUH/aqbbbbJv:MdCyTDcZyUpULCgodM96eyXlOfnbbbbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705898451, "uuid": "2e27aad3-5f6e-472f-883e-fee6f772c5d3", "value": 162544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705898451, "uuid": "ac1a367e-6a94-4816-be1e-34dfe7e3aefa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898451, "uuid": "4bd1aad9-74d9-471e-8d59-d4c689a9695b", "value": "Mlhello.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83920526-b92f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705932421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932421, "uuid": "818ad9d3-45ac-44f9-babf-79c6803b68de", "comment": "Malware payload (AgentTesla)", "value": "67264514f7afbb2ec180dc94a14194a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932421, "uuid": "7b118a5d-de14-447e-8ab8-94833eaee323", "comment": "Malware payload (AgentTesla)", "value": "8b44d22c62f8f7f749ed63a3ae1ea5068bdac5db4fbccec5635f47a6fd27dbde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932421, "uuid": "9f5a1d66-2d2e-4eb3-a85d-65e8a06c24a0", "comment": "Malware payload (AgentTesla)", "value": "7403167385888d938913e75200e4dca9efa56b42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932421, "uuid": "b59b85a1-1ccf-4014-a86f-eb127b46d6af", "comment": "Malware payload (AgentTesla)", "value": "9ed05e37b5ee1f6bf36613879d90edb3816895edf558cfe33eab884ef91e8deeae0e800cb4b1b9b7d79bb0e2921c6770", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932421, "uuid": "f4577d24-0a86-4a5d-801c-f260c79d76af", "value": "T11605043D38BE6127D175C6B7CBD7F427F138856B3111A968A4C70359438AA8638C72BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932421, "uuid": "9d195add-2040-4cdd-ae7a-81527f9b0a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932421, "uuid": "ad4b76b0-526c-423d-90dd-d48cd043b3ce", "value": "12288:Y0TauHvXli04sxePpo+tpSE9wK5OcldJlN2JhGH7S4NNyu:fT/vXrD4po+tsE4s3lNkGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705932421, "uuid": "acc615fc-b5dc-443a-91c7-b5fac20e626d", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705932421, "uuid": "53cadb05-f480-47b2-a28e-b66b37b29025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932421, "uuid": "166925bd-b559-499a-b9c4-4c9ef0f30edd", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e428ed39-b94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705946327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946327, "uuid": "e0a64afe-0154-4132-a15c-d2fa16fa758d", "comment": "Malware payload", "value": "d5c4d88b7148ab05af33a179bef09415", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946327, "uuid": "7f345962-59d9-4c18-b195-29b0c48b3426", "comment": "Malware payload", "value": "8d6a24eac7a90860edaf6721856ff11ce0cff9dd3dc9c2b546a3fdf9d15be4ed", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946327, "uuid": "3f53c177-3076-4e10-ac19-5e18de26713e", "comment": "Malware payload", "value": "bcd71caeb50acdac169c20c820bc99c85618a5cc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946327, "uuid": "ee86005f-3a26-487f-b151-36f995c53983", "comment": "Malware payload", "value": "f3882d5ea5df5fb4dca22a1bf10bf747fcf6ad49278ef71d3f8b232d1bb41287eae2f587371efc9a1e843fbc3b4623df", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705946327, "uuid": "b4297370-baa3-4d53-a2f7-260c357ab7e1", "value": "T1E9435CA2D390116CF517D1A6F9B23B9E36A54037E30706B9E77528DACACF4E9017278C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705946327, "uuid": "6ce517fa-8304-4d6a-9cc7-34b565cbf2e0", "value": "768:4RFORa/bD08Nhn2j8JcEpUBEzkBbq3dWrpxVfF8uDViG:Wsc/bRN0fEpUBMkBb2dCjVfuu5iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705946327, "uuid": "649e9f04-5e2e-4d4e-bfb9-a23d65e3ae73", "value": 60458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705946327, "uuid": "71b5fbfa-81c2-48c1-8e21-b8f67dd39acc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705946327, "uuid": "95118c0a-1532-42bc-8c53-da9e8403e04e", "value": "report.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492f1657-b93e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705938766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938766, "uuid": "9a4c42db-b6ea-44c2-86f2-5b29a79d177b", "comment": "Malware payload (Socks5Systemz)", "value": "536dce0131972ae6ec3e567eed43a031", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938766, "uuid": "6281b645-363b-4f61-8b98-cd11fffd032f", "comment": "Malware payload (Socks5Systemz)", "value": "8ebd7fd5b84590f6f57ed35c7af93ca3c550b058b4939a3c9028ce7fb8a5f4e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938766, "uuid": "4615bdad-df1a-464a-9ff7-59ff6a7b8073", "comment": "Malware payload (Socks5Systemz)", "value": "48aa39bc9aa0f0decf38f3e4c435b341e761204c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938766, "uuid": "02cbeac3-16f2-4d95-92d6-3a66e914f6cd", "comment": "Malware payload (Socks5Systemz)", "value": "a3365bdfd0597bbb373e263a824fff56bfd198e4b9a665be1c311ec6e43ccacf4a373d3039de77b7f29a08275a286d3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938766, "uuid": "2ed2c881-41b4-4cd6-9b5a-ffbe54d80d14", "value": "T160263311BF40933BEA114230BDD2B710CB76FE4D261B665B396F94DA2CA53D01DBA392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938766, "uuid": "074f9a73-733c-41a6-b62e-e6981c70d119", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938766, "uuid": "f559862e-3cee-411c-8315-afd09af1fb26", "value": "98304:jftJy6MmFnx8fasVKqH5Tft9Yc6QjcOWky3BKxjVEahd358:ZJyAnxaBVKqH5TtxAnE7phk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705938766, "uuid": "874ceaef-f398-4d8b-afe8-a70dd1a03b2b", "value": 4796543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705938766, "uuid": "ab1ef1a3-16b8-42e4-b476-2b15da2272fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938766, "uuid": "258800c4-f1a7-44d9-b0d8-a9f76da4b2e8", "value": "536dce0131972ae6ec3e567eed43a031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21c17ba-b956-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705949250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949250, "uuid": "48655a6b-362a-456d-9351-378bac3884eb", "comment": "Malware payload", "value": "145909b65f0aa41bc2ea26e61485e265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949250, "uuid": "f8f56964-016f-4c94-98c3-54e0f4e23334", "comment": "Malware payload", "value": "8eed969439caae425cac85ad5b221e4f19ab22b40182a8d6beeb035dc50cf6a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949250, "uuid": "95f3c3d3-1341-43fb-a4b8-0bd975e1007b", "comment": "Malware payload", "value": "a596dd6b642049b4e2690dfbb6fc70d1a2e53e12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949250, "uuid": "83b0cd44-c98d-437f-846d-4d1ac57b121b", "comment": "Malware payload", "value": "0bf12393cc66b54b3f34e140dc0806c2f89a62763aaae7df3162eeed5dfde8fadaad13ba51a5bf6ae733ce71c5e65987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949250, "uuid": "2519facb-fab1-4750-9c73-7d9fe2a1d860", "value": "T1BF4512027AF08870E6F30E745D786E508ABFBF220E61D9AF6794142D4DB2983952D773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949250, "uuid": "1225ff9f-8eb6-4e78-b6ef-6c36350d4f7c", "value": "a9a82dd2a66e63538a3bd4ff3d20ae6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949250, "uuid": "58193a3f-2c49-49d2-ba31-f824a7fc77cf", "value": "24576:wrazulgAe5oAmDmUWYWefo3t5mHuCZwYEyBUUdKPQm8OD9rMw8:UazulYobDmUkuo3t8HxwceUdKIm/Bh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705949250, "uuid": "91bad3eb-f053-4e21-bb55-7cc2ac54a550", "value": 1195594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705949250, "uuid": "a4574d7e-06e2-485c-90cc-245842ab7599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949250, "uuid": "089140b5-48ab-4c4a-a5ba-bb100ddcb21c", "value": "145909b65f0aa41bc2ea26e61485e265.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2133dc7a-b8fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705909922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909922, "uuid": "513ae080-9db5-40cb-9d4d-85a27d8acebe", "comment": "Malware payload (AgentTesla)", "value": "27f23da004e250797ca4ca353b5d49b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909922, "uuid": "e3778894-91bf-4d82-b452-6df17111840d", "comment": "Malware payload (AgentTesla)", "value": "8f985f295e769cfd6436d575d39b83ff17892794e90becbbc673eef403c70ca5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909922, "uuid": "e3447f0d-559f-40c4-a630-18aa3ab1846a", "comment": "Malware payload (AgentTesla)", "value": "10241163cb69a3f922e736008fd3edb1169b3637", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909922, "uuid": "0e21c0e9-4cc9-4523-a0d4-38e0a56b69b0", "comment": "Malware payload (AgentTesla)", "value": "11d739f8836cca071af15b910f5ec025aaba17d4b7e74b851b248e6935b5ba8fb54427315d0989c351d013dc47a47d31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909922, "uuid": "dce0f392-9c79-4086-bf1e-154f387532de", "value": "T1DAD41224372E9F3BD0B257FC8431646407F1B8AB2A50E38C5DD671DF5826F896A81E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909922, "uuid": "a8d1ead6-d11b-4428-801c-b04f20b2c62a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909922, "uuid": "488110f7-270e-4d93-a5ee-bcebc6ea22df", "value": "12288:/8q+FJzMVLURmHLKpyxjaa+Fp8FZPgNZjMcdmMH:E75MVQmHL5aa+p8FZPUdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705909922, "uuid": "5e8a533c-b702-4925-a795-8731e08af0e5", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705909922, "uuid": "5245b78b-9b50-4681-9b9d-a146e7bd514a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909922, "uuid": "ecb19ce1-4c00-46ed-902f-d67e07fa4ded", "value": "Swift Bildirimi 10000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c864309-b95d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705952032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952032, "uuid": "7802e182-3720-44d6-a2a6-8b140ed6d778", "comment": "Malware payload (AsyncRAT)", "value": "fefcb4063d5fa6b6f7e18df15d898a4b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952032, "uuid": "01bf5011-7c7e-44f8-b45e-e566df95696f", "comment": "Malware payload (AsyncRAT)", "value": "8fd923fdc56266a3739f8ca0cdcbb97973cf7c84e1585eed90faf80e0a03d670", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952032, "uuid": "c162b3ea-529f-4450-9006-066733c8db55", "comment": "Malware payload (AsyncRAT)", "value": "191fa40f80347e5a7d359e2a7c1e7e896e13b8f8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952032, "uuid": "42b74d9a-14f5-45a6-b893-55ab98c5ce10", "comment": "Malware payload (AsyncRAT)", "value": "39df8578c2b19b9d9c8fcff3bbb3a5a85812d7576ec6f63b5884087e4e806f7586472058211fc10d492d0087b17b88ec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952032, "uuid": "d3c62b4f-2009-4a49-8ec1-fcf384b75938", "value": "T149F24B4877A14722D9FE1FF46EB2A1464278F517A817F75E0CC4899A6F73BC289003E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952032, "uuid": "0b827e63-bbf2-43fe-a184-44efe74e972a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952032, "uuid": "452a5ef1-0873-4471-8370-79d4dcab5834", "value": "768:sWHqIHRXYauPNhzIgtoFj9Fy9YkROjhR/dcU:sWhxX9u0gtoPFy9YQOj71cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952032, "uuid": "17834ea1-5453-4ecf-8238-548738913560", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952032, "uuid": "63545e6f-a422-4ed1-8169-d419b85434bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952032, "uuid": "2282729e-a914-4267-b068-9dc115d88a42", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a36e3-b941-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705940154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940154, "uuid": "95918540-bc9c-4d41-9718-a04dce5c66c0", "comment": "Malware payload (LummaStealer)", "value": "6540dd808a1d6eb06e9d790f0f597aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940154, "uuid": "21ee9174-052d-4215-ab1a-addf91d7c7f1", "comment": "Malware payload (LummaStealer)", "value": "90b7554631eedb50958f85c1cebf563aa1137c193e701a53940a9783360b0ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940154, "uuid": "89499181-5f71-49e9-87c2-91be294bae14", "comment": "Malware payload (LummaStealer)", "value": "83fcd4e3360d11744596df30b0c0b00d48a3c1f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705940154, "uuid": "f2488844-976e-4ff1-8ec8-563414095b39", "comment": "Malware payload (LummaStealer)", "value": "8156b0242bb292312affe53a251f4868b13c5ddfebbfa12752fd41c89a4c61c78e9556dca968e31e8030119d10cc0d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940154, "uuid": "d25f8677-4802-47c3-8981-281fb84ba1cf", "value": "T1042622F367553378ED8D697580C7649F7C69AC2342EAF521B38E0AE2C6474928739323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940154, "uuid": "b7dc0708-37f8-4a3d-9c6b-05bbc49e1d97", "value": "101ea25e3f83a1eb3b6e28a030c29662", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940154, "uuid": "7933e244-c9fd-4980-86fe-b44bef668d21", "value": "98304:AI5A2v3v7YDqaJToYdOmxPC53WB8XnavXEPl+h/Fwrsmh1iA:bASTjfm85kSdT1iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705940154, "uuid": "9530f2bd-a56d-4d36-9ffc-a97857f64dcc", "value": 4728408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705940154, "uuid": "28c8206e-47df-44a0-a31e-8ce2ad325a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705940154, "uuid": "2a1746b8-476d-4d4c-ac3d-1781cc259b13", "value": "6540dd808a1d6eb06e9d790f0f597aaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd424c4-b8e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705898512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898512, "uuid": "78c9f98a-ceaf-497a-af5e-41427a589fbf", "comment": "Malware payload (LummaStealer)", "value": "816f5d32fee67f49e4eadd87a01f73e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898512, "uuid": "24266a10-e50f-44bc-8256-83fb8f8ddaf7", "comment": "Malware payload (LummaStealer)", "value": "90e1e420b6bc2ca2e21c5355ffee523f675c73fcad67b62621d76c1ebee4063d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898512, "uuid": "5ff711d4-8d10-4c5f-8b51-4c9cf6f08a42", "comment": "Malware payload (LummaStealer)", "value": "7a6ac0933b26c5ed1309eab10878e9c5e3185ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898512, "uuid": "f05c8c5d-5683-4e8a-847f-f6fe2a152426", "comment": "Malware payload (LummaStealer)", "value": "f7a03b05182e00a3ea77451d4464681c1bd8b8f2bd958e994c32f3d3ad7a8ff8f066c3e87ea4bf31c65965dfe50dbcfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898512, "uuid": "569c6b85-3bc9-4ad3-8267-a0dcc75b9f1e", "value": "T11CD423617A47937BD25D1DB680E3855007FAB3952D33C7CA3DD901612F027E8DA06BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898512, "uuid": "aaadf959-b45c-4a78-b0ac-66570c59aa7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898512, "uuid": "5e8e1c07-deba-4f16-b1f9-d18cef962685", "value": "12288:bBZgBs41/j8m29nVdBGuo/8x/e5F/+hr4aRnnWIoSk9t:bBixjqVk8+/+14wnnWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705898512, "uuid": "7b9e4f49-9ab7-42fd-bf33-ebad3cf3ab5d", "value": 611296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705898512, "uuid": "1df95dc5-6814-4072-931d-452ad603b02b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898512, "uuid": "20af49f3-eccd-4023-b74d-9a58ff9c7dba", "value": "Codium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdf5154-b8fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705910215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910215, "uuid": "eb14ece4-fc2a-4fef-966b-1dc30bc8a589", "comment": "Malware payload (Socks5Systemz)", "value": "36c4dcb3e0f25493f244d21ff318c2b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910215, "uuid": "08359443-54d5-4011-95db-584c078ca6b0", "comment": "Malware payload (Socks5Systemz)", "value": "91acea7b76d886050d940812efcf5e75563978129c04636a3150543e9aada9b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910215, "uuid": "80b2164b-e90f-4b69-8fdd-4ea033d737bb", "comment": "Malware payload (Socks5Systemz)", "value": "ce063427cd7f449a9da467cd4f16bf588de8c868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910215, "uuid": "41ad5832-e77b-4a08-a186-d22a7324da3e", "comment": "Malware payload (Socks5Systemz)", "value": "186007b15ca9fe3e8a961e2c29031ffd5fd012230f9b5cc74676836e5dfc7ee74ed10a9e65edfe3106f7a5923295002f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910215, "uuid": "2479a538-4893-4b4b-a35d-3e9e271a2a58", "value": "T137163312BF409237E2426A34EDC57350EE62FD1EBB234702554FAAC91E953D0ADB53E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910215, "uuid": "9d46670c-8ef4-4145-88b2-ca3509d5f937", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910215, "uuid": "1ed0b2ef-5237-4aa1-8f52-5c74412c06e1", "value": "98304:65tQX1zeURvdT1QfYM/n7H+NcxaTVW3kNhA5vrtAdatUO9TCiNOrd358:MtkRnCr+NAMeks5zuo+SnErk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910215, "uuid": "c0e132fd-decb-4a81-b17c-b0521fd0fbd0", "value": 4419468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910215, "uuid": "5c47b40a-8a37-437f-ae21-9ebbb5347128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910215, "uuid": "373c0a56-727e-459b-b791-c7ea266dfc5d", "value": "36c4dcb3e0f25493f244d21ff318c2b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e23dc5a-b929-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ExelaStealer)", "timestamp": 1705929835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929835, "uuid": "3b76aca7-68e7-45c5-82ce-8a1ff31d6128", "comment": "Malware payload (ExelaStealer)", "value": "d4aeecc46dd137152cc331fe17756a33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929835, "uuid": "d51d3304-1e4e-46d3-8958-ba7519f1e8cb", "comment": "Malware payload (ExelaStealer)", "value": "93c23fb3e7484a6617e11892072b90d94f9b32784aeaa31edfd011ce94fff85c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929835, "uuid": "560e8be9-16fd-4343-a25c-23f562f1306a", "comment": "Malware payload (ExelaStealer)", "value": "c32e19df96e0f724b28e74e3ce04251d81e16654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705929835, "uuid": "71cfec4b-0d32-44ac-906c-26eb0d0b5a9b", "comment": "Malware payload (ExelaStealer)", "value": "8e4e5f516b7019b3bab6d30dcb4856971a0f6c1f6c09c56da8325d9287ed854ebee9dcc6cfe2223d16646a386a2cd859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ExelaStealer", "colour": "#4DB216", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929835, "uuid": "a3354e89-52f2-4ec6-9b69-c1955f85975d", "value": "T1F6C63368B3E01FF6F56B297AD0C28415E272FC510B64CB8B872866F50F279615C2FB58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929835, "uuid": "759bc9d5-38c6-4757-b340-2af0435284d9", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929835, "uuid": "a55f594e-ad7d-43a2-ab0d-213fe1c9ece4", "value": "196608:9AZb5ZPAEuj6on3dDTeeNy+wfm/pf+xfdjSEqReBnfXWKsnPtSDrIWOIWsDaqkH:uZb5eDOet5y+9/pWF8NRUnfXBsnYDrI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705929835, "uuid": "e3fbe031-faaa-4f76-ab07-eadc53cdb488", "value": 11969334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705929835, "uuid": "c911c8eb-f93a-4bd5-b7d9-970a4bdb51f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705929835, "uuid": "7a47edf4-6e0d-46bc-86b6-268ae1361218", "value": "SecuriteInfo.com.Win64.Evo-gen.31305.28602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cb6018-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705915839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "d8544556-cf68-4a1c-b55f-a32fc4cd8d89", "comment": "Malware payload", "value": "a5ba8f073e0713a09d991a1d47512d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "12cdf2b5-b258-4bb0-a092-e071c1dd4f60", "comment": "Malware payload", "value": "949d41d8ed1642812060f557f9f5dab609f8268eb299b4adfd1ce5842083f273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "1951f42c-3015-449d-b167-98c1715db499", "comment": "Malware payload", "value": "352e5b540bfa818fd07c0d6d21616fd77bd7e500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915839, "uuid": "8dd9b4d1-12d8-4a66-9043-6193f4abda5e", "comment": "Malware payload", "value": "90295227e6322c2afd8a4cba102570138f1207eb2bdd0265eeb9ab93a111400c8c7c1bf43dcdd0dbefc5a4c716982857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "c1bdf157-b199-4c6c-9f1c-26ad5c1a33fd", "value": "T1D5C533A394866907FB8F99F1B7D80B1B4F791158002399F7B22D2FD1417A7B4B121EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "239e8816-eb60-4ea9-99cc-7b03275daa7f", "value": "f8afa2669eeedb489a1d7d8f07e38693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "4b541b56-6ee3-4848-8bc5-8de1ceb71b85", "value": "49152:InDc2eaSMf1BlLKP+aAgImvfSLTOpi7ja37tqE436ZECJujrUIWV0bDm8aj:InY0SMfz9yImSPO0GtI3842mDm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915839, "uuid": "d4287425-8781-4e77-8c8f-6925f4e53479", "value": 2655744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915839, "uuid": "90c71f7d-b5cd-438d-98ce-acba4abc7d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915839, "uuid": "4d8c6545-3730-423a-85af-6b249a4b3c1d", "value": "SecuriteInfo.com.Trojan.Win64.Agent.17086.20860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cb0d4f-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705910653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910653, "uuid": "abb52551-3d87-471c-af2a-04ba94cee2f7", "comment": "Malware payload (AgentTesla)", "value": "0946a7e6384346a80f5cc4933e38591b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910653, "uuid": "2b8ca720-d4a2-4ad5-969f-b324e82b51c2", "comment": "Malware payload (AgentTesla)", "value": "94a33f12727532ff17c7cbce2fd33276e607e53bd6e03e8e7ee38f1386491bc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910653, "uuid": "de3de569-358c-4eb5-b182-d202fed72645", "comment": "Malware payload (AgentTesla)", "value": "f89a929c7b8099b3b3a7a845cb4ff4c5d89e072b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910653, "uuid": "157afeb9-78a8-4e42-9c97-e78b7d6dd481", "comment": "Malware payload (AgentTesla)", "value": "e45303af7ca99289a2cdef09a00bb5719c83bb35c689027d604b038f7a77fceebbead2f25dbe213f7229e0d91121e6a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910653, "uuid": "0d047143-477b-4186-8b5f-144b88421707", "value": "T1AFD42262737D9B33E5BD9BFC2E69149047B476AA1281EB4C8CC3B0C71464F489B81E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910653, "uuid": "71c5ce28-7bf0-4b6e-8a9c-ea6624c244d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910653, "uuid": "31e69305-354e-4a72-adb6-507f1670b06f", "value": "12288:+smj+AWtOoGK/V2cO8ciMsljkWEn5aGqpsTW3Ym+LhbjMci+5HAU+cq1K:a3Wh/V2RslgBgpB3YZhbjMw5rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910653, "uuid": "a151b1de-ad33-498b-89d0-449ad78f5ff6", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910653, "uuid": "0be407af-6e3d-4fea-a960-4ae899d011a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910653, "uuid": "9bcdcc57-df92-43c8-b0ca-5cc6c3c764a1", "value": "DHL_ AWB#22875102901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f1b0d2-b959-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705950645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950645, "uuid": "d691bad0-baf2-4235-88a7-5ccd8e0d48c4", "comment": "Malware payload (AgentTesla)", "value": "4fa28048b306dbc79dd07635227cee0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950645, "uuid": "2bd67530-f7f5-484e-9654-1ca1abe4f015", "comment": "Malware payload (AgentTesla)", "value": "94e1dce52a03edfe400a77aa0d7fe4958561d869877b271685048067606e0e40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950645, "uuid": "876594f1-d7bd-40b8-9a49-721a023c4875", "comment": "Malware payload (AgentTesla)", "value": "bf4da9b5ad543cc1912c92351315bfb45e170b08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950645, "uuid": "47f0758d-a742-4956-8e74-e6d28eb198b2", "comment": "Malware payload (AgentTesla)", "value": "667e2656881a29af7befc6a17f87ef3e9465bdee841c4f61e624069b078fc678bcab165b6f161ffbc2b14b29a27c085e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950645, "uuid": "52b502ed-e485-48b7-adca-907d714dcc7f", "value": "T1AD55BF4277C0C092FFA78573474BE72187BC7E764127E92F12A9387AB970460663E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950645, "uuid": "d518c3bd-1da8-453d-9482-fb4b0829903a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950645, "uuid": "00fafc59-611a-41ce-88cd-b31f441de1d4", "value": "24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aLCrcIiVvPIxFo:sTvC/MTQYxsWR7a2rcRy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950645, "uuid": "5a0e1a26-0b3b-4a40-9b6b-b92d6c08cd32", "value": 1302016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950645, "uuid": "779c5a75-0f8a-42e5-bb8d-408656670ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950645, "uuid": "7a271a42-93b8-4521-b0b6-1d44037d327d", "value": "MT103 0216009430 - Aviso de Transferencia Realizada.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00aa87f3-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705950670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950670, "uuid": "c331a117-53bd-4b73-8137-655b46d270d9", "comment": "Malware payload (AgentTesla)", "value": "b617a6a12b850a9e5ad881b143074f39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950670, "uuid": "7570c5a5-a0cb-4f5f-b2e4-aa8f7ccd61ea", "comment": "Malware payload (AgentTesla)", "value": "954ac4022c4ca231ad8dcc85b327c427257fb567237ec503a1d402814c39df61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950670, "uuid": "1889aaaa-32a3-4687-bde8-68df7cd953a4", "comment": "Malware payload (AgentTesla)", "value": "82596003d006df00fe86d4b3b907422d74ef8ed9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950670, "uuid": "147dd758-6781-4b7b-87ef-fdf2d4ca4ac4", "comment": "Malware payload (AgentTesla)", "value": "996cd9343146cdc14fc5ad20f021896c8025a32af9adf4cfe3b28172736a9b9701cb2a2f6b5cfb9c240c69f302e7e5c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950670, "uuid": "d898f512-2f88-445f-8135-2da8e916c89c", "value": "T1C7F4BF4053AC0B2BE56F02B4E41140D0B77AEF80A3EAEB5E444A759E6CF335174B5DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950670, "uuid": "a7da782d-578a-4b44-b6a6-99fb61068634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950670, "uuid": "c323ed66-50ee-488a-b56a-5f489ac9ebcd", "value": "12288:IqLPyXcTj2/u/WcYppCgwzgdpevyxdp7OmVfItQTuMNDqUOwr:x6XdEWcYigXe6x2GfItOuMNDCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950670, "uuid": "b5798b6f-f6cc-4c69-b6a2-17dc2a267584", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950670, "uuid": "ab55b7ac-f5b0-4ad1-b026-0b3b6b6d219a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950670, "uuid": "3b858d2f-4b46-4662-accf-5604cffedd19", "value": "RFQ - For Supply and PO3452302659-Project Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bef754-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911970, "uuid": "d37f1dd5-f5ae-40de-8ce0-18c58f85b4c7", "comment": "Malware payload", "value": "e970f5d850804e51fc3e36696098cdd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911970, "uuid": "9f163ca3-340a-41b3-b8dd-222dd764113a", "comment": "Malware payload", "value": "98689e16472da17ee1a75d4f9cb47c8d969d5829eb1b0bc2890f5ba24bccd84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911970, "uuid": "9dced9f8-8bca-4af0-88ce-da12a027213d", "comment": "Malware payload", "value": "70b3aa04496a0a47742126a09dc855d9f8ec7e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911970, "uuid": "8289b063-0a80-4787-8597-d3b4d29bd4ba", "comment": "Malware payload", "value": "3a2aa5b7918e51265ffe189a5915e25603d29531787330e1b50776c588825edf74d705e8994b28de7c4a35dc652513e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911970, "uuid": "b2f4b6f3-9811-42e2-9c47-79555f00b81e", "value": "T1E20633C606F06CA1D26B37F9032BDA0D1365052B7CFDF7ADAC1579A4CE4231A8726C69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911970, "uuid": "5f94e976-2507-4b6d-8bf6-7c1fa2dc78e0", "value": "811a55f4e109c60cab54458e61ceea49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911970, "uuid": "66b7f540-a2c4-4438-9a41-3b538ac3757e", "value": "98304:/d+qCR9F8MXE+kWwwhEEjPwRu0aFQ+zdJdBgZ4:3C58kzkWw2VjPwRHaK+JJdBg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911970, "uuid": "3154db37-e1ee-4538-9508-d3f48e700d32", "value": 3928080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911970, "uuid": "ffe15ba5-2b1d-455b-a0a2-79b3efcd4149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911970, "uuid": "75e070fe-cce5-4cb5-a443-ae48c88d2fb9", "value": "SecuriteInfo.com.Win64.Evo-gen.4383.20587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d19b61-b978-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705963857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705963857, "uuid": "dabc70d0-466a-4f19-aa10-fe04e73c2fb4", "comment": "Malware payload", "value": "ceb657ef40aa340cc60e7018dfd6508d", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705963857, "uuid": "27385561-ed4d-48a6-acdf-4d937ef20196", "comment": "Malware payload", "value": "986efd723526d9d5239d2290329d87af5a6d8ceef6021ad48aa0c80bb07bcef7", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705963857, "uuid": "80a01428-c57e-430a-8f04-24a18e829ae9", "comment": "Malware payload", "value": "b75cbda2a57b312f73482ca62c18ac69e47868fd", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705963857, "uuid": "f12f2d6d-c862-415d-86d0-6c54a67e5222", "comment": "Malware payload", "value": "2a574e0ec1adf4ef8c9bea90e9bf175a6214dc6e36736df0c7a12485e3c207830f53218b82edaf58e109d633ae6c949c", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "wallet", "colour": "#09285D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705963857, "uuid": "40575891-3fb4-40ae-9b10-8f1f29d26cb3", "value": "T10484238660571F3E6DC29AD3500AF30DC526FC67E38E971AA15AE3E86857E57FD008B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705963857, "uuid": "3ce2f832-1141-47b1-9124-a4a8012060f1", "value": "6144:f1Wb800cCwVTEAG6A4WpnqV41a22b4d2TD/h2SOji0xXzCCwp+/ZJTJ43AivKW8j:f900cDTEAu4o84t2Ud2JZai0ZzkpeZ1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705963857, "uuid": "69c2ca77-ec70-49cc-9a3d-50e584b7af36", "value": 375364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705963857, "uuid": "7b221fae-9e3b-4340-91f1-900348e10e6b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705963857, "uuid": "f0b74e30-221f-4340-b172-2715e54c4553", "value": "Wallet TEST1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fa80d8-b8e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705901664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901664, "uuid": "842e2da5-54b6-41fc-86bb-a49636c74f1b", "comment": "Malware payload (Socks5Systemz)", "value": "b47515d6b8188000735c32bbc46005be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901664, "uuid": "3cb3da59-d7c1-4855-b421-bf5bd8e3b88e", "comment": "Malware payload (Socks5Systemz)", "value": "98dd0b13309f39e81a6078648b6f533f6ea409b314b41cba394305b379767ac0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901664, "uuid": "5a7eecf4-5f72-468d-8598-0379c64afb4e", "comment": "Malware payload (Socks5Systemz)", "value": "1b3fa97ddb36f98f37bff1f93847b72a8e588177", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901664, "uuid": "c3914b95-219e-4dec-a7e1-f947b830161d", "comment": "Malware payload (Socks5Systemz)", "value": "ec2af982a0fdc0a3ccccb1217ab1a33e483b784c38893444f5e5077c7e8d24fbdffda025724f9b65a8004ab90df699de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901664, "uuid": "2ab9d156-6574-45cf-af0c-761ca37277cf", "value": "T1781633017F112A77D511AB35FDD6B368EA61FE1E4A130A07765E50CA3D82BF18CBA2D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901664, "uuid": "e8463287-6bd9-466a-9e21-1a9da08dedc9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901664, "uuid": "be3d3b7e-3698-4cc7-88f9-6280da6b60d0", "value": "98304:6eu+ClGFzYQnLE9EOg6S9fjcIYvnjVVvD4KToroOFNchd358:9u+cGFzYQnAur6S97cI8njzvkKTokgim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705901664, "uuid": "b1e19760-991f-4e11-b0d4-c44f1a2dfb6d", "value": 4322162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705901664, "uuid": "aecb0b55-75a3-48f1-be9d-4d1854c17d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901664, "uuid": "bb7fb90b-839a-40b9-8c9d-3d11a5a8cd33", "value": "b47515d6b8188000735c32bbc46005be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c62dabd-b967-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705956515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956515, "uuid": "6e7a65bd-cfb8-47d5-8bb6-7bc00237c0c1", "comment": "Malware payload", "value": "e3dd0bfe38b07d750d2c13da80d9155d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956515, "uuid": "d7650432-f707-4c4a-b727-eb09e0ce0082", "comment": "Malware payload", "value": "99c24686e9ac15ec6914d314a1d72dd9a1ebece08fd1b8a75e00373051e82079", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956515, "uuid": "dd25bb3e-b23f-40bf-9cd1-662780dc56b7", "comment": "Malware payload", "value": "54faa6396f179908918b4d5f1fdc4e99ad6fbb5c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705956515, "uuid": "470990da-24d4-4368-bfc2-ee969b002e9a", "comment": "Malware payload", "value": "9025b194ce1669200e04dbb5bc49bb31feab1eb41be2ced042bffb2d094ad0c0d945b362dd41318f56d77bf1669448e2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705956515, "uuid": "3d6e729b-fde2-4987-a239-825791669f6a", "value": "T1BBD63399A03E4352E9936D365725E7BB09C68FC362B3C618AFD08CC3B1F6F1A5751182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705956515, "uuid": "c4bd7582-e4e9-4f1e-8bc1-de8738c9bb5f", "value": "6f462fcc6b830b77fb3fef2add9dc570", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705956515, "uuid": "40de17c6-6c98-4a26-a5fd-2dd7df0da43f", "value": "393216:HaXuGHyMeW9/MkMVEoucpzXN78c6GxrLx:H6VDe4OAIx78c6CL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705956515, "uuid": "2a1bb1bd-3d9e-4300-97a8-13e28df56778", "value": 12919808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705956515, "uuid": "f15dfeb7-34c3-4bf7-8c56-4a8fab08e8dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705956515, "uuid": "b8e37514-ae45-49a4-8b23-dc9c5ca418aa", "value": "VespyBuilder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f27e2c7-b940-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1705939527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705939527, "uuid": "10cd5472-c2d9-4f22-a3a8-5196bc3a3bf0", "comment": "Malware payload (PureLogStealer)", "value": "3ef515bb081e3a8546a39219bf1310a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705939527, "uuid": "dec8bc73-0863-4fa4-8103-c6ab705ceca5", "comment": "Malware payload (PureLogStealer)", "value": "9ae50d0f38c49c5e2a1e90d5bfa9972e551f8274f83fcf7182ab3ed38b2fd394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705939527, "uuid": "4cf90195-2ab0-4282-938d-8c24d04f1f81", "comment": "Malware payload (PureLogStealer)", "value": "65b19bc8100f6b67368c46b33d39ef441aaeaeb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705939527, "uuid": "9558116f-5603-4b3f-9134-cfb99c65cfeb", "comment": "Malware payload (PureLogStealer)", "value": "a11ff83606a47fe8930af79fda23b3a8c08b67d350367804bda84c534d8d3e2bdd90271a1f7f7643959892e5a4c3ce3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705939527, "uuid": "10699aab-d83a-4ee6-be6e-936386e76f46", "value": "T1C525234AA7488F42CAB6D7BF54E8AB0183A0E252E69EC71F7CC2E37805497D75D41923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705939527, "uuid": "d3036cf7-6511-4b89-b119-0ee689a4e327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705939527, "uuid": "92befc99-48cb-409e-8e62-0732fe4e50e1", "value": "24576:e0iX4h2UdICJKqGHN7zoD+VKUKLCbkfIhtRhp0HBUnhGD:+1UdICQpN4D+vmEhjheHB8h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705939527, "uuid": "56e53d9f-eace-4660-8f38-cbc9d6af89e9", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705939527, "uuid": "510eb153-c3a5-4ba7-9cec-8e01ef611dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705939527, "uuid": "48fb862b-f79c-461d-8de9-f9e1506139b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d933014e-b902-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705913238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913238, "uuid": "4cee7e78-abc5-485f-9e28-6c11497da1a7", "comment": "Malware payload (RiseProStealer)", "value": "3e5ede4ffd481a00d7170c98fcdb31aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913238, "uuid": "c733850e-b1bf-4700-b848-8aab6862de0c", "comment": "Malware payload (RiseProStealer)", "value": "9b62781c8df272bd7d2a663c9c3de546300597edd06d89432e00a6d2736c2a15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913238, "uuid": "45188ef7-bfc6-4bd4-8c90-0029973ae9a7", "comment": "Malware payload (RiseProStealer)", "value": "39ca564c64c8180541932a9617c7536a93b30ed8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913238, "uuid": "ded9a910-2aed-4e50-9f8a-8ed66c6ac292", "comment": "Malware payload (RiseProStealer)", "value": "aba98bbb04634f329eac865b623cd58a9f798ea521ae2dde3996c9e1074c0899fb885170de641f6e4ff74c574ad3214f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913238, "uuid": "f529cccd-fd62-414a-aa86-99952f65e3fe", "value": "T1604523F7D2339000D037B3B85154491D1AAFECAF1140A89A49DFFA464BBC5BDBB52E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913238, "uuid": "c991ed94-0949-4aee-8ddf-d2ed2419796b", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913238, "uuid": "62c6d15a-94ab-4529-a616-661be4e61a50", "value": "24576:CvKzfqxSijY0HOHvOsqfwQ6yEvO5QYDx9Fi:MKzfqxS0YVvOllp2YnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705913238, "uuid": "fe85e2e7-c560-4531-ba67-327bc89ba5ab", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705913238, "uuid": "9167f55e-d73f-4e5f-9e2c-f9e3b5365c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913238, "uuid": "f685a31a-2540-4e1d-aa6b-0ef062617a16", "value": "3e5ede4ffd481a00d7170c98fcdb31aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b95deb6-b8d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705894424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894424, "uuid": "9ea44e86-b3ef-499a-bebf-b6742f64c2c7", "comment": "Malware payload", "value": "cb7540975a2d1643707fa30760b36c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894424, "uuid": "cf40825d-d638-41ff-9740-ef4ac9a30246", "comment": "Malware payload", "value": "9c44660a837beaed12beb9cb626ee2886910adefe044f269240a1e2db1ee6dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894424, "uuid": "402fe2a8-bf14-42f0-abfc-ee7276fc270e", "comment": "Malware payload", "value": "5ae5cd61058dd0979e2c898bda1b07d26d041f3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894424, "uuid": "1893a9ca-a1e6-41f8-96ae-f82a02f11a9d", "comment": "Malware payload", "value": "0b89ddf95f84061faa10ba348b6feda8ad744f0432c87025259a8af546eccbff847b0629ac7595a1d66327783090e1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894424, "uuid": "5b48ad1d-02fb-4715-aae7-1d58c5406d40", "value": "T1FD549E57A060C221DA210E3AF4F151F69F787D06D7894D23B7247F2338F7A54AE4B92A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894424, "uuid": "5debd87a-54fc-475e-b943-37ef44ca8dc1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894424, "uuid": "92f6f8f4-9e1e-459d-b0ad-63d84b4548ac", "value": "3072:ZbG7N2kDTHUpoui3uy1RjwOkisGB+SWl912pU38BPtmWlUlZKAOg5FVFDs2EfyHo:ZbE/HUuuaEOBkR8B1m7rKAOg5jjsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705894424, "uuid": "ab752a43-5732-4cc1-8196-e2385283a79b", "value": 300920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705894424, "uuid": "d21bec45-dfc4-4499-9ff6-bd4501e45422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894424, "uuid": "6a3504a2-4fdb-402d-9ffe-1dc2d94422ab", "value": "SecuriteInfo.com.FileRepPup.18058.13095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1edf828-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1705917064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917064, "uuid": "dd7cc267-6182-409b-b760-9c527698ef08", "comment": "Malware payload (DBatLoader)", "value": "17a95dcddc8560dbe536d2a5d1f5cdce", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917064, "uuid": "19440f10-4593-4887-8d6c-592ec83d12eb", "comment": "Malware payload (DBatLoader)", "value": "9ce2b9c9640462cf44d95a905a52a56f39eba649e5946610fbd97cd9c00a2b7e", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917064, "uuid": "69b6385f-51f6-45cf-8251-b396d4a8b3f2", "comment": "Malware payload (DBatLoader)", "value": "07aee3f8ab4378163e2605d59b77e6845655f37f", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917064, "uuid": "2aafd15e-b99a-43e2-ab89-0720585677d0", "comment": "Malware payload (DBatLoader)", "value": "27f9ecb00ab6dfef4a53320854ffcaf3a0d9296b2154a00379cb474b3627f3893b653420aafe0166d86599a9b7127c2f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917064, "uuid": "82f7fa56-8d63-4ac4-a77f-fc89a391a5f5", "value": "T1AD45CF21A6F1E632D87D31365F499BF4509EFD78CD44481232F52EAC4E3A0D2DD2A26B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917064, "uuid": "640f1d67-822c-4fa1-b483-b2787bce512e", "value": "d0b5957997afb7a9ed86d545f1da82b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917064, "uuid": "f607cc6b-8df9-4549-aa47-adad0be691c0", "value": "24576:jWtgwv8HxB2U7YcW+5nRk/Yn9aNDNR7HjRW4APiKZ7:j1tYcnR8YneR7DRWhiKZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917064, "uuid": "b121d24a-9395-4ae6-aeee-8a08c8252b3a", "value": 1203712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917064, "uuid": "25b49c49-e8d5-48e1-a68e-74ee34a65635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917064, "uuid": "06efc663-8a56-48bb-b357-adacd49cd94e", "value": "17a95dcddc8560dbe536d2a5d1f5cdce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7316d8-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705916840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916840, "uuid": "0da55b9e-7824-4053-b05a-e67a4fdd1aea", "comment": "Malware payload (RemcosRAT)", "value": "145349bbf829a5f9276096963902e4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916840, "uuid": "34f5f9e3-91a5-4cb8-88c7-2d1b58434f83", "comment": "Malware payload (RemcosRAT)", "value": "9dc83f160070d54cb14ad15d7852c862724cca38d135613f3779f7185c6af484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916840, "uuid": "63a4148e-46a2-4d4e-8b56-718b8c642219", "comment": "Malware payload (RemcosRAT)", "value": "4b5aa7ddf1bea99e27a9f9de972dc91c60d9d0bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916840, "uuid": "018466f7-59df-4d5f-95d0-ffcf894e2740", "comment": "Malware payload (RemcosRAT)", "value": "db42d8cbd76e54a5924b6e3314e0d7f6a1e6e81655642e49c5b35eb6745d22eaf3ba4c035e1ca65b3d6eca2bba5beec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916840, "uuid": "588a89a3-0b2d-419b-b3d7-9b0715b68591", "value": "T10166AF12B385A13ED46B0A3B493BEA54983F7F313A16DDAF27F4194C4E35A40663E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916840, "uuid": "353615b1-52aa-4072-86dc-6937f8d2c648", "value": "51c6c2222d4b2765999d327c03c424ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916840, "uuid": "3191a10b-7bc2-4113-8909-2903abd4b814", "value": "98304:I3X/qFuqj6tN17DnVucBKuLXfPLzLjY5OCZ+DFFfoB:qqmNwuLv3/mZ+DMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916840, "uuid": "248bfaa2-3fb4-4fc4-8fa9-094c7fbbdb75", "value": 6868992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916840, "uuid": "900c2638-7c0b-44f2-8bc2-d3d37208b28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916840, "uuid": "921b724c-6ef2-4c65-8649-d4d6eb030043", "value": "145349bbf829a5f9276096963902e4ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3360da16-b8df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705897927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897927, "uuid": "07c38bf0-1fcf-42db-bd4a-81411b3453ce", "comment": "Malware payload", "value": "b02f1dd2b03424944593706f8152a3a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897927, "uuid": "053edeec-88b7-4455-a4c0-1239cfa8d596", "comment": "Malware payload", "value": "9dcba4f78cac13db5dd14144a3dab220f8dc1bf6810b4ba0396725afbeab1e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897927, "uuid": "3af53ca6-cc83-4dfb-a5f0-5c00d051d786", "comment": "Malware payload", "value": "b49c67bde964e3bef3f3e3480a11030a86efdaac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897927, "uuid": "9258b575-5eba-48be-ac43-8fa7d70d4bdd", "comment": "Malware payload", "value": "dfc6ad5b055cd02200a5ef8dc15b6e563104dc96fb654cbc8277708c744938674ef3ed377cfe22ca440dd18b19083e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897927, "uuid": "e88d3f5d-1b64-4511-9363-88c282702723", "value": "T1F6532B09B3979739C5640AB7C0E3B52002F2A7872973EB5E7DC412C60E16FD5DA43B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897927, "uuid": "01825da5-c2c5-4132-9abb-3de49d880a36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897927, "uuid": "728a56da-bf39-4a48-813a-bd146698b543", "value": "768:7IX+O38/1FEWo0YCCSSg1zS1dUAaduFG6DRyn7m1fZbj+z3M5C1pcVfbuEVp2fk5:sK0vxCDL1daG6DRyn7Y3gcC1efbL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897927, "uuid": "584a3f3a-445b-4340-89d8-043a3d5869a5", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897927, "uuid": "ee8770fd-a1bc-4320-aca0-8c9240261c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897927, "uuid": "241d0ba7-9cae-4fb1-b13c-97e327962e5f", "value": "SecuriteInfo.com.Win32.WiperX-gen.28054.17010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8617ec-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948086, "uuid": "1f4e033c-477a-4ef4-8321-3ebc08a6d8e1", "comment": "Malware payload", "value": "38dbe26818d84ca04295d639f179029c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948086, "uuid": "42c827a0-3fc9-48d3-8810-9935e311a253", "comment": "Malware payload", "value": "9f94daaec163d60c74fff0f0294942525be7b5beaf26199da91e7be86224ceeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948086, "uuid": "3d3e2369-9b6e-4d5d-96d2-8a89b77ef6bd", "comment": "Malware payload", "value": "f24e9c792c35eb8d0c1c9f3896de5d86d2fd95ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948086, "uuid": "1a2eceee-aff0-483b-95da-0cadadbce344", "comment": "Malware payload", "value": "c735e4c6e1fcad69fef7ce4017724a5bea3b1696b603e1ee7d2cbbeb5ee4ac5296422e0b42551af1f2f7bf8634f34c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948086, "uuid": "2b11f6b4-59a2-433d-83b1-934d414d07d2", "value": "T15594126CA6DDCC62C36C1D344D03D6F41A12BDA98D494E1B6AB63EDE383C39439285ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948086, "uuid": "f2d52a2c-bf6f-45f9-a47c-49c86665ab29", "value": "3cf88f98a67766d86701649737750a83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948086, "uuid": "897f709b-aab0-4955-994e-f71b0947c739", "value": "12288:XxHwajJ1tkL2ukgKfap7UcfzoHa6y0S3XnXmGDtoS:XJJ1NcrEyHXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948086, "uuid": "8c09fb35-ba66-418d-81c7-8f2668c9f0b6", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948086, "uuid": "cfc91cd4-d93d-4768-9177-4dc4adfa7a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948086, "uuid": "9f47fbd1-e27e-4646-bdaf-bef7c5410cd6", "value": "SecuriteInfo.com.Trojan.Fakealert.59798.30938.23415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccf5c52-b96d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705958931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958931, "uuid": "3a1cb69d-c023-4ed4-a3dc-dc3319eca3b1", "comment": "Malware payload", "value": "cd2a52c40321739dc5e8b263a30271fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958931, "uuid": "3d7337bc-898d-43d4-bac1-eb7556548aa5", "comment": "Malware payload", "value": "9fc1cd4b3fa2811257fdd541be91d72544815c5574be2e7ce32c5cd93299528c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958931, "uuid": "6b452db6-735e-4ec2-862b-3f824469c4e7", "comment": "Malware payload", "value": "c2e684c54612173ee9c2ce66d32e72b0bcacfe01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958931, "uuid": "81a2d147-2c87-430a-9f79-6fecf0c93792", "comment": "Malware payload", "value": "a6788b4d47186bfd743e266f10138e630de3a1419ef9e800cef18c34378f88a1e249686fc0d381b24046f167aaf53766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958931, "uuid": "b0d52f13-31a4-49a3-aea5-f3006e0b2743", "value": "T11336D003E342D547C20A18B48165C3B1EB53AEF165A98347F6CE7E1BB7BE7904977282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958931, "uuid": "07e40d95-468d-4288-b761-bdd1390b648c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958931, "uuid": "17246ade-1996-4b0d-b5f0-848fddac4bea", "value": "49152:5v3/SL9sw1QWwosK1S6Tt1DEK9/dRqE7T261nV5hth4Zuwk8IAUGl5wKNBilw+Wj:5SLOw1QWwosKg/i2E80W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705958931, "uuid": "cc446ec9-aed8-4c39-9aa5-7abef8fa4dd4", "value": 4913600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705958931, "uuid": "bdb2276f-57e2-404f-a211-c6386a19c627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958931, "uuid": "f443c953-3fe9-4491-821d-ef8a19e6277d", "value": "SecuriteInfo.com.Adware.Linkury.150.467.4892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e9f511-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1705916832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916832, "uuid": "cfe05858-d122-45e6-9531-01fa8757cf01", "comment": "Malware payload (DBatLoader)", "value": "73dfbea64daa3414f875039fc0bfb65e", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916832, "uuid": "adb574c1-da92-49d5-a9e7-909487df3059", "comment": "Malware payload (DBatLoader)", "value": "9ff38738b6189632eea9c61185e0d722879941119d3ff43cf44443fa9a58907b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916832, "uuid": "5693e16d-84e4-4abd-906a-94392702feed", "comment": "Malware payload (DBatLoader)", "value": "c6ec6569da44183745b96f8c368a78aa03bac4a4", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916832, "uuid": "59fcd45f-67cd-457f-91fe-1a38b07f4d40", "comment": "Malware payload (DBatLoader)", "value": "fbe7e1084c0d5307381794b340359c16e920b16aa4fbb298756b2cbfee856ee457afadb2bcabb8f9f7a50c2784a629b4", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916832, "uuid": "1141c641-e24c-4047-b65c-814f24e9fbe9", "value": "T137D5AE024F7CB862FCD5C936CE6773A4EB653E31AD60859232A978DCD936E9D702D012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916832, "uuid": "ff92fbd9-07ac-431e-be69-8f6518ad0ef2", "value": "02e3ebe88b2a6296bb4b034e0bd03814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916832, "uuid": "f86dc493-2ab2-4b5e-bc69-4eff4c6dccbc", "value": "49152:xDWu2Avcfk5wAQaEOsA7M0enZFnZrABL:xyu9uFX0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916832, "uuid": "055a76ff-bf3b-4114-9dfb-3a936f64735a", "value": 2774528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916832, "uuid": "9bc4446b-24a1-407e-b7c1-5149b33e9e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916832, "uuid": "0afcc60c-8430-41d4-bfdf-ed90f419f7a9", "value": "PI and payment confirmed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863b7324-b95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705952612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952612, "uuid": "e90e370a-a21a-43ca-8b62-ea5557e081a0", "comment": "Malware payload", "value": "085d3471e880c5f53fd98df14ccc23e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952612, "uuid": "8ad749f8-b1d9-4933-a340-3f0d461e29be", "comment": "Malware payload", "value": "a154dce9949ad0786441d80feb36159e1197dc45d6b2101d5831bffa5bc46fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952612, "uuid": "aa8a7281-10d7-4548-8a86-657416a44c47", "comment": "Malware payload", "value": "f2783677b1bcc4e8f36492cb7068549d05e9aeb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952612, "uuid": "76d370b5-b0f0-47d8-87ee-600470b02642", "comment": "Malware payload", "value": "7095bafe4a595f881e8f097598094a960a18d0e5ff699754245937d5e652e2fd9e02656794c0056becc27b023bcbbc04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952612, "uuid": "1a73e1ec-315e-4446-a505-28aa832e56d9", "value": "T15065D0027391D062FFAB92334F96F6114BBC6A260123E61F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952612, "uuid": "dcb5f383-9037-42a3-8040-c2d9b581827e", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952612, "uuid": "456b629d-8153-44a3-b8a3-65b38c00a4d2", "value": "24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8afoe6b29pfUrMPLe5Z:4TvC/MTQYxsWR7afh6a9mrMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952612, "uuid": "bddfd96f-3536-4aeb-a1ee-2040e4835bcc", "value": 1424384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952612, "uuid": "77aea93d-2f72-4cd8-9a15-2e4629e31586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952612, "uuid": "1c92c19a-086b-499c-bd95-2d095788e1eb", "value": "british.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fecaf87-b8d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705894431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894431, "uuid": "bf8e2536-918a-4752-906e-dba85644a36e", "comment": "Malware payload (Mirai)", "value": "ae3458149d704c3c1ec3cf823e1790f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894431, "uuid": "e68fbdde-081a-41a6-86a4-b45e4ac49206", "comment": "Malware payload (Mirai)", "value": "a1b99e9e96a0e2a22f3be0a1dc4691bd1f824e629aae0d7a4d18bc7b9cca3035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894431, "uuid": "0a4dc0b3-7104-4721-87d8-24f2ad5369b1", "comment": "Malware payload (Mirai)", "value": "8bfc4e1798b283e338c0c70bfc30f9434854c5bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894431, "uuid": "782dbf4a-c155-4fc6-adf2-471e72c94747", "comment": "Malware payload (Mirai)", "value": "16512bcc2160a6df9e47d294a9cc65abf8f103506c3d1c50b214cafdd576484d5c47edbb5db751b1283c59a8918b3638", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894431, "uuid": "f885e76d-2b6d-48a9-94e0-1bf00af35e9f", "value": "T17D515E47CF54B053D163207B91270397E7891634F292934F92755159CB060FB1F6E48A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894431, "uuid": "eb1130ea-8a9c-4318-b3e9-c2495d7760b5", "value": "48:A8dY1iaIuL1TKQFCzZEWK6HfykmHNZTLrJ4WpQudLlY:21ixSCzZQ6/uHNpLQMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705894431, "uuid": "d3120d36-a48a-4a1f-85e7-1bb2276a33a1", "value": 2896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705894431, "uuid": "ffba3d38-0fb6-4052-a2d5-30e545637649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894431, "uuid": "2b28218e-af97-424d-8c29-7e56a03cddf5", "value": "SecuriteInfo.com.PossibleThreat.12621.19226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d806fee4-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705917101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917101, "uuid": "c9d3e8f0-5bca-4d5d-947e-a53f2fd6e519", "comment": "Malware payload (RemcosRAT)", "value": "2707b9ed82b1deda4cb0ce3cc3e727d3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917101, "uuid": "5713e2a2-d0a7-496e-ac16-ca423c043a3f", "comment": "Malware payload (RemcosRAT)", "value": "a1d323166349f499aa796148c0120f89d3a0946abdf74f0dc045c5641b2ab2d3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917101, "uuid": "d0198a14-96b8-4e92-924c-1b239e776a2d", "comment": "Malware payload (RemcosRAT)", "value": "cc9400861fea3deee8815eb34b7f5879fd6ca3ab", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917101, "uuid": "29f4ffbb-dc31-43fd-895d-5e0f89d7b7c2", "comment": "Malware payload (RemcosRAT)", "value": "c32389400912d0b5bad06e79df37797f8e917b4ec3a8d240d65f82f94dd0dbcabc193e58d2901b0dfd1e1213da4e9300", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917101, "uuid": "9b4cf6ae-8c47-458f-8e47-d5339aa8a0c1", "value": "T14FB4236531DBDE7BC0C398700E95C1C726ADBC216E4DDA6B7478BB2C1CBCB809963256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917101, "uuid": "e327c369-6458-4a14-a670-be08f9607f01", "value": "12288:HSNbBC6uEkVQpozwjTqCfg7zcpE3GO48LV9lo2UVxtV:Cw6sfWWCfg3cpE6EV9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917101, "uuid": "6437a2d2-38af-4e75-80bc-259255193f03", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917101, "uuid": "e205bb08-c670-4483-8052-880aff85ddb4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917101, "uuid": "1bf80191-20b6-4cf2-8684-6a31c9b8baa8", "value": "[YG E&C] [TOP URGENT] RFQ 5100-ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee637020-b915-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlackRock)", "timestamp": 1705921434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921434, "uuid": "532fb90d-921d-4b61-bd2d-d2e96b581ae6", "comment": "Malware payload (BlackRock)", "value": "0d4a272052b87d098271ddfb6f4ea191", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921434, "uuid": "b9bc5327-3eab-43e0-ae9f-ed350095ec12", "comment": "Malware payload (BlackRock)", "value": "a25bf4bdb2ed9872456af0057eb21ce31fd03d680d63a9da469519060b4814bc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921434, "uuid": "8d457301-fd55-4d93-a9ba-13026acb8041", "comment": "Malware payload (BlackRock)", "value": "c1b3db52e0aa1798b9193ea7f1a2c8d7747aeec8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921434, "uuid": "95a436f1-7560-4f1f-b2f4-5804a538f972", "comment": "Malware payload (BlackRock)", "value": "eb63ebe748f63d3dd3f8945ffb91618e5718b3b4c865ec4b10ce360467ad4031766a32b0cc22b3cbd5c3fb7354ee861a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Blackrock", "colour": "#1B4CE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921434, "uuid": "029966ad-ff1e-4d82-971c-f62c7280a117", "value": "T1C5F533DED3E0E57AD16E0479D44990D1D22486904202F32B92BC61ED7EE4EE5B237E1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921434, "uuid": "c64bf087-7871-46c3-af4f-48b537fc3e22", "value": "98304:t91OL1lrWdyaMKcPr0clWlAP8r8VMZmARB9exM:t91OJlrWYf3lKAkroARB9exM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705921434, "uuid": "d930e3ca-bacc-44f1-b154-4e9b5a9445ce", "value": 3621025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705921434, "uuid": "94291bcb-b087-4973-8987-3033d2f85fff", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921434, "uuid": "9d140be0-2f01-4895-a419-9c744ca61cad", "value": "A25BF4BDB2ED9872456AF0057EB21CE31FD03D680D63A9DA469519060B4814BC.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04779b7-b8e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705898593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898593, "uuid": "59bc4acf-45e5-4bcc-987d-4bd92b880dc7", "comment": "Malware payload (LummaStealer)", "value": "aca826e6b69627eeed1cfe722a482cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898593, "uuid": "ac4ff0fc-0f98-4ed9-96c4-a0abf2ea008f", "comment": "Malware payload (LummaStealer)", "value": "a2a5dd8a66dd24dd6097f9983748b37e8ad30ebf14948b1c36d6804803d711ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898593, "uuid": "48916ff0-7368-4a5e-803f-a33b84a9f647", "comment": "Malware payload (LummaStealer)", "value": "d2a46c58b990a39ecaec8d3b298394b8a091386d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898593, "uuid": "3f040e7d-b458-45cc-9837-467155a0e747", "comment": "Malware payload (LummaStealer)", "value": "e7b4c0a9ecd9b867373da1153826c27f48dcdce8e435e5b162356cdd54d8de6bbc4192e5c3a6e6dbb15f29fd8c54aec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898593, "uuid": "a0c4f5ac-4657-4b71-b095-925534896127", "value": "T16DD4125E33C34B61C50944B0A0C7982502FBB3EB89F3D74F6DD945A61E82B95E71AB8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898593, "uuid": "756e8152-cd26-424e-ba24-266869608fb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898593, "uuid": "ba6f2d88-f0ba-46fe-a229-34527a40b058", "value": "12288:qPmDG/61OR8IkFXSxa5PCVOYBavBy7wFNF:vi/6kSIQY3ByBMKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705898593, "uuid": "0b1f1d40-bb73-4871-a336-593d845c97ff", "value": 612832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705898593, "uuid": "3a0c75dc-46ed-4ee9-8814-d341cf0533dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898593, "uuid": "be73cb71-1ef6-4933-b102-4fdf9c416e3c", "value": "codium2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc58516-b95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705952460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952460, "uuid": "da5d7efd-816b-4a2a-9805-caac93b1bc2a", "comment": "Malware payload", "value": "740146e67954278e436ea111a0583859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952460, "uuid": "266a7f5f-192c-4b64-be14-318f3cbfaf80", "comment": "Malware payload", "value": "a2c0f2bd38148f13253607c31e82011391750c222c9ed96f24b1a8082412d19a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952460, "uuid": "60b3495c-7261-45a4-9311-164a5bd48672", "comment": "Malware payload", "value": "4478dcfd3eb10cad4c1c5f72731c4afb417f175f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952460, "uuid": "b7f4a845-0ae3-47e4-b1a6-e30d37251bd8", "comment": "Malware payload", "value": "330eb762d4908f728f6652df3957bd4c6145bc452c04f7d5d723363a35b991623cc0a012abd88afca3b2baa872813cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952460, "uuid": "b34d5a39-d3e1-40c3-9107-d36ed859055d", "value": "T1ABB5CF51A3F411B5F1FB9275CA678732DB31F8451228831F09B0CA4A1F736626F6EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952460, "uuid": "eb580c81-ed5f-4b85-8ebd-b7f580ff32fd", "value": "3ed55bfb353c5fef468146748a90a8b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952460, "uuid": "8cc7eaba-ddf7-42ff-8a55-e251c2c41cba", "value": "49152:72Ljk8qyBOT0yYe9cPH93A9cRbdlMHkfkkrTz6qMMMLMMM1:6VqVgi9QZikf56qMMMLMMM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952460, "uuid": "daf1d99b-e1f3-48fd-a3d2-3f4b59927796", "value": 2297872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952460, "uuid": "f00060e8-cdb5-41d9-a159-0b1b161b5165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952460, "uuid": "f5cc73d2-5974-4a3c-9fe0-448a4fecfc21", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cec5b0a-b95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705952408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952408, "uuid": "98a6ab3b-61df-4b74-8085-f7c8bab2fcbd", "comment": "Malware payload", "value": "6ae9e6b744b2779965c89e3bebcefa94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952408, "uuid": "d78a9bd5-30b1-463f-8080-52fdb4085900", "comment": "Malware payload", "value": "a4d3d83b3d71b7aaba2dc83f5900ba3d0fdbc8a2a3d7d6fb763c7100d4fd13d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952408, "uuid": "22294b18-e03e-426d-9b78-1b6baeacc355", "comment": "Malware payload", "value": "a7b7ee4db5d3934f250e867d450c84aec09c75f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952408, "uuid": "22932875-a972-4274-9dc9-098b18ba9cbd", "comment": "Malware payload", "value": "48ee819bae4f4805742d2f86468f453316c474f22c23a6dcbbedb0312f4e3ecccff8125234558f4e62066b496ad04ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952408, "uuid": "b967d0a2-29f9-4e1f-946b-b0d0cab03134", "value": "T192C4AF01FAD1C072D57514300D26E776EAB8BD2019364A7BB3DA1D5BFE30190B73AAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952408, "uuid": "3311cc84-ec1d-41a7-8546-66b5966d29be", "value": "6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHSsAOZZsAXFKuj:6X7tPMK8ctGe4Dzl4h2Qnuos/Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952408, "uuid": "1a5d25a0-2f45-4730-9e64-0b5c93d533d5", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952408, "uuid": "d4588851-48cd-4b34-b911-d57a486d7ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952408, "uuid": "ce81ee1b-8c47-4faf-a682-526854703d91", "value": "curves.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0d986b-b94f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705946290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946290, "uuid": "48239f15-1867-477d-a487-a8b21261508d", "comment": "Malware payload", "value": "1566f890b4762d6547a17bb63c6030a5", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946290, "uuid": "d7f5295e-0fa8-4ee7-a4e9-3e4105d4a903", "comment": "Malware payload", "value": "a5418213e34f81913726f19cdeefa8d9e3d425a8786eda086e56faacea1372ae", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946290, "uuid": "ccee80c7-ce8e-4867-a112-17b27f9050a3", "comment": "Malware payload", "value": "97357a32982e1b3b56e4cc9895e41f641ede243a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705946290, "uuid": "c4ff72ef-a81e-47a1-8710-23d109aa4380", "comment": "Malware payload", "value": "189d6fdb0126ca10e65dc96041c530e9d0c2f01b64e2725d25ad3845b43f1ab7292a45a4478bb67093a56231bfcb7c06", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705946290, "uuid": "d5ee80d1-cafc-4835-9ccf-8c6255059fc6", "value": "T1FEC2F9E26AA458EE414AE55BFC147B4D346B907FBFB7674111B83DBFA1D2800C62CB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705946290, "uuid": "07ca35d0-7025-4ba7-abda-6ec96fb96c24", "value": "384:u1aWoWhW/XT86Yd0T19ykjRNLREyvTeA/D+Yj2G4BI3XmFQR+gp2SuF:OaWoWhW/XT86YdzckBA/Pj209E/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705946290, "uuid": "328f9e2d-0ca1-47f4-be91-f7a4a4ced82f", "value": 25814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705946290, "uuid": "aaa60164-9282-4f49-b828-10f417750e20", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705946290, "uuid": "c16512d4-4a00-4cdd-911b-b0d59eb89fd7", "value": "ukrNet .html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2faa66-b966-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705955840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955840, "uuid": "ed9f83bd-b544-48b7-8df5-aad19591d250", "comment": "Malware payload (Socks5Systemz)", "value": "efeb409d7348a8ddf4edf55f338a337b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955840, "uuid": "4fefaf59-49a1-424d-8f4c-95ab614af7ee", "comment": "Malware payload (Socks5Systemz)", "value": "a56db7832e5a3bec917ddda893b1137d6a2da4732a0c74ef7e67d9c995ca2c17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955840, "uuid": "4011dfc9-3931-4ae0-8c38-0062616492ac", "comment": "Malware payload (Socks5Systemz)", "value": "6e1030634bf79d1b5b48a3313970c1fb986110d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955840, "uuid": "26e0be83-9739-43de-84d4-2827715fbc6c", "comment": "Malware payload (Socks5Systemz)", "value": "8cc8a6774790123a6f25a82b015689c3f6932b3093945e357681cb825b8885c727215444f4dc6660394762f10143a744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955840, "uuid": "4f337a47-5242-408c-8751-62778e72d7ed", "value": "T1A716020B3B2062AED16D47F4AC8BB0F27B08FF1EC32155666259A7B825D17C1DB13E64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955840, "uuid": "cebe29c9-536c-4b42-b253-d7f41fa6e80e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955840, "uuid": "0fa62b16-63f5-4c06-b9ef-bb3ed069e2ab", "value": "98304:ustBWcCejtbt0AhIeL0PrU1zG4Rs6qhsOj06YNN7/Wad358:hlbtOAhI80Pr/4Rn77/hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705955840, "uuid": "bcd3a0f0-60e3-4ace-90be-57a7012a0274", "value": 4288020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705955840, "uuid": "898443b8-b37e-453b-bfe8-edf759a46613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955840, "uuid": "3ae1079d-41e3-46bb-90c8-d1f8f7ac6d77", "value": "efeb409d7348a8ddf4edf55f338a337b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916b0302-b912-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705919989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705919989, "uuid": "293610e4-4732-4676-bd35-24e20e3be070", "comment": "Malware payload (RiseProStealer)", "value": "bd40bc6e22c382de44134746247061e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705919989, "uuid": "3416e9c7-035e-4047-8be5-c7084f6454bc", "comment": "Malware payload (RiseProStealer)", "value": "a59c6779c8917db0f98eee8efe8910b53ae5ffeee690cc8e8208741fefb5bcb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705919989, "uuid": "781160b1-fc51-4b49-94ff-e9fd25d83cb6", "comment": "Malware payload (RiseProStealer)", "value": "1e4875c4dafe9c25a3f0a094af42167312ce3caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705919989, "uuid": "df8436cd-1b9a-4d70-9b21-3c6a7be1944f", "comment": "Malware payload (RiseProStealer)", "value": "11ac8921e6e7f881bc77bd5367b9f834fa7bd170ee63dacbc1d06017796f6e7169d697df149c195d5b090b14a63e99f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705919989, "uuid": "e89ca0c6-6a44-4a0c-80d9-3dca1396b392", "value": "T1373633865EC816ACC19E1F344E73AE6DF8F46A3C71904E1E15A4EBC67DBA17460F600B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705919989, "uuid": "8c65755f-9dc0-4cbe-adbd-e6b5329eb060", "value": "d7e9a9767ab3095bae27ad1d640070c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705919989, "uuid": "9249c4d3-9d3f-4213-9f3a-601a488c9dba", "value": "98304:K6JdR82MJT/uYoGQzHqgONGJ3rg1bD2dvrPmmMfCSIL/ZWxy2MgyMnLRaAU:K6HRrMJIzRONGagrOfY0LRTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705919989, "uuid": "efbe7287-82e3-4ec3-b322-2c3b7ad14170", "value": 4884528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705919989, "uuid": "44fc00a4-6da8-46ec-b483-00a17e14c592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705919989, "uuid": "3ed30fa7-1acf-4a12-9086-0baab4d5f7df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5528444b-b95c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705951671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951671, "uuid": "2ec97d40-bd5d-4489-aab8-6d2ad9ac1e76", "comment": "Malware payload (RedLineStealer)", "value": "378dad7c41c2d2cb8f9a8848b0e503d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951671, "uuid": "adf258a4-f8a2-43a5-a954-07b6199289b4", "comment": "Malware payload (RedLineStealer)", "value": "a5cd964c8a054439dfa9e65370298ddc3cf5ce34c4e2f61c5107c45761acbbdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951671, "uuid": "39a73b0f-5f64-4cdc-a3e6-1d15013b4136", "comment": "Malware payload (RedLineStealer)", "value": "a432234df1e3fe080345665275f71edbb8017861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951671, "uuid": "3b14189c-3b54-4aa0-99cd-96b055545ed0", "comment": "Malware payload (RedLineStealer)", "value": "f6cafb33f4b4bb222d7b221fa00891428bd40f28c6219a79dc56247f6cdbf1c350ac38e26b04a2dfe1509b0b3d343963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951671, "uuid": "ffa774f1-5021-4998-93ac-dd3ef6961d1f", "value": "T1F5943996B0A10A5DD08C6DB36E54C0CDA98DB99FA0BB7FE3F517D0081E267651092EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951671, "uuid": "6938c3c1-7e2b-419c-88dc-30b26cbfcb41", "value": "06eb4d13e1bb2dcafbe526f4a64db1ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951671, "uuid": "b8ac2d28-ae2d-4ce8-8f10-d6f5d8e8f55a", "value": "6144:T/PpLc4vK6DgfzNt0aaNGHaGnwWmgz4Om/cftA0+dpK9Sh:b5c4vvEkGH5HJLm/P019c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705951671, "uuid": "40a50566-b509-4f31-947a-8824179a7f4c", "value": 434329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705951671, "uuid": "eac0d33a-209b-42f2-bbbf-f41f017c7dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951671, "uuid": "c106cee6-547c-4b69-93bf-28e4b94c3609", "value": "sando.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cc4ea0-b966-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705955836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955836, "uuid": "5e40ea9f-4837-4177-8d7f-9a51b8dd8735", "comment": "Malware payload (Stealc)", "value": "46599a37443ee1d3f088411392a789e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955836, "uuid": "8fcef6a4-7ffd-4098-ac52-7f4d212e8f49", "comment": "Malware payload (Stealc)", "value": "a60c272105b2802b30743ba02681632fc5edf538222cc31bce6cdb815df5a097", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955836, "uuid": "30662bc7-9afe-465a-8aca-5ba69fbc8934", "comment": "Malware payload (Stealc)", "value": "dbfe0ffe62d35f420f81f8d12f1cb92d67655962", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955836, "uuid": "88d631e5-4d28-4d00-9881-6483c90cf753", "comment": "Malware payload (Stealc)", "value": "d1e9fe72d15f77ccf8506af9542cb3644a6c39fed6d74f79569abb8ce95f79930b40170ef6fad86fe804a8970bcf4dd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955836, "uuid": "31811012-3224-4373-b9fd-b7bf75778cdb", "value": "T1E956F1D863C66684C3B94B7F0BF1757AA7077F071D5285FC9EDA96EAC0125A080788F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955836, "uuid": "a1a03cc2-7524-41f9-802b-47feddcf20b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955836, "uuid": "536af2d3-32eb-4cb4-8003-2b1c12f08416", "value": "98304:lXa8jw1t73VoN1x4YULUT2MF27QydQJMa/Vr205pVmuOUT5iwidXph8166fNQR1O:c8kj7WNLDUofwcyd+MetguOyjiXpq1m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705955836, "uuid": "abc4396d-ef87-438f-8e4f-23fb27d44756", "value": 6169088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705955836, "uuid": "eccb5c76-0562-47d5-bb55-deaadc1f5e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955836, "uuid": "1d47491f-c967-469c-8c3c-46a4ddc50afb", "value": "46599a37443ee1d3f088411392a789e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d62162-b90d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705917612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917612, "uuid": "a6c9ad04-63a0-450f-b363-35a056454081", "comment": "Malware payload (AgentTesla)", "value": "43171ab17feec8b9a3ac85eee29ed023", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917612, "uuid": "644d1cc0-918d-4223-a773-75bf4ce78e1e", "comment": "Malware payload (AgentTesla)", "value": "a6c2977a2692320b5327b1e2aa17ab2e278cbdbfea3c686b18be49e7a3f82579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917612, "uuid": "8832b508-f4f0-45a9-b31f-2e75204cecb8", "comment": "Malware payload (AgentTesla)", "value": "a3dd6bab92e4b51f05d5dab078269f0aa5d5e176", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917612, "uuid": "f0c62acc-0e8f-4198-a3c8-586acab2f450", "comment": "Malware payload (AgentTesla)", "value": "f482392f5bdcd355c1f624a31b63216be8eaec94df1bd8632b4e9611e7ed2478ed0ba8b7bcc9a0ac478fc0b9336df2d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917612, "uuid": "7be34381-bcb2-4dc9-9da3-d29116855a2a", "value": "T1F594EF007764D45BD5DD0E704DBFE2FE8E65BE036950460BE290FF4E38726C1B98A68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917612, "uuid": "1d6789e0-7277-44dd-ab5b-73d2383964a5", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917612, "uuid": "59472cda-3001-4ee7-9296-5041c3f825bc", "value": "6144:/4t6Lsvq5WSBHT3LJn0grnBOERl4v/+tWORFwA90og6cjmSlJeC:/kvqcSBHT3LJnRrBZR7LFv9tpcCoJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917612, "uuid": "5db03fb3-fae7-40bf-a36a-b0dfca3d7930", "value": 431272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917612, "uuid": "b9a5237a-a259-4846-926b-e095f07b9c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917612, "uuid": "17b345ad-ef0a-4a3b-99be-b076a30fb000", "value": "FATURA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340cf615-b8df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705897928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897928, "uuid": "f39758ea-a1f6-4520-848d-328606454146", "comment": "Malware payload (AgentTesla)", "value": "c78c698c29ac50b62f0980840f171982", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897928, "uuid": "4ff08e05-0bbe-458d-8699-2c5c009cd86f", "comment": "Malware payload (AgentTesla)", "value": "a72e43fa37b46c6c05aae87485a78b39a69d82624a447bc4a6f2481bcb892709", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897928, "uuid": "cc2680d1-f069-4c8a-a49b-dc42e2a97abc", "comment": "Malware payload (AgentTesla)", "value": "60141babd41e058fecdcdf2f474e3619b95ff94f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897928, "uuid": "f98867fb-4920-4bdf-b422-f9161ffa72d5", "comment": "Malware payload (AgentTesla)", "value": "e92b43642427713c08a2910b30c716a13af129b7c69bf7668d68dace08cb86c6e5c337ca21276c9e7df60b50c4addf74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897928, "uuid": "6641dbc0-2497-4c3d-8762-50fd58b3f84f", "value": "T113D4126533BF1FBBD0F287F99A52289843B275266205D3ACDDC130C78865F0A9D91E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897928, "uuid": "f06f2122-f53c-465e-8488-760dc7ec3f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897928, "uuid": "f9ab1453-7beb-4bac-8d1d-2e78b3359c6c", "value": "12288:yoa7+rFGUSayGYevoJNfFeG5uyvsLcmsr25sMTVm:aYFvwJNcG5ZPmRmMT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897928, "uuid": "5ffed899-e6b1-4d8b-a312-ce4307652334", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897928, "uuid": "eca0b798-99f6-40a0-ad4d-b92a38b37d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897928, "uuid": "b1c839e0-32af-453f-8281-3cc058a46fe9", "value": "SecuriteInfo.com.Win32.PWSX-gen.29415.17165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad31fb28-b8e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705898561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898561, "uuid": "9cab65dd-6096-4906-9209-338bacda3cab", "comment": "Malware payload (Socks5Systemz)", "value": "83c2ba9a81f76e75297c62b3b9b7bd12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898561, "uuid": "33982cbe-3ead-4b9d-9aee-f0cf0981ab1d", "comment": "Malware payload (Socks5Systemz)", "value": "a79e64ec7421ed5e5a7c718b390f78a8a06008271d4c844a055d9f42c27901be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898561, "uuid": "1f730549-5a8e-4d44-864d-e4a9649b45c5", "comment": "Malware payload (Socks5Systemz)", "value": "4c00b6fffa02403470fb4ce476321fc75b57b2f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898561, "uuid": "9ec9cc1c-8836-409c-9591-3f62747079c1", "comment": "Malware payload (Socks5Systemz)", "value": "8f00e3e911476c71fe5a8c01d38e0d607434fc542acc58df31b9fd2c2a75a388c0afbb2ad093eb02e99fa92a7242915a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898561, "uuid": "5ed651e5-e872-4b33-ba18-6cf1cdc22c4a", "value": "T1B01633027F0056A2D3419B75DDE1B354DE72FC4EAB221207A64FB2CA0D6A7E1ECB52D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898561, "uuid": "4a98607c-d539-4f58-b373-f837adbf3c50", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898561, "uuid": "45598803-54f4-4531-adee-d18a28fc71a0", "value": "98304:6OilIqTXEyb84jBh1ZH8/AmSzth3s/bcPWMoOT3d358:sIqrEyLh1eSzthc/wPWMowk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705898561, "uuid": "3998faf1-0bc5-44bf-ae1a-980453fc962f", "value": 4155645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705898561, "uuid": "b4f3b0e0-1779-4c82-b077-d1c4d6af4309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898561, "uuid": "2736e76f-60f3-456b-ae6f-d977f09bf42d", "value": "83c2ba9a81f76e75297c62b3b9b7bd12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab8131d-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705923360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923360, "uuid": "183fbd83-ddcf-4758-9956-93a95914a383", "comment": "Malware payload (Formbook)", "value": "c64f111968f10dbc5939569f98f5a669", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923360, "uuid": "105c2df7-772b-43a1-9130-9b9008662d2e", "comment": "Malware payload (Formbook)", "value": "a8c570d66c707299d6eb13c3a82c3e531cb516ca3c683f8037ff04833d09644e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923360, "uuid": "7b6b034c-6bb7-4d4b-8815-7fe62f8a9e9e", "comment": "Malware payload (Formbook)", "value": "20c10c6ba5310c280244d499279170cb72d2f852", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923360, "uuid": "11bf91e9-d8d4-49a7-9150-e684f2441960", "comment": "Malware payload (Formbook)", "value": "1882edbc2d34453c676709e738c1b750e52bebbdc5c47cf64cba0c618ad8afff8b30cac979113a8710d1d4af112e5787", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923360, "uuid": "1f11478b-202b-4b68-b5e8-cb9a816aa8c0", "value": "T1BD62BF2EC447BE21A033487D0029EF5D91A59FEFD17B81BA958F0E85ADCB06E5E864D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923360, "uuid": "a5d62a2d-93fc-4868-94dc-4cc09e3aaa22", "value": "384:tlDU/dJoiUlORblbVJdhBkklDU/dJoiUlORblbVJdhBM:L2OhYRblbfOg2OhYRblbfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923360, "uuid": "7b52ef0a-5277-48db-b7ab-fb8cdf77688f", "value": 15553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923360, "uuid": "690d57e3-feae-4792-a6ac-f829700cd0fa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923360, "uuid": "7553e029-73db-48c4-bcc5-570700775038", "value": "nAl_Adrak_Contracting_BOQ.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b67fd4a-b916-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705921536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921536, "uuid": "117429ee-ec2a-4546-9191-8b50fe5c7ef2", "comment": "Malware payload (Socks5Systemz)", "value": "4c79d8dd89f2e03d7567315c8ab611c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921536, "uuid": "d51ab95f-9bdd-4b5f-9475-4bc0c03918c9", "comment": "Malware payload (Socks5Systemz)", "value": "a9a2d70167b5961ce786f7fea3d075959bb8144bbc23d26e2f9b20c662fc4391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921536, "uuid": "6dfbed19-ba9c-4f41-a6f8-5897db9be4f0", "comment": "Malware payload (Socks5Systemz)", "value": "8f3fd908d09d1c14783da7be92c59044be00b951", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705921536, "uuid": "a87ab3b1-4ed4-4faa-902f-508357d13523", "comment": "Malware payload (Socks5Systemz)", "value": "69e207f2a5d1201c4af29037b1962d7e2dc74094908046fd15087ee2807d2a7469bb252a15a8a285ff9bace56b9d7301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921536, "uuid": "7f637893-d408-44f1-a852-3267ef02df22", "value": "T1844633027F44A277D2918F34DCE2B348DB71FE5E1221461A2ABFE1C82C55BE41E762E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921536, "uuid": "c04e6421-8827-4200-aebb-64586cb9c899", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921536, "uuid": "bba27aad-e68a-4809-be48-14d11d388541", "value": "98304:Cn98jUacXVLc+d7c1/YYEI2lL9CYa4+39DYgODhh9NPY0Jqxv0Th93d358:Y985CVLcQgJILW4e9D/8hfY+Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705921536, "uuid": "01b38975-733b-4864-a112-62bee6dd00e9", "value": 5516517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705921536, "uuid": "89dfb22e-1681-49e3-8c11-dcf69d7055e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705921536, "uuid": "a642f216-da2c-49a5-978d-a46392e55666", "value": "4c79d8dd89f2e03d7567315c8ab611c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02823ec2-b95e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705952391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952391, "uuid": "5c312845-595b-438f-a2b5-ec6614a2ed75", "comment": "Malware payload", "value": "8329713e982d98e9cf630351aa34e13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952391, "uuid": "ee62fd1d-8d2b-48aa-95d9-65e008e1fff5", "comment": "Malware payload", "value": "aa706e499613709437557585c58599059c2570f5e68ca1db32156d7e38415f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952391, "uuid": "63dd7e8c-53f9-4c50-9e53-75e1c5db51de", "comment": "Malware payload", "value": "050acc0515574f95f6e101b165899313d68063c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952391, "uuid": "e56f22a6-260d-4375-91b3-ffeee34eb9bb", "comment": "Malware payload", "value": "084bf9179feff2020d7261129ec97f6a60263933794b75be7e6a92a699cc8702ab801bb559f9234322a18d4a9f415b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952391, "uuid": "878fbc82-8eab-4ad2-b5f2-d81c84101791", "value": "T113852396BB61C2F2D41810B96515CBE72CBA3CB80B42EED337D6164E5D641C2BB72723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952391, "uuid": "a57d182c-bb2e-4a5d-8cd5-b37bfe8f0f8a", "value": "56176109b52a452352dd6749c77c0578", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952391, "uuid": "4d14f2b4-ba4c-40ec-a032-c57d3418d8ca", "value": "49152:7ZlD4I7MAOJLrxaCVGUjdwUxTha+KHNoe:tlEOMAIxrGiqHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952391, "uuid": "acbc74b4-efbd-4942-902f-5e75fd36f8f4", "value": 1867776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952391, "uuid": "1c7fb921-a7f5-4549-a4bd-d3483239b7f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952391, "uuid": "a3588c2e-41b7-4820-9274-5f42faf9fce9", "value": "WinRAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a29a07a-b902-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705912944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912944, "uuid": "db601439-6f4e-4c78-9786-1925fa35205e", "comment": "Malware payload (Socks5Systemz)", "value": "a235e30f90a078107846ac1d3dabc3f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912944, "uuid": "aa5f4b41-f12b-4dda-bdba-1425933aa0b8", "comment": "Malware payload (Socks5Systemz)", "value": "aaef09f1cf81a773ae00f923d700327522562f7ea584df9873e65a86702ec05d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912944, "uuid": "04e68026-d9d2-4f9c-b44a-f899fb9e475a", "comment": "Malware payload (Socks5Systemz)", "value": "3b4b17bb015f6895dadd1d28b95903a48f1f8799", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912944, "uuid": "2ac3f624-d066-4d3a-920d-91ac96270a6f", "comment": "Malware payload (Socks5Systemz)", "value": "46c1355c72d9ca7d7d865d989d1c2f02c7cea3efb4ca957fbf613e5930aef7fdeeb6859497a3a92957ef8a6ecceba05a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912944, "uuid": "b2a1dee9-3d41-4415-89d3-a5dd5d01c618", "value": "T1802633013F821BA3D35456349CD2B228FF35FD4C7B2662032A9B96CA1D467D19DF22E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912944, "uuid": "01442ddc-adf3-41da-afd6-365ac1b57636", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912944, "uuid": "61fe7135-4c80-4a55-90d0-168af1d5ee17", "value": "98304:6771yW+5PI9zo1QjrMmXemgl9BD7katd358:O7wW+5PI5o1QPMIe/BDYyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912944, "uuid": "e8009e73-b7db-4e8c-838c-98b50c696ad4", "value": 4569646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912944, "uuid": "ecc6d980-c2ad-4097-b793-140e2bf7b714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912944, "uuid": "33f71a09-b687-44bd-a6dd-1125045fa492", "value": "a235e30f90a078107846ac1d3dabc3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c886f86-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705950690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950690, "uuid": "d8c516c6-f5ee-42cd-853f-3c20ebd38f3b", "comment": "Malware payload (AgentTesla)", "value": "d9a97b835a9a5ce057d26802bf5f3aaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950690, "uuid": "5e0f224d-a174-4922-a1a1-3d01230624c5", "comment": "Malware payload (AgentTesla)", "value": "ab1af59ee510b2f334a0b719b480ff098463061552c7463347de4dc77757a179", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950690, "uuid": "96d95f98-c976-4a35-9874-2ca1be84b37a", "comment": "Malware payload (AgentTesla)", "value": "7b752642f2ca8eb89a3a62e0db60909b91b2586d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950690, "uuid": "f722a05c-6f6b-4f56-b999-02ab4e61b1aa", "comment": "Malware payload (AgentTesla)", "value": "7268933e75e94c87f090a037eaa4cf32b68dcdb9914f0662e86d9bc8d9e264694cea9c57c06b963c56b4f083fa9c9d60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950690, "uuid": "f04e3d5c-af17-4907-a892-f8c25e70ef83", "value": "T16845AE0273919022FF9B91334B56E63157BDAD260123AA1F13D81CBBBE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950690, "uuid": "9c1c7f02-396a-485f-8115-9453d76a0b9a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950690, "uuid": "e1f70f1b-1f24-4a1c-8829-8ef97d2b4535", "value": "24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aLyh+WSJ8I:uTvC/MTQYxsWR7aLyhAJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950690, "uuid": "ac070075-c1e1-4244-96e1-403a9b7226ca", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950690, "uuid": "39f188dd-4ad5-4070-8bd3-81974268ca2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950690, "uuid": "716bac29-bbe1-4d8e-a81b-6e52eaf337ac", "value": "facturas 000005111, 005112,, 005113, 0005114,,, 005115.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d684d27-b932-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705933673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933673, "uuid": "bb69b970-65ae-4087-a5eb-e4e3dc2e37f1", "comment": "Malware payload", "value": "3b1c5522a934b8da74492d1931869571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933673, "uuid": "fdad49bb-c2d7-494e-bde5-b3d2c37ac6cf", "comment": "Malware payload", "value": "acc5d42818e5d2d443d85427fc64858cd9bc8d46366b3d796259c85ba3e2ab09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933673, "uuid": "555dcb83-b78a-45ec-9bd5-b304c4f2b396", "comment": "Malware payload", "value": "141d4faecefb6056fb9ac7070b84b38e0a9bdf73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933673, "uuid": "0b0ff1f0-f7d4-498e-8e5f-6bcc49708746", "comment": "Malware payload", "value": "4f35bb304d58c97106c9b344462019173dd2394a6053795b4ddf7b91556c4821682e19bc800e66c815f126e1331420b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933673, "uuid": "110c05d6-6aa2-4a87-bb03-fec36056b76a", "value": "T18A858D22F4C2C0B6EF710C705FE97665CA6EAD28172545CB6EC979B9493C0F01A3B627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933673, "uuid": "e598a58b-86ec-47e0-af66-8a06a417860d", "value": "a5ed1da3dda39cade185a7a27576a4ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933673, "uuid": "d7000dc9-894c-4dc3-81d4-4007d54f470b", "value": "24576:OD6JIO14QirBitn0V3Ja7N0RvoswesE0X2ZAAjn15rS1xjd/U:z1S8tiUJuQb/B0AAZ5roxjd/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705933673, "uuid": "7e7120ae-ac88-4da6-b20f-63066d50a6b3", "value": 1839936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705933673, "uuid": "25c0a97f-3dfc-4df0-94d6-d0a4fd18c3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933673, "uuid": "99bf3780-8554-4490-a8e6-775f1fc1177a", "value": "SecuriteInfo.com.Trojan.GenericKD.37492465.14534.2817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ffd088-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705950756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950756, "uuid": "45b836cb-7b5d-47a4-9937-fdf2a71c75f5", "comment": "Malware payload (Formbook)", "value": "dda681d58b157e53dff58dbb3cc13a14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950756, "uuid": "7b252c69-05fc-4661-8512-aa6811825fae", "comment": "Malware payload (Formbook)", "value": "acf69401a803cffbd730398ac25023dade03bebe74dc237f300bad953df976cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950756, "uuid": "aed37001-1775-45ea-8e2f-15a82b61aac6", "comment": "Malware payload (Formbook)", "value": "7fd6a8910ae06ff35f6628abe625f8fed9aa218f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950756, "uuid": "b65985b7-bb8d-43c4-9924-a5062f747d19", "comment": "Malware payload (Formbook)", "value": "3d217222d797316209913bd9c71559819a2e21663b2152fcfea2bbb4ddb38b4dbe25cd294db0fc7829d6496c84c2c637", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950756, "uuid": "460c0f5f-ea2c-4ad4-a80d-b8623896d3d1", "value": "T17C556AB22BC37011FE6A40F2FF89A54C077F585244169B4FD294986F6EB35E3422D6B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950756, "uuid": "5a4d896b-1a3a-405c-b613-341258ebf963", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950756, "uuid": "9f5c3b1b-e008-4ed2-84cf-9d8722efdd01", "value": "24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8asXGDE8:0TvC/MTQYxsWR7asXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950756, "uuid": "c185c37b-df77-494b-9286-c8122eef0bbb", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950756, "uuid": "fd0f0ca8-219c-4361-8298-cab2d21c3f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950756, "uuid": "8cd6110d-8954-4385-ace7-61442a819212", "value": "Detalle Factura_001-008_0000734264.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12848da1-b924-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705927507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927507, "uuid": "9811922c-7de0-4c5f-adf9-e732f631b956", "comment": "Malware payload (RedLineStealer)", "value": "afa4b5293faaade81fdcfb074a0f68f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927507, "uuid": "9a6b38aa-4ea6-4c4a-8e3d-4878d86edb74", "comment": "Malware payload (RedLineStealer)", "value": "ad54b9c45e35baf130eb1f5f5ffa49681ee47426e0df07c664e78f9105e452ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927507, "uuid": "04396bbc-fafe-461c-bc63-079acf115c47", "comment": "Malware payload (RedLineStealer)", "value": "f92b8bb183029f98ea497513e4e625354f44a20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927507, "uuid": "8308c0e0-bbbf-454e-8cfa-a39bfa57abbd", "comment": "Malware payload (RedLineStealer)", "value": "b8828402f9b0c29ef5346a841d38bd5c1b436f32eacd6b56ce3603fb4baac2b0c4c2e0933d27cabb05a30a9780cffb90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927507, "uuid": "d588e510-dbfb-4bdf-9f5d-150ffea49817", "value": "T1B8646B1873DAD902E23F57B5A4A1D1715374DE12E513E31B2ED82CBB3D22740EB126BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927507, "uuid": "02ae17d3-74de-40bf-bbe8-1be35f14850b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927507, "uuid": "f7b40b03-017d-40b1-a778-5254825fb49b", "value": "3072:gfkCpXpfxIzbBePckWk6kVYmGmO+7GnTNSC3gILkBaWLkBWkrk34dTvs+2qj4j+P:lRg3BPxaUq7zMRqTjD4IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927507, "uuid": "8db253da-97ff-4a1d-a2c9-72be6acbc9f8", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927507, "uuid": "df046d31-764d-4b20-a2bc-bd7a645b69a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927507, "uuid": "09d2ada6-1b4b-4f5d-a37a-a39f565d741b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4530ba11-b913-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705920291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920291, "uuid": "d0ecc274-7955-43a3-a877-f67126f0a6be", "comment": "Malware payload (RedLineStealer)", "value": "35399d2bad767652cb749359e99df165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920291, "uuid": "3b9d3ed7-58ae-40cd-b0cb-2a5cc96a8331", "comment": "Malware payload (RedLineStealer)", "value": "ada725f2367c5e6f1ddd0b80f298cd5b6795d03ce500c1f9a4c01bca3764bc2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920291, "uuid": "29fc30be-28b5-4409-8671-09596ebb6bd1", "comment": "Malware payload (RedLineStealer)", "value": "e8169f91f552a266e421b860d3de78172f51de3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920291, "uuid": "501ff6a0-1f21-42a6-b294-e15f87c9ea5c", "comment": "Malware payload (RedLineStealer)", "value": "ea79cf1bc70610a36b71cafefcc039e987696cf3c9e846425f466e0562e9353aaabc845eb279e04afefa36139eab4d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920291, "uuid": "670a3802-3430-4dad-9c3e-65d05bf0f8c8", "value": "T1F375D0033381D066FE9795730A9FE620567C7D6E0123DA1F23952E3AB9B1262113F7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920291, "uuid": "8acb606c-a75b-45ce-bb9a-0a58a31b114c", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920291, "uuid": "a613ba82-395f-49eb-8b81-1d8f5bff3565", "value": "24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8a9d8Kku1OTm9xj7O2uxMoDcxrS:yTvC/MTQYxsWR7a9KKkuoCjj7kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705920291, "uuid": "282cd094-21cc-41f0-9ca8-1f8e79090a66", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705920291, "uuid": "fe6dee41-3c55-4ec2-900f-327e9a66a0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920291, "uuid": "af311d07-babd-419a-9b56-7421ca357e80", "value": "MACHINE QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd1a1d3-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948085, "uuid": "e4064f37-d835-4fad-a351-a3876e7d5c71", "comment": "Malware payload", "value": "68d4e3f257c6f2977cd19341cf1d2c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948085, "uuid": "b7a40a8a-540b-43ee-a8dc-b38f2182d235", "comment": "Malware payload", "value": "ae543d02df8d35657b2ac9612414b77a919a73568cd45eb28e7d8f196a0cd7ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948085, "uuid": "e477473f-eef9-4343-9d54-4bc2993b56e9", "comment": "Malware payload", "value": "8132aa208b2fa26c9fd06d558103efccc5b4b4d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948085, "uuid": "26cb23f2-baa0-4661-9bed-9a95ba64aec9", "comment": "Malware payload", "value": "164dbc559e2ef3eca9511906fdda8fc839e3041fa556a38d10f968ef7bcd9bbed9661f06aa21b10837e72f90ec507bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948085, "uuid": "e85727b5-8d91-4d07-b819-8ef6051f4c77", "value": "T1E215F7927DC9CF22E3A5603089B2CAED66657CF1CAD116073234661E6E37331F62A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948085, "uuid": "12c009ff-2b83-48a2-964a-e35ae6f8784e", "value": "5abf6ab454e460dbb30a2a8696dded3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948085, "uuid": "47b485a5-3647-4e28-9434-730bb8c94010", "value": "12288:Egby2lNwrn1GT9TL2CJLbrCy4hyvNh6u:EgbyMwrnIXJLHCy4hQh6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948085, "uuid": "d3ac71f2-3833-47f7-b172-bc7224026c35", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948085, "uuid": "11d06778-1ac6-42d1-b7ec-35f6bb8ce1d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948085, "uuid": "e6c17b08-86c0-4768-a4c9-f2d296178d31", "value": "SecuriteInfo.com.Riskware.Application.11330.30930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471a807d-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705917287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917287, "uuid": "3108542a-23eb-4ba4-88c7-bae9152a02ae", "comment": "Malware payload (AgentTesla)", "value": "852a8acf891de2fe02bfda2e6c03c625", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917287, "uuid": "f1a75763-47d6-4a6e-8570-62319624e85a", "comment": "Malware payload (AgentTesla)", "value": "af16f9ba5ea40f4fab4e280c23b516157fe5bd8aa0fe988160e5d943f9e4b35d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917287, "uuid": "0a1f5426-3373-47b6-a854-12d86b6f5d1b", "comment": "Malware payload (AgentTesla)", "value": "8a7ef3c08e2e21549a830382048969ccd30cdafb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917287, "uuid": "1ac32894-ebdd-4954-b955-a7b4a1f0dc3f", "comment": "Malware payload (AgentTesla)", "value": "9d2498ecf1e16dbf92669df63d9d233315d9f66148b2fe4ef340f39eea71326be5bb9fa67d0ff93148691799ecf823de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917287, "uuid": "2d152f40-f663-4f61-8600-0adba737f37f", "value": "T181D7222233BC6FA2D139C3F85801695447F2BEA99A95E2CC8DD131DB585AF884F60F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917287, "uuid": "0d851030-1e0f-45a1-b5b0-6a0160c9b1f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917287, "uuid": "8bc877f0-5061-4515-b4b0-832d8f567506", "value": "24576:SK4vPr7iKH85ecrMJDMS3vrMNHwc30JfJYFnYko:Szr7MmYyvYNHwcEMFnro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917287, "uuid": "4070dbc5-96a4-4f6d-9946-6fe8b3c42e46", "value": 62914560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917287, "uuid": "5a48ca7e-6e4a-4ecc-9eb9-e92b6a32270e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917287, "uuid": "e372bf31-1631-4b9c-bd5d-864397be3161", "value": "Supply List QT46178 REV 01 - Bubble Number ITEM 18 - ITEM 24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f07fe82-b901-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705912657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912657, "uuid": "e677a4a0-3589-48d8-81e4-203aa14ca856", "comment": "Malware payload (QuasarRAT)", "value": "5ccd609152c098eee751bd9f846b7c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912657, "uuid": "0370fc93-dac5-46d1-b117-a0196d9790cc", "comment": "Malware payload (QuasarRAT)", "value": "afa824ad9d8f2b1b0d54b0daff8f2363d1543afe214d8a3d7a21a258f1ef671f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912657, "uuid": "628039d0-ca4b-4593-89da-53a496522091", "comment": "Malware payload (QuasarRAT)", "value": "922a05014dbbba9cacf339ecf6c221cbb6f40aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912657, "uuid": "366b50f7-f521-4dc5-9166-bfc899c9585d", "comment": "Malware payload (QuasarRAT)", "value": "d0a0d0c8820a4f3ee784d1b73444c70027b4bc2e7700bb85d3e59317de1f5c83d99664775e550427922ef8278dc65edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912657, "uuid": "cdb5efe4-c26f-4eef-9392-a8945401ee89", "value": "T156E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912657, "uuid": "ddbf0ffa-323c-4a90-846f-e1f42f7a79e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912657, "uuid": "e306a4be-b541-4259-8a60-c20dace8d8f9", "value": "49152:fvLI22SsaNYfdPBldt698dBcjHnyRJ6sbR3LoGdGnTHHB72eh2NT:fv022SsaNYfdPBldt6+dBcjHnyRJ62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912657, "uuid": "f3921e1d-9ab5-4e42-8ee3-7fe08c503cb9", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912657, "uuid": "c872f875-9f0e-412a-aa8a-03c96b6d15aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912657, "uuid": "b28fbec0-f01a-4ebf-bf0a-dede402defd3", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc036d7-b910-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705918963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918963, "uuid": "7ed6f2a8-cbaf-4be8-a410-5ae323df0b5d", "comment": "Malware payload (Stealc)", "value": "3c65f0a20b1de81c19eac4133c64d0e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918963, "uuid": "54d86a85-51c5-4ad5-bded-40dd75d924da", "comment": "Malware payload (Stealc)", "value": "b0bc83ef24019693aa1ef84da931cfa1393561de564e7bd0c9b46e6164c2c169", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918963, "uuid": "295fb990-06c0-4620-bbf3-5487a1623377", "comment": "Malware payload (Stealc)", "value": "9b5df1471543b00cfedcc50907b324d667802dc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918963, "uuid": "f3f8151d-9728-49bc-bc36-24e7d36652f9", "comment": "Malware payload (Stealc)", "value": "2b395bf30c3842df37be54ddcad013e138a80aae9a82a83a7515571fadaeb93c9dc49567764edc754809e530f3dc3ba1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918963, "uuid": "f23a4d3c-0c68-409a-8e4c-59a8804d7871", "value": "T138345B87D2E67D90FA668B729E3EC6E8361EF1508F593769521CBA1F04B01F2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918963, "uuid": "5f2c5494-af2c-41ab-9ee1-4feb94d4a580", "value": "6772a34575cedb2362e5464a0a60f25f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918963, "uuid": "b3d4bc2f-d79e-4e90-84fd-32c3d246db77", "value": "3072:vHZNoJOLyGpd7Kfkd+01V3c9Akc78+xYlQqP69lx:vHZGOLyIJKfkdZWjgnxYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705918963, "uuid": "c77a68e2-a1f9-4c5d-a88e-be69473d2dda", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705918963, "uuid": "234028af-2876-483d-b7a9-26f037ee0f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918963, "uuid": "00435793-99d8-47e6-bc20-7f54d4f5b8b0", "value": "3c65f0a20b1de81c19eac4133c64d0e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc41ae7-b905-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705914346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705914346, "uuid": "784d63ed-6999-4a6f-aca8-b711e480eee7", "comment": "Malware payload (RedLineStealer)", "value": "c4349e2b7b51db1549c227e36fceb7eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705914346, "uuid": "666cb014-78fd-40d1-a936-94c8505ced6d", "comment": "Malware payload (RedLineStealer)", "value": "b10bef2b2ff053e1f2bff7ed1a7afbb0bacc991959ff4b18ae30710a13c5b413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705914346, "uuid": "1c2acf96-5e4a-459e-967c-db44c45ed58a", "comment": "Malware payload (RedLineStealer)", "value": "069adaf25a880663e9d307f19f16de03dedccb18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705914346, "uuid": "9315acaa-90bd-462e-89e5-f7119e96bf1a", "comment": "Malware payload (RedLineStealer)", "value": "1c14b40661b5afa22ce6c5297a1676c26fe3ab18d3e0314219002d65c6b866ce84d0a78ef03900c1c5af61b520c535b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705914346, "uuid": "9a53e40d-a30f-4065-bff9-5cae0aa7b5fc", "value": "T1F3841215B79F2B71C9498678C8E3412103FBC78719B3D78B391C00A66F52BD99EE4B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705914346, "uuid": "d419c46e-c0b6-4dd9-9b17-28cdf0927f3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705914346, "uuid": "f999dae9-0360-4386-97a3-02810298fc16", "value": "12288:QB1/EX2AiGOLxzduqW8sWw9UKcMemP1/4jBxvM4:QD/EXXiBxzcqW8S9lchmwz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705914346, "uuid": "42000319-4fec-4396-881d-53a2be1e4eb1", "value": 396256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705914346, "uuid": "74cf36fc-6b12-4b4c-9946-252fcc003528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705914346, "uuid": "bb7f5b4d-1f68-40bc-93fa-0765baf1ce24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432323d1-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705950781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950781, "uuid": "bd90f7fd-a258-4299-937d-e9c1ef91f759", "comment": "Malware payload (AgentTesla)", "value": "f665e2a0e57e71ef3541b4861969d9f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950781, "uuid": "2e517ff0-20a5-44f5-9aab-a3dd3027972e", "comment": "Malware payload (AgentTesla)", "value": "b2793636094e36dcedaa1b76a38a5da55aaf12573a3f6b8c3802a07ae960cc29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950781, "uuid": "e8b171ce-d82f-4ca6-b95a-45d578208958", "comment": "Malware payload (AgentTesla)", "value": "ebadfa4dfe86fa59cca03065017c705a04555d88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950781, "uuid": "5f7529dd-a728-453c-8527-f7eb67d69913", "comment": "Malware payload (AgentTesla)", "value": "1c396b13bd1973ef1cb09b173cf5e5caf85d7a208e24cc26ceac1c2279def5c9fd9b01c2f319304f638b95a9b8c34655", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950781, "uuid": "e4a3d2fb-63ee-4948-bb14-d712a796567b", "value": "T16CF4023EB3E5DD11C2DF6A37C193906807B1DB416223DB4A29D9631606073AB7E05BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950781, "uuid": "f2a5ac50-18be-4e8c-9765-cf85b135081f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950781, "uuid": "f44014c0-9346-40c6-911b-dcebeb28e4fb", "value": "12288:Yd46r/2iNhJz/IIHF3fKqHPQq4j8M7iDlm0lK8JiMVmPspnW4OhPdvs392JyO9K:Y2o/1HJz/IIHFv9H4xjjil9l8fPdk+yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950781, "uuid": "b98a9ae3-467e-49d9-bb9a-9ebcb9b694a7", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950781, "uuid": "82c476be-2858-4cf0-8b3f-8e85d9b726f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950781, "uuid": "0a0f6ae0-5e99-4f8c-a938-4b3955c4a61b", "value": "c7JFgVKLXMalusA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c09448-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705911648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911648, "uuid": "85556ce9-bc5b-473d-ad13-d333de4f5992", "comment": "Malware payload (SnakeKeylogger)", "value": "439774937b7b16754193c72ecd005470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911648, "uuid": "30968f2a-da0d-4756-8ef2-fe9d81f8e79a", "comment": "Malware payload (SnakeKeylogger)", "value": "b348825be831e3eb48ba5bee71b43e90073ba4d29056c86aea794dd1b6424618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911648, "uuid": "6d681b46-5c8f-4d00-befd-5e848875b0d2", "comment": "Malware payload (SnakeKeylogger)", "value": "19ebb3ea12b87bd844a61f5dc09b29367bc50797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911648, "uuid": "def66f4b-daa4-43b8-9ead-35f67a8de71b", "comment": "Malware payload (SnakeKeylogger)", "value": "24719fdc8c2fe8fea5f5455dd61b4a4f8dc8604459292a5bdd2325ddbe49977e87dc29558c8fd9ff06daa33db0b6fe34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911648, "uuid": "2fe476a7-c838-4cff-adee-1bbf95c967dd", "value": "T127C4120133FC8BA6F1B6D7FB26B0A4902BB67927252AE64C5DC520CD3D71B40C662B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911648, "uuid": "96f731b8-8fad-410f-85d2-e40b0fb2ead7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911648, "uuid": "60a203a3-47f0-48cb-8632-6a10ff13cfb7", "value": "12288:PVzo+ae73NHA2l2bpre3fRo+DkzicZd4Ly+:5eez6gape3pzYLZGy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911648, "uuid": "0e12ade3-70a2-4b0a-ade1-4a4883878d27", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911648, "uuid": "2a921e9b-f789-46e1-9ffa-7a8c3ad00549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911648, "uuid": "bbdca0f3-3134-4e86-a709-2146d8570cde", "value": "RFQ-2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89140472-b90f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705918687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918687, "uuid": "86156335-a8c6-44bc-8a81-c2dbcb48392d", "comment": "Malware payload (Socks5Systemz)", "value": "7c9e2bb2417a8f2b2611dd73d25e7e23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918687, "uuid": "b5e63a0a-afcc-4b99-ae06-0d7e32e7e1eb", "comment": "Malware payload (Socks5Systemz)", "value": "b3b8854c0dc1e5678ab99ae1c47f44a74eba795e1337a76f81cf236fa9e82f12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918687, "uuid": "2fde1869-b197-4702-96eb-9f6d5058117d", "comment": "Malware payload (Socks5Systemz)", "value": "7e350391feb0f9abf31adf98a68e8b4e7a46a08c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705918687, "uuid": "e278be7c-0dd7-40d9-bd89-98363102fd85", "comment": "Malware payload (Socks5Systemz)", "value": "89b46d61433c53bab2f2d7a913972b9dccac7b7fecb54f9beb514ec3c8eb530967bca3ca6ec52ed39753bc25a2dd7e74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918687, "uuid": "93f49ec1-784e-4f4e-8f2a-a5c5f6254891", "value": "T183163310BF54A727E3065335DCC67210DE36FD4DBA419B01BAABE5CA6E213C26DB26D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918687, "uuid": "65907006-da10-46bb-af6f-71048dfdc3d3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918687, "uuid": "13cb5a2b-c1da-4e17-b4ee-dbd133168673", "value": "98304:6Hz9m+lfKxow09O8+ASe2MYgkkjkYRVuWMUFhJ0Ahv+LX9HHOd358:s5lFKxow05JSIxkchRVuUIROk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705918687, "uuid": "7cc45eb5-0ed6-48f0-950d-f60fe0465f83", "value": 4375847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705918687, "uuid": "8d9c8725-0d04-4ee4-bb63-0c7bb352b731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705918687, "uuid": "a1d07456-c2d3-4858-9ae4-9edfccfa090e", "value": "7c9e2bb2417a8f2b2611dd73d25e7e23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6680ac-b960-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705953317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953317, "uuid": "a5c86988-5073-499d-9d99-80f927e2c471", "comment": "Malware payload (DCRat)", "value": "231ee1c3f6c71510bf04cdb835afab71", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953317, "uuid": "5a718743-956a-46c8-a8ab-3268d80f8248", "comment": "Malware payload (DCRat)", "value": "b456ef867ac67bfc770d662c7a427e1ac452d54fcd1b688c22fb8856a521197a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953317, "uuid": "41a25f77-281c-40d5-af3e-b9bf78389eb1", "comment": "Malware payload (DCRat)", "value": "642d798055cde5695bcc339be3b9291ef62a2e7f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705953317, "uuid": "1f775e65-bca9-41d5-9cb3-01e8a566f266", "comment": "Malware payload (DCRat)", "value": "6169c179913c621fd277ac1460f86a4f777d758e6f8ef5bea6bb2118d9cd742ba1069102920f7a28a506ad30d1768320", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953317, "uuid": "c801fe77-bc47-4b5f-aeb2-97f6522d3ae6", "value": "T1C705E6027E44CE52F4091233C2EF454887B4A85266A6E72B7DBA776E55123E73C0DACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953317, "uuid": "4033ecb7-81bc-4594-92da-3c70ae3fd183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953317, "uuid": "5ba9a917-be6b-4f81-bdcd-2b4b12618129", "value": "12288:vIwiLt3Sp/rhWa5s4EL4oRoElLz0HbIqGwURbLwm:diLt3SNhWa5sNlb0N2wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705953317, "uuid": "acb58e5b-c501-437c-bccf-91e4766ccf58", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705953317, "uuid": "ae1debfd-84d3-4fb2-9c40-875383227a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705953317, "uuid": "d6958a17-3d99-4538-ac14-979920b48bbe", "value": "231EE1C3F6C71510BF04CDB835AFAB71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1bc9d3-b8f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1705907637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907637, "uuid": "be16f51f-038f-4643-8221-cf4b8ba532a4", "comment": "Malware payload (Gafgyt)", "value": "fab8af1a6b5e2b545d8f428d46b77c9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907637, "uuid": "84a83438-c713-476d-a9a9-c108d5d8f7c0", "comment": "Malware payload (Gafgyt)", "value": "b48cb485fb9f09828f65bed21175155bd2645487b239397eaa297597ea15bd41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907637, "uuid": "fa54cc49-9c3d-4972-a555-6aaa501c7fd2", "comment": "Malware payload (Gafgyt)", "value": "9607f4711992f62b5ffdec1b5556e480b4ed6839", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907637, "uuid": "5b75180b-ac25-42a7-a3c5-85087796011b", "comment": "Malware payload (Gafgyt)", "value": "84d9889f7a117d2e49e7327653b10d5fe943b576297451f393f6b0319576ea508e70f2b04d12a804bae4d22670fd355e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907637, "uuid": "9abc34e0-4287-426c-be88-e9e567b84499", "value": "T1D1C32A2327670B23C4E9503441E75337B7B5CB843878934BAAD0AE9C2F1AAD435973E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907637, "uuid": "7f83ff76-1d9f-4fc1-8580-526a2edda967", "value": "1536:lIR8jc0YyVNM2ZwoL0QImVv6Fuo+uU1tZTQM9KGmuwA/KiyYIW:ZcVyVNXZPVvaFZiX4GmuwACXYIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705907637, "uuid": "490b9ceb-a5fa-484a-b8ed-7d18bc7a9bba", "value": 119963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705907637, "uuid": "de6942d3-0c15-46c9-af8e-7114488c9150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907637, "uuid": "6d5e4aea-b143-488c-902c-d656b581892f", "value": "fab8af1a6b5e2b545d8f428d46b77c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4e06c6-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911954, "uuid": "b76145a6-37b9-410d-b680-8e8dd0b296dd", "comment": "Malware payload", "value": "ec4784eb214b390523ce00434c723e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911954, "uuid": "04cb3962-df6c-40a6-9fca-a24376d4f84e", "comment": "Malware payload", "value": "b52ca43121ef221e8de12a924e13239844d879c78d149a1085ca417b41487f9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911954, "uuid": "956cb0b8-e88d-4465-897e-d73f3bd5932b", "comment": "Malware payload", "value": "2d6b5be71ce1547dfbcd209136d38925f4b4762f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911954, "uuid": "b3282eb1-8a6a-405b-b066-e36df6af1f10", "comment": "Malware payload", "value": "77ba69bfc906e8664f150e3d735d88d37582457210465922fab6a7c0803efc23546796f35e5336fa53eee9e3a4e01923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911954, "uuid": "74fa8957-7cac-45a3-973d-986bbd7fc8cd", "value": "T1B116334EE63AB859E6285EB27FF6642ED3430A00D17693FF291611DA0D4D00FDBA4B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911954, "uuid": "8cac76e6-92f1-4f92-bfea-e38cc21251ed", "value": "eef2fc0d8c0344afa24fa2adb7e78a61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911954, "uuid": "bf11fd34-1251-4f8f-af8e-d427becbeba4", "value": "98304:DTAMLsl1C6SnTepFEKtAflzVU8fc4nf0jsfHld98NsaePZ:DTAde6eifEKtAfpVUqc4fAwd98CaeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911954, "uuid": "09ed4237-7162-4dd7-a739-44a520194cc6", "value": 4122640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911954, "uuid": "fed2dd64-9ac5-4af5-9683-5f3318e6cd7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911954, "uuid": "52c1f63f-2d6e-4d98-885a-00f5a968b923", "value": "SecuriteInfo.com.Win64.MalwareX-gen.5842.23757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66a9bcc-b92b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705930815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930815, "uuid": "3e4bcceb-264e-41b8-9419-61e3d7fe7c3d", "comment": "Malware payload (DCRat)", "value": "7c4eaf9e3ae1758120b10e87ee43be05", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930815, "uuid": "2f6267fc-a4b1-433b-8a9e-6ae7185e3da0", "comment": "Malware payload (DCRat)", "value": "b5dea6687a3027abac9dc8135d8685c919c44da3d9f69dc180ad1a403858bf92", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930815, "uuid": "3970029a-f792-4476-b4ad-c22c935e2e9a", "comment": "Malware payload (DCRat)", "value": "f2e06f989ca39c29bd5eef01093675b46c4e86fe", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930815, "uuid": "22fa5015-e227-4df8-9b36-cd2548615895", "comment": "Malware payload (DCRat)", "value": "6c7f4b8bed847f42d02ddb26fb671b07ed7e49dde68804c07f47641bbea15cff090dc00122db1afcbcc87f648ab61b4c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930815, "uuid": "04dad982-2fe8-4930-872f-acc1133937ee", "value": "T18D859DA665D34F32C3E06B3146A7463E5290C7323556FF1B7A0F2092690BBF19A771A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930815, "uuid": "1759ac8b-88dd-4d0b-9520-a64db397030f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930815, "uuid": "f6293d0f-4f59-45a7-8147-971cf5e4d30b", "value": "24576:moTjlZoSlZqXNN56/gcq/MvnSR85MUxhwlNzdHiVsq9oWGEc+i4Vuh5Fcu0IFvN:hFjq/MvnSyncN5H9qKWGEdVuh5FdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705930815, "uuid": "4371ed63-b51e-45b0-a348-8f1947971f82", "value": 1866752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705930815, "uuid": "654e9f6c-d0f2-485e-ac36-5a56dd443d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930815, "uuid": "781a2219-82e3-4eeb-a9bb-dcaf8b189166", "value": "7C4EAF9E3AE1758120B10E87EE43BE05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217aacb1-b8ce-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705890595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890595, "uuid": "8e9c1ca8-5fd5-49e3-ab93-3115e9b0ee7b", "comment": "Malware payload", "value": "1d083fed9d8d61dc2a0fecaa859ba657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890595, "uuid": "aa58ebf2-5644-4843-b7a4-6e5e4e8adcb4", "comment": "Malware payload", "value": "b6c3e535c77296c2cc148217e480e2bb95ffcca0a469e6d434b8810e1b07c171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890595, "uuid": "c65c77f3-996f-4e99-9ed2-3db3e6fc3b63", "comment": "Malware payload", "value": "1a55aa64dc4851ea10bc9b25b720842920f9712d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890595, "uuid": "b9911899-8aba-4b39-81a1-ec37a58cbf37", "comment": "Malware payload", "value": "698bc4955023616717945231bb3deeb9917e07d057bb84ffb24f5a8c26cf38ab0ee9ec5a901ba3b966c8f93190a08c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890595, "uuid": "a23c8d2d-748c-4a4d-ab69-9e1ea8aefbcf", "value": "T1C35328097B8BA370DA65067C80F7D52507F2A3CB2673D68A3DC113C64E12BE5DA8275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890595, "uuid": "ebd4a175-d868-4daf-ad41-425a010adc43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890595, "uuid": "415b2c9d-78b8-4a1a-a77a-1129f6e6a007", "value": "768:ScN0P8/1bt0HhEn2FtNMSjk9s4sdaSuD9e6OxjM+Sr1HEYNfa0UERmVbwg/2f7a:S5KXQVjk9NsdkZebgjhHEYNijEmbUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705890595, "uuid": "23030658-4df0-4b46-883c-f245555e35aa", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705890595, "uuid": "070689cf-2b72-4710-b948-d7681dc44aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890595, "uuid": "cb05721b-e0fc-4efb-97a1-de63be1ce76d", "value": "SecuriteInfo.com.Win32.WiperX-gen.1775.18089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ae5968-b900-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705912289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912289, "uuid": "b67db02d-1f58-4894-a036-4e07cec42daa", "comment": "Malware payload (QuasarRAT)", "value": "b7c7b264510e9849eb59252cc353f1a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912289, "uuid": "6f7d843c-e213-4aa8-a2e2-00f370b1afda", "comment": "Malware payload (QuasarRAT)", "value": "b70b64872a21f338463d0e6b1f2a45bb186ad711317164192b64e54a19baef85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912289, "uuid": "6a454cdf-1de5-4d3e-b449-b0d862b5d793", "comment": "Malware payload (QuasarRAT)", "value": "22e4af10ddf0a7dabe39bcd7e9990bf64219e16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912289, "uuid": "afbb130e-c46f-483a-8574-7c8e040b7135", "comment": "Malware payload (QuasarRAT)", "value": "0f0d99a2484eccf2d1f94399427573e905950501dc7e3a63e9f9947b39a6f550051e25a7773d73f6f53e87625de6e200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912289, "uuid": "f110a3c1-cb6e-4cb8-9e08-659890fb2ff4", "value": "T1E6E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912289, "uuid": "48670356-eeca-466a-b67c-9faff0afa671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912289, "uuid": "7db2689a-2dc2-476b-90c7-6ae48170e09b", "value": "49152:PvSI22SsaNYfdPBldt698dBcjHTVRJ6fbR3LoGd/THHB72eh2NT:Pv/22SsaNYfdPBldt6+dBcjHTVRJ6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912289, "uuid": "fc20f680-95e7-4df4-9b40-09ef3430e064", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912289, "uuid": "6b099c49-77a7-46b3-b885-92577ddc2df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912289, "uuid": "3fdf8990-6197-427d-9612-a9110d46f25b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db6d416-b8f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1705908628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908628, "uuid": "fd15950d-bd63-45d6-b8f6-de42b0ce8ce5", "comment": "Malware payload (Adware.Generic)", "value": "836f348257f2ce73b0c25608ed52717c", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908628, "uuid": "c6648ae6-2bd1-41e4-91d5-b09e3b9f01df", "comment": "Malware payload (Adware.Generic)", "value": "b71c4705c449361a9fa6bbca0cc0f6f8e1946d016b33941000dc0f390c3ff79a", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908628, "uuid": "4fffecd4-be8c-46ff-a415-857dbefa4c79", "comment": "Malware payload (Adware.Generic)", "value": "873d9f616dfb756117846a74005bb63fd386c18d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908628, "uuid": "b8b1ee8d-4f4a-47be-9f64-b1d308de005c", "comment": "Malware payload (Adware.Generic)", "value": "a6f8af9b5f20fb0f9851f7d19c3f81e35d09505b5416a2d227acda44b958b8f895cbbcb279d03c1f1c906f31500f959d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908628, "uuid": "bf2368db-f4c1-4ff4-a10c-d17d6c380028", "value": "T112673337F225B93EC82912324172E22005BB6F1A64174C5EABE42D0DFB7F1912E7ED59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908628, "uuid": "9e939fb7-a079-4974-91f3-7340d5ef8a12", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908628, "uuid": "63eabe10-ff84-45c3-b235-f197283b9f3f", "value": "786432:QzbBqYCYV23hu8qvSI79IOKho3tP4o1AAAQWVk3xy1:ybBqF8dvSI79IOKS3tPRAAAQdy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705908628, "uuid": "ec369832-f551-4e9c-bcac-d614b91fb835", "value": 31650960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705908628, "uuid": "de6fa824-b5e2-4f35-8f1e-0ac7807139f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908628, "uuid": "b3401616-c7d8-4118-9dac-24351bf82d3b", "value": "SecuriteInfo.com.Program.Unwanted.5387.16311.15342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa32f21e-b923-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705927466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927466, "uuid": "74934d62-9b9d-4810-8ae4-8b04829050c2", "comment": "Malware payload (RedLineStealer)", "value": "3b8212d9d6fdc390c9f5c9262563c34f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927466, "uuid": "a0241bea-cd8d-471c-a1ce-f7e3a2bff339", "comment": "Malware payload (RedLineStealer)", "value": "b7bc7db05aeb57af30283f118d3fb8d3406862de660552dbe6c930516dc6a579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927466, "uuid": "d1efc62d-75f2-4675-9ba7-57b10f33e2b4", "comment": "Malware payload (RedLineStealer)", "value": "1e609b7396ccff4efa6c4a58f00f1826afb10c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927466, "uuid": "1d45ae84-636f-4f02-b704-6ce6593d445e", "comment": "Malware payload (RedLineStealer)", "value": "ca1e802635d62e889efb8fb1df937b38024157c7e239df75bf7361069fc1d10f98a6362798b155fd1d9f137ebd1b88c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927466, "uuid": "dfe16943-5862-4825-854a-178d3d56d23b", "value": "T18C548D1135B0CDB2C0A2203F45D68A65596F38254BA6B5D7B78B2BED5E303E1B2371CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927466, "uuid": "fdd9be33-4753-4dae-9408-8acbe72f0a1b", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927466, "uuid": "702dec67-2977-4bc4-9af5-e981fe89f038", "value": "3072:uDKW1LgppLRHMY0TBfJvjcTp5XgxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOub:uDKW1Lgbdl0TBBvjc/32UYP4hFedz6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927466, "uuid": "7eb8eec3-de23-4fee-a67c-63e6e56467e1", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927466, "uuid": "da26073f-3e84-49e2-8598-394a185fe462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927466, "uuid": "67179dd6-8991-41cd-a84f-aa74ea4db1d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dd254d-b8d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705894433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894433, "uuid": "2b48b0f7-a02c-4175-82f3-c3f20d0aec4d", "comment": "Malware payload (AgentTesla)", "value": "1d20f81887bbb46210347844d6edbc48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894433, "uuid": "4d11853a-7bcb-4c02-b6df-80df0becf00e", "comment": "Malware payload (AgentTesla)", "value": "b8c957f9a2e336ad409d493d67bb72a4f56d9abc4b7cf7cd2f998d60fb34b583", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894433, "uuid": "028cd3e0-3589-4ae3-b4f3-6cd4d31ba104", "comment": "Malware payload (AgentTesla)", "value": "864d9815c04f3f50b10e58c8a3dfe9f83a3bfea9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894433, "uuid": "9b2bce52-d8a9-47cd-9110-60601228a181", "comment": "Malware payload (AgentTesla)", "value": "36a2dd1ee26463f4ab2d801e4dd53ee08f0f9ae6f782267618ca9fc45d21371438b6f05bee7c995e01585735d8476145", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894433, "uuid": "02e0e6d7-25cb-4a65-a370-6cad76c8b412", "value": "T1FCD4220D73FC8F92E4B487F84A2224605BB67636A991F7C81CC725CB1025F895EC1E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894433, "uuid": "a08f5302-a482-4381-9059-dc8171085f34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894433, "uuid": "faa72f52-b860-471b-ab29-ee67b83fe5f5", "value": "12288:uaV+1nvUhPmg5EhzYLs4JAhrwaHu3dcq8u70yuZBkce70:BmnMp5UYLbAhcaNu70lfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705894433, "uuid": "b924c687-5bef-4e51-aab0-c9d023c69fe9", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705894433, "uuid": "c48caf60-f066-4975-9155-be0ebba000e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894433, "uuid": "191400af-8692-4ee3-8e08-48dcbed8443d", "value": "SecuriteInfo.com.Win32.PWSX-gen.25512.15994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e029477d-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911961, "uuid": "35f59cc4-1710-4321-b05f-dec466b49284", "comment": "Malware payload", "value": "cd3831296bfe802e6980aeb0fd084f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911961, "uuid": "3c601e62-fbec-4e1c-9a97-a33e56a01ff8", "comment": "Malware payload", "value": "b8fd50e666ca6e50abe28a54db9dede40cf1669728c2e90a4947074c6eb31a35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911961, "uuid": "073e5813-eb3d-462c-abae-493a88da5da2", "comment": "Malware payload", "value": "6840a7ee5600cc6bb69e22fdfcf50108849a888b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911961, "uuid": "1d040fe9-ac51-4887-aefe-b36b8ae9829e", "comment": "Malware payload", "value": "d32b6f54f64430a3d31adc22480c47aaffdaa5111f3bfcd966ee57469b4710ae741dc1c3a100235bda091c30ef3ec1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911961, "uuid": "cabb33d9-a479-4ef4-af55-0b35c63d6bfb", "value": "T1FBF5A016A3A641E9C537D039CA87BB17D177340827B293FBA79105501FAB6F039BBB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911961, "uuid": "9e00bd10-b3b9-450f-92d2-c93aac1bcf65", "value": "1bd285dfa39dba35ffb6e069a90d0520", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911961, "uuid": "b5f0b25b-d385-4bf5-ae38-15389a5c1ba9", "value": "49152:9UX3/quhciwI9x8daZ0jPe2RETvYKNOJlA0vAFqjsoOqiAXmlbiaCqXC80sLmdi:w39ciwGKIYPet+m0AAaqiA2lOJqVmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911961, "uuid": "dcc3939a-4a3b-48a4-b8b1-682d07766f7a", "value": 3514368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911961, "uuid": "ec3b7dd1-4342-47eb-8e0d-a965377def43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911961, "uuid": "a7c8dfed-9a72-4be4-9350-ff18f99d5d39", "value": "SecuriteInfo.com.Trojan.Win64.Agent.23586.13967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed952e8-b8ce-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705890591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890591, "uuid": "fe762b5a-9287-4aef-8efa-c516d973efad", "comment": "Malware payload", "value": "560a812c47a89f5eabaa84cb0230ddb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890591, "uuid": "b36c51f1-5045-4d5f-b0e7-8ea63de94c92", "comment": "Malware payload", "value": "b94360a03bde1061fabeaf40d2a8923e06bfba470e5da7dd89036a55f2fd756f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890591, "uuid": "e34ee21e-d0d6-48d8-a3f3-0b76b94b8b42", "comment": "Malware payload", "value": "4b31730bb9db0382bc1e32e1715c4550e2a4a6b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890591, "uuid": "cdc73509-00b8-466a-904a-cc8c59d2da95", "comment": "Malware payload", "value": "60c5e4696ec0429ed133a831f8e24feb05dbb1493fbeec477fc932816c4210e82bfd9263cba8ded1dffb320ecd85068e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890591, "uuid": "30dd7d26-4237-4590-a1ce-27aed80638ea", "value": "T15E16BF43E19264EDC85AC23053576236B63178891731AEEF52A4E7303FB5BD06F3EA58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890591, "uuid": "aa912a43-3c3f-4a31-81a4-d2088ccf0943", "value": "eecc46fc41dfec245d8fa30c7828c813", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890591, "uuid": "8c211d53-8d70-41dd-b4c5-f72e3ac06b57", "value": "98304:APUwhdGjDH97jx5zTYfBkk2WJLwlr5qA2qBBRbUz:UUw7GpzTYfBoWJLwFRvVUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705890591, "uuid": "be469fd4-0513-4cdc-875d-c6ea5c8df1b5", "value": 4286286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705890591, "uuid": "e7072e05-5a6c-493d-8266-fb6a5b7ae209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890591, "uuid": "6f3de081-12e3-43c1-9c6d-79e1deeaeb0b", "value": "SecuriteInfo.com.FileRepMalware.26928.28691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f1cb16-b90b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1705916856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916856, "uuid": "93d3903d-0a51-4f66-b7b0-0b0832c9bea5", "comment": "Malware payload (DBatLoader)", "value": "404d739214210e2b8ce2badc8c00a5c2", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916856, "uuid": "978b9c78-c977-46a6-ab73-9ed8ea6bf01f", "comment": "Malware payload (DBatLoader)", "value": "b9d7c098afa53de66a2e6cced5036987a429f71adb35df1c3bf5e445af8a96dc", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916856, "uuid": "fca1d1a2-ff20-46be-90b3-ba8faeb5b357", "comment": "Malware payload (DBatLoader)", "value": "33319af082e49e1a0ce726eafee718cf01655e00", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916856, "uuid": "794e70fb-98b9-4b60-b21d-dc2799232add", "comment": "Malware payload (DBatLoader)", "value": "594f75e2ef752299f941eaf534b19a29b0f6112d1b2f0548adc5735ff65c8adfc2ce3682841d248815688d4c0682aec2", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916856, "uuid": "873b63c5-49f8-484f-91b3-9286c1ab8244", "value": "T1E2D5AD025F3CB8A2FCD5C936CE777364A7653E31AD6085A232E978DCD936E99702C112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916856, "uuid": "f102ff4b-6b95-4bb4-bbba-fd1d032dce73", "value": "02e3ebe88b2a6296bb4b034e0bd03814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916856, "uuid": "c98f18ad-5b38-47fb-9664-d1bdf6bdda8a", "value": "49152:xDWu2Avcfk5wAQaEOsA7M0enZF/ZrABL:xyu9uFH0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916856, "uuid": "fb82e0e8-8d47-47d2-8442-9e3d1ba36820", "value": 2774016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916856, "uuid": "03292202-8aab-4bc7-ac7c-1a3d74611bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916856, "uuid": "fe90e07d-5b5e-470d-beb5-17edc33e7f8c", "value": "DF0987890000.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f5afe3-b8df-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705897925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897925, "uuid": "0fd5cfa0-9a09-454e-aef2-24fc0b0090ea", "comment": "Malware payload", "value": "60ef37ca4cb715f2d3e56ce368a07e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897925, "uuid": "217c6d3d-8f6b-44ad-bb22-1e83e5ec3df8", "comment": "Malware payload", "value": "bae5d1ca2c96492545037ce5a2054696d5a0b47e3fa3b9244b74359f350a5e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897925, "uuid": "e71aa379-e85d-4d31-bf90-65ed9da3f542", "comment": "Malware payload", "value": "7d21c52354286ec62a54be91a392d509119cd566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705897925, "uuid": "6f7e00cd-dabe-4a63-9869-d922437bb42f", "comment": "Malware payload", "value": "b12c2e82ea7aabfa93d8912eb5b142e22cc4ef82d3922b430832be8db2ef6d76e1f7f60fe3d55af5609170ddd25cd2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897925, "uuid": "3dfd11f1-4991-4232-9476-db1424b4cf23", "value": "T1F4B5336ACB8189B1D2D5B1F71063DBEE4F34FA0D3E3D9BCE8B961818F52091768740A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897925, "uuid": "7995328d-bd63-4525-8c4a-4cd2e3ec16cd", "value": "5aa94c7fbfc01c9462c4d62e06efe88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897925, "uuid": "c257b982-85a7-47be-a26b-d23e56ac9b78", "value": "49152:UktZ7o/JQexmvpIYYnOupp6sl1/RZ/x3gBpvllb9XC:U+Z8iEmRIYYnOQJfJsvTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705897925, "uuid": "679f7515-dcbb-4b88-9566-b0df0cbfc6ef", "value": 2310592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705897925, "uuid": "9fb81f0e-b830-4299-968d-0a820e22d7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705897925, "uuid": "797ffdea-3538-4e2a-a032-ffe2ac5f92a2", "value": "SecuriteInfo.com.Riskware.2144FlashPlayer.26507.3675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b185e4-b948-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1705943046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943046, "uuid": "8cf9165a-33e6-47f5-bed5-ecd4de897b2c", "comment": "Malware payload (DarkCloud)", "value": "5b8d78968c989c9b1ab8eccf22fcd58e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943046, "uuid": "db6eb12a-1510-41f8-a1fd-3fbe8e842ad4", "comment": "Malware payload (DarkCloud)", "value": "bb05df923d78b810abb650a138f411f2ba5cc2ac628f76ed67cd7ea3254ca58d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943046, "uuid": "4129c100-4d22-44ac-8be5-885f80bf5041", "comment": "Malware payload (DarkCloud)", "value": "7d72d64188e21b3f8e94bcf8bcb36e5d8d90087b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943046, "uuid": "9199655a-c567-49dc-8136-2a7c4738b8ce", "comment": "Malware payload (DarkCloud)", "value": "7738d20fd59e6341a2636ef3cf17b7a90ce7d0714bd3b1c5031869eee71b5922e57f5fd251d1c1b12ae832074dd3fd3b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943046, "uuid": "4cee9f5e-c86a-4b6c-ad6d-965c21cec082", "value": "T1B3E433CBA93AD56D34CDDD8DBC3F82F25590CC4D522074EBE29AF7D2CDC892A8519029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943046, "uuid": "ae8536e3-afbc-4d97-b142-795cf80ab646", "value": "12288:SyVX3MJ02v+tmkJ4j0lYTMkrxYi2GsXWyxCqha6AvXVkokQZgvmJ8GrAK:SQA022HiFfmXBRMlkZKgVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705943046, "uuid": "c794ff3d-1a1a-46f2-a97e-efb1c8ec584e", "value": 704875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705943046, "uuid": "6f4970ec-6683-423c-9bd5-18015c5ca644", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943046, "uuid": "5a181d47-0840-4e58-918d-6fc7c2006959", "value": "Q-Specification#107287.pdf (189K).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4934f547-b921-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1705926310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926310, "uuid": "edbc04d5-1f5d-4941-b81e-18a6d71105e8", "comment": "Malware payload (RecordBreaker)", "value": "3d6f88c2670e52d69d05db9ca2cc0322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926310, "uuid": "62b6ed46-a23a-4877-a526-2176e799f9de", "comment": "Malware payload (RecordBreaker)", "value": "bb4d7cd815700d90e229d1d6fa672b46842b66ffede6981d63f67af0cb99a0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926310, "uuid": "88ed6411-4b4f-490c-abf6-a5f639a9f6a2", "comment": "Malware payload (RecordBreaker)", "value": "62886ea7e99e0f7048d2fffc36a15b53e9033ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705926310, "uuid": "83a70589-8483-41f6-92bb-05c1952004ec", "comment": "Malware payload (RecordBreaker)", "value": "d8d981768361ff33c23e16c5157f5be2070034ad0a9653e2b99de2f5b09e280d4667bb71b1fe1bc22a3b4a19980393ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926310, "uuid": "864aea4c-12ea-4a4d-800e-3daf3f014f1b", "value": "T1E275BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926310, "uuid": "04a3edfd-ab69-4e07-b7bf-5128867c8af7", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926310, "uuid": "eb0e1ca2-31d9-4418-b225-f415cce0f7fd", "value": "24576:s7FUDowAyrTVE3U5F/1sKic6QL3E2vVsjECUAQT45deRV9RJ:sBuZrEUeKIy029s4C1eH9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705926310, "uuid": "fd61e563-89fb-444a-8882-034711e6f906", "value": 1672005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705926310, "uuid": "46309ed4-2ce5-4744-b025-3fe22a76bc1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705926310, "uuid": "87702dc3-0a33-4569-809e-5ef07550ab53", "value": "BB4D7CD815700D90E229D1D6FA672B46842B66FFEDE69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e486204b-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705915833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915833, "uuid": "3f38dce6-6669-4c9c-980e-2c737692b27a", "comment": "Malware payload", "value": "b07d8ff3e57f7c65b3bdec8e855a98f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915833, "uuid": "aed5ee95-ee0a-4704-bc09-32a5357cdad4", "comment": "Malware payload", "value": "bd1c6fa5c0948d133cf4696cea0e646957e4f83db1c3f50da7836ac4048d8686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915833, "uuid": "3df4eea3-fc89-4623-a789-cccd2db1c3fc", "comment": "Malware payload", "value": "421322155a40466135e2e275ed292c8eeb53d6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915833, "uuid": "907f858c-e986-43ee-ad86-300baa622996", "comment": "Malware payload", "value": "47d134d33e86abfc16c8aa88a098931f3345b0258c1e33cf6df2747a88864ff68712494060939bcc323d8282d538cb86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915833, "uuid": "c90e4d67-7f1e-47f8-943f-e4096f70d126", "value": "T1C50633C1026EA405DFEECCF884B4FD2190015E99DF600B65B22B4EB6D125F683EDD7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915833, "uuid": "238ee3a3-d7cf-4e4f-913e-915860321787", "value": "56d9bfb9b672831f62e2928c1607d085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915833, "uuid": "4402cdaa-33b4-4dda-b5cd-92eec6f0a020", "value": "98304:V8Oh1EbQVR9dtx/K5kcT9iEnZIZUF8jq0nrwDNe+MwxJ6wPro:V8qZVRjveAnZUu5nrcrMwxYwPro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915833, "uuid": "aa00ff33-fe86-468f-8ed6-eb3dacb1069c", "value": 3939344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915833, "uuid": "19327316-fa85-4048-ba72-f0c888c4ba1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915833, "uuid": "fefc21a6-5226-422c-a73e-6a267644c738", "value": "SecuriteInfo.com.Win64.TrojanX-gen.19951.20594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734c4a6a-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705923374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923374, "uuid": "156900eb-d0a6-49cc-abf6-2a0da3182f74", "comment": "Malware payload (Formbook)", "value": "3ee86cf85ca87087118ccd76a01a7fee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923374, "uuid": "8eae77f0-dc0b-4af0-9c6a-1594ff3b830a", "comment": "Malware payload (Formbook)", "value": "bdedbe6d10d500531db662fdfaaaedf6b3362c144189443e1945f16c2db331ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923374, "uuid": "934cc948-b092-4570-9cfb-43dc670d0130", "comment": "Malware payload (Formbook)", "value": "5be8dd013348014e63ddc0bae15b7c668960adc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923374, "uuid": "fdd3be54-d892-45b3-accb-3195954ecf17", "comment": "Malware payload (Formbook)", "value": "0878c114f916eff57e82b17f9664ab2075eff4afc98695a90724d0bda0abf6b963436b53f00c096354c611dc8f5d0044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923374, "uuid": "772e3771-24ad-4907-8017-67b2423f08fa", "value": "T1F8F4F43D38BE122B9179C2A7CFD7F427F178956B3111ADA898D343994386A4634C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923374, "uuid": "7ddd86fe-5cee-47ab-a576-664e8fad8135", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923374, "uuid": "93a53190-9da9-4464-9b41-f32ae5626f6b", "value": "12288:QbVauoax2cDNDkPMU+MbD5HH4as+Xxa9kBgbVqPvpewLkmha/r3jQvfZ:6VQAXFkPHNDlPVXxobVtw4m8DjQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923374, "uuid": "0259252d-e2e7-4c11-8485-adf59b84099b", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923374, "uuid": "18cb76d3-68a9-4b34-affe-4f5683579e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923374, "uuid": "2c82c2f0-cb73-458b-bb1d-0f9693b43c4e", "value": "r8fJ7A2bKaPASZQU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985b5bfb-b97d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705965957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965957, "uuid": "7c436cf0-c190-4291-99d9-072b105f45eb", "comment": "Malware payload", "value": "88f07e9911b109bbd910f056e2e85feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965957, "uuid": "11d8fa41-f0be-4d2d-ac80-fa31a78778b2", "comment": "Malware payload", "value": "bec0cbc5bcfdbb8013e95e5c2d1d5ac9a544e97491234fc1ebcbbf061867d9bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965957, "uuid": "0d25e214-6ae2-47f6-a6ac-b1581ebe2b76", "comment": "Malware payload", "value": "96f62bd68e054f1d468972fd8559405b1a3176c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705965957, "uuid": "9c16ac72-190e-4eef-8ddc-02a73ede5943", "comment": "Malware payload", "value": "74138ef8bbaddc906d59d98b0377032d5f070551c89ac63a53bc9444416c9b8b6c785dd1413e057f81fa2b5f5577c64c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965957, "uuid": "6615b99b-4ede-4983-81ab-dcdc4d5ab4e8", "value": "T127059E22F3D15437D17337389C1BA3699D39BF102E28B9466BE91D4C8F39681782A2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965957, "uuid": "e9c6ea9b-2207-491b-80ef-2f5d06f8d7a4", "value": "c07d2be93c920fdad92e8293e0bbdd43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965957, "uuid": "6be13b4f-f060-49c5-989d-c8c8e7449ba6", "value": "12288:PXvTyZ8//rfO9nLPBApqHQFsmErTamRq/rsJQHhTAnVTfvj8s0qWlErJH:fmZ8rW9rUdFUvaWIYyBTiVTAs0ErJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705965957, "uuid": "2c536272-9234-4f8f-b1aa-2f8652cccd6c", "value": 846167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705965957, "uuid": "93691a75-0b61-4d3b-b08a-3076c392f2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705965957, "uuid": "ce0db5a2-4a7f-4e3d-8bf6-00ec2cc086d7", "value": "SecuriteInfo.com.Trojan.DownLoader39.28168.23712.22939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea09e31-b937-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705936010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936010, "uuid": "d3e0ff25-9feb-4f17-aba4-9a9936462e11", "comment": "Malware payload", "value": "7190accac7a9656b41552c3288c5f58c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936010, "uuid": "066b4e43-07ab-46a6-8abe-74661248f7cd", "comment": "Malware payload", "value": "bee4d128bd2d287df65b3722399528dd9b3c461ff14f5a332924fff97573b3b5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936010, "uuid": "0379b5ab-1db4-41f5-9035-93953a28650a", "comment": "Malware payload", "value": "d361c451d4a64806d9a72ab0c247b3f89bf99c17", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936010, "uuid": "a2c45f03-9c5e-4278-979c-112bff673f8f", "comment": "Malware payload", "value": "4d29d4545536d8522db60b1fd417367f6d550fbc8658a9b81b411000abf34e1fa409cc41f2d7244eafb4e76340e1d26b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936010, "uuid": "7dcf7e62-abf7-4a13-a1cb-4e108e950dcc", "value": "T1E51812D3E769EC55E0F3A735D63161666A168C609B23E3B31E01B13C2EF39C4A619EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936010, "uuid": "45d145d7-1142-40c3-bd36-dbcdd560f335", "value": "1572864:Z978rj1c4sV0MmDpPwpJ/vxf+CElkPNM0PGBMu8Z3V9NrnD:/7+E0rDhaElCN/GBMu8l9NnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705936010, "uuid": "2b0f35ed-c8b0-46fe-9005-71280388ba60", "value": 86579337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705936010, "uuid": "5dc157eb-1eb4-4643-aede-dbd46cac5e84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936010, "uuid": "17a6a483-7779-4a74-989f-15b3f60475ef", "value": "Important_update_5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8570d7-b96d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705958932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958932, "uuid": "40cb575c-602d-412a-a12f-fd29d9dda22d", "comment": "Malware payload (AgentTesla)", "value": "9c63fe16007f48b7dcc0abb373e6d959", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958932, "uuid": "dcf00b62-9a0f-49d7-aef8-f24ed0220f44", "comment": "Malware payload (AgentTesla)", "value": "c0bb5c738263d4ab3fbcf7743f3b700324c93d3236cfaecc0919771b0efe1b70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958932, "uuid": "5cfc63c7-6a51-4a91-b0f4-29396d37bff1", "comment": "Malware payload (AgentTesla)", "value": "6a279cd3049172036ff2300b6f2ee07e7e2e22ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958932, "uuid": "d2d1bafd-9142-4d53-a3ab-197c0e6f6723", "comment": "Malware payload (AgentTesla)", "value": "6152f5990faee47b68a8ed80541436cf5913e5b07b234848bc339431c50ce9ac72392ac12ccbeeee5123253d845aa4c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958932, "uuid": "3cf8f6ea-cc9d-46e4-8660-1b5a4bf67769", "value": "T127151117AEB8BF16D92657B76108520D03A66E6E7CF5D2079E8E75CED633B400A21F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958932, "uuid": "a7fc168f-88b0-4726-ae12-5a18e61bb275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958932, "uuid": "8f161aaf-2658-4892-a5dd-86b50e6678d6", "value": "24576:CnGIrJYdvjdu8tG9gfJqVnFr4cdBlavt8K:ufl6rk8tDJQqcdval8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705958932, "uuid": "abdfdf4b-24a0-43a5-a9be-3376329a6c62", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705958932, "uuid": "863eb57a-e999-446c-8315-de2fa72cef2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958932, "uuid": "b790ba05-96c5-499b-829b-6479b7f91d8f", "value": "SecuriteInfo.com.Win32.PWSX-gen.9291.27572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affeb9bf-b8e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gupboot)", "timestamp": 1705898565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898565, "uuid": "810d47ab-a94a-4a20-91e1-53466fefc2e3", "comment": "Malware payload (Gupboot)", "value": "bd8f4ccc6c7caf9af3fb239cefd3280e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gupboot", "colour": "#EF1DE5", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898565, "uuid": "623248d0-f0e3-486a-8789-b47f23557956", "comment": "Malware payload (Gupboot)", "value": "c0e047a78dfca4fa2085c878d4b41745d3cb7a26238a883d36a32136777fbc40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gupboot", "colour": "#EF1DE5", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898565, "uuid": "6e193669-6c52-4894-bfec-ba05534fd894", "comment": "Malware payload (Gupboot)", "value": "33be5a22d7e98c0814582100b9352c315a6b5b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gupboot", "colour": "#EF1DE5", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898565, "uuid": "bb21545e-00b9-4860-96ad-b0d2f639d1db", "comment": "Malware payload (Gupboot)", "value": "39489bf6ef13de711ae112a1276b34b219d945f9b1016f383b8963ee7525108c53162eac609757c6bb0c1b8c8b661f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gupboot", "colour": "#EF1DE5", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898565, "uuid": "c7316361-138f-49b0-ab1f-5c2cc99b5959", "value": "T133A4CF117290C435E3A613764996E6B05AA8BD345A90E68FF7A83E795F301C39B3730F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898565, "uuid": "be2910e7-c1f2-4246-9a54-8cbbd8dd84d8", "value": "09eb18457adb53a09f3f97fc04e9e2cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898565, "uuid": "018c8f83-ad26-4748-bab9-df9beb8d83e6", "value": "12288:Y6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1UO:Y6tQCG0UUPzEkTn4AC1+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705898565, "uuid": "9558afda-6ea6-4c8f-ae69-5a1091c5375c", "value": 478650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705898565, "uuid": "0eda6bf7-00c6-43eb-888d-80c949de9119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898565, "uuid": "bebc2a38-65d2-4195-b084-58633a0f3b2a", "value": "u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec50cb1f-b8e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705901673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901673, "uuid": "29a93769-6796-418c-94ee-27a9b1f29448", "comment": "Malware payload (Socks5Systemz)", "value": "d5c270dc078e617811382da38b3e3cdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901673, "uuid": "cf095ec8-9918-4516-bb4e-0de8e670ad27", "comment": "Malware payload (Socks5Systemz)", "value": "c18b9b5914d8abac09322746396ca03a47f22c00b9f7a3a7732272abd35a07fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901673, "uuid": "6ff4faaf-69ed-49ca-8aeb-11f613aea454", "comment": "Malware payload (Socks5Systemz)", "value": "5c0df96a591ff24e8a1709cff24868872744b929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705901673, "uuid": "3c0730da-4834-4d87-ad5e-696e9d0abd6b", "comment": "Malware payload (Socks5Systemz)", "value": "9c76aabf99f2022a64408d5dc1c45eb5341e83be74fb674ffaf6af0014b246eb135c5614343dbfdfae2fa3a2823ca379", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901673, "uuid": "33de2f05-2337-4e21-919d-77b1cf9afbe2", "value": "T11F163310BF505662E3919634ACE2B316EB32FE5C6912034679AB84CE5E913D98CF27D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901673, "uuid": "8786d73a-a91c-409c-8254-09b0aae4d420", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901673, "uuid": "f2427e3a-0e61-4c23-9d19-84eff93b0717", "value": "98304:6Mzm1YV2jk0k+POx1W3rWPCbudRpAS8dZ1gd358:ViE2jOzgYjASQAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705901673, "uuid": "3478d702-6a9b-4f16-bcf1-33850e29fe23", "value": 4204317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705901673, "uuid": "450b7829-3d06-4462-8fc2-a4a787fecdfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705901673, "uuid": "3ea77918-5101-47e2-92c0-8b2a8d9d47f6", "value": "d5c270dc078e617811382da38b3e3cdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa3e74-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705910333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910333, "uuid": "47e824d7-aff3-4c1a-b739-276f7e58fb08", "comment": "Malware payload (AgentTesla)", "value": "85d4980b5eb1396a1c958627ab7b0f3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910333, "uuid": "ffa8158d-0767-4be8-a807-807872639d89", "comment": "Malware payload (AgentTesla)", "value": "c1a6baa70586412b087bd83e9590b22981e3cce80c0cb7e52d92330a044e6e26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910333, "uuid": "7ca7b21d-49f6-4f56-ae77-06b7590484a8", "comment": "Malware payload (AgentTesla)", "value": "40163a46652676b9a5b116919b2704e2f5c054a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910333, "uuid": "d4f5af19-cb6f-4c0c-b852-f6ec9f0a218d", "comment": "Malware payload (AgentTesla)", "value": "842019fa06647113a30f46fd5a40f983db5d323b5a7b9dd934a714409cea3bc6765e38456c12755eb93eb4fba9f5fe0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910333, "uuid": "6844e8af-3991-494b-94ca-6835896d180b", "value": "T111E423191FC99710C69A5DB994F3F3605372E63C9799D30AB888DA920F323E765D3A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910333, "uuid": "1a1fd8c4-3ec6-456c-9742-91e0407e48c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910333, "uuid": "571119ac-879e-44b6-9d91-bce612236b94", "value": "12288:YK6JVzgRzQYyNduR7T9JiOlSmVHS8v0HgT8iSd/voTqtpI4:kzyPyQ9JKW/vNTpwYTypI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910333, "uuid": "d6eef66c-4932-41e9-af30-ec9c6193e2d6", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910333, "uuid": "87f5ca65-666c-4c01-a77e-8d536652af27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910333, "uuid": "5991ebbf-9149-4841-88c2-13b5ec882e0b", "value": "Brohoer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a7b2e1-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1705917233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917233, "uuid": "62513af4-c69b-4b31-ba98-a4f03de9ac7d", "comment": "Malware payload (Smoke Loader)", "value": "82802f337cfae13e680dc93fb67326fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917233, "uuid": "06f6c29f-f894-43a8-b7f7-70fda05220b8", "comment": "Malware payload (Smoke Loader)", "value": "c21bbf910bb1b965f4adc57205591243b1f32ea41cbf5716472ec33fb0628614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917233, "uuid": "5ee6f316-bb93-47c6-a519-be0bec3f73e4", "comment": "Malware payload (Smoke Loader)", "value": "603c64258d3882bd5eb7210a674f691892d84896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917233, "uuid": "d0fdc56b-fb85-435b-a811-84507f096e73", "comment": "Malware payload (Smoke Loader)", "value": "ff7561f7743e539ecae03faf9447301fc7b755975bb7193f718a9b57a1928f9b810671541e0730cee71f12fc6bc8e5ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917233, "uuid": "b524b361-4cde-4f75-b55a-bc313e7ee351", "value": "T14C3428D39AE27D80FA264A72DE6EC6E8371EF1514F79276A7218DA1F04701F2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917233, "uuid": "af0b0a74-7f1c-4943-8f60-84dbaae1221e", "value": "c52f363ae887f7e2b622bb07b5377eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917233, "uuid": "6ebcf138-c58a-4cf0-a686-2b6fcb4596e6", "value": "3072:R5hh7/LwvwGXKJ/2WTZlwIBXW9bYT9r19eWGerzV1ODPtz2a5vO5AcRdZx:R5hd/LwY6KJTZqoW9WTx1OTtz5jqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917233, "uuid": "8080c359-8b04-4648-b98f-7929cc45587c", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917233, "uuid": "23d45c45-393c-4d03-b6d9-4ef004c3fabe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917233, "uuid": "d4a06260-6fcf-488b-8939-e3ef8bac9069", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fced12da-b959-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705950664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950664, "uuid": "f46f88f1-0f1b-4618-b3b8-97b281b509d5", "comment": "Malware payload (Formbook)", "value": "8f7596194540848a34760575eb00b636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950664, "uuid": "5698a201-b936-4931-b2cc-d0ec8aedc015", "comment": "Malware payload (Formbook)", "value": "c3c08b94e956165562366c14e6ace4a5fe4c66edb0e47628ad94883e02f719ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950664, "uuid": "c8f01f01-2653-4fc2-93a1-86b230bcf050", "comment": "Malware payload (Formbook)", "value": "bbb8ad4edae483048d9785e29b829fbfadcbd371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950664, "uuid": "dc4feb90-7a05-461e-bd2c-6f53609c26ce", "comment": "Malware payload (Formbook)", "value": "0ed27b44cf5a6fe5b2e9a8056de2b35157a939e6fcdcb8563595f7379e8c36527509c1914198e3434c9dba75c5ec1cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950664, "uuid": "42fd5ab6-688b-40d9-9300-982b0329fe97", "value": "T1E794235771F0C8ABD6722BF1176DAD6EF5775BA40E906C8F4FA00D2EA4864C7920A037", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950664, "uuid": "0de66f72-aff7-4ab3-a95c-0a2a7f0d120d", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950664, "uuid": "92737ca3-4c1c-4a52-b01f-330b444e1884", "value": "6144:P8LxBfsjPzbYSQN5DGHGCPLJqzXhCni57u6IUGiTNJy59IDhN4Uy3Veyky43lWoW:esjbDQOHtkLhSy/aEV6UyoykL19in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950664, "uuid": "b6d5408c-dcdf-4059-ab46-46e9faab1c03", "value": 442874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950664, "uuid": "801ab93c-8e3a-4c30-99c8-a33c5c10ae1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950664, "uuid": "939a5f51-2d44-4077-93c6-147caf2df209", "value": "RFQ-High Star.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b46bbe3-b930-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705932783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932783, "uuid": "6a80cc28-05b2-422f-881f-f6c21779ccda", "comment": "Malware payload (AgentTesla)", "value": "cc1d4ed193c0b1c8a9e54f7445a0d5c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932783, "uuid": "b5d17046-235c-4710-a2c8-ba73d0df180d", "comment": "Malware payload (AgentTesla)", "value": "c3cbff3aed1ec835babf2cb779d38d66ed9328662fb049819ce7d199e693409b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932783, "uuid": "d1b85a78-e022-4a2e-bd3d-dda8c04319f6", "comment": "Malware payload (AgentTesla)", "value": "72820e4c3bc00b4a9fab994d8ca4561913e346b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705932783, "uuid": "6d905541-e8b4-40bd-b014-e4409c23307e", "comment": "Malware payload (AgentTesla)", "value": "847b428546c25dbee31f21d0e564e6b6ee43ce473aa0764eb5ec4c2d37609cdfefac087ef5c5252526eed0897e3e0ce1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932783, "uuid": "6de81a36-1a73-4056-9eda-101e08c61b08", "value": "T170D4121137EDDF46EAF2DBFA0561906047B7BA2B6576E60C0CD131CE5872F018A90B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932783, "uuid": "a6dc3506-6c7e-4a71-ab3f-343464ba235e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932783, "uuid": "397c6907-b6ce-4d4b-aeb1-6580b11dec75", "value": "12288:oVJo+hIMPDekxqrQzzbjgmAyUZBV7yvnEFm9KHy29oP:aNI2JqrQzzetZBFyVv29oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705932783, "uuid": "b45ff934-6fb0-41d4-a020-ec02d14c4485", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705932783, "uuid": "6cad719a-a17d-4ff1-a57c-e40bce79862b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705932783, "uuid": "2a0068f7-0f70-42c3-bd05-39576576efe0", "value": "SOA Attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3de224-b956-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705949156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949156, "uuid": "0a64b7b6-0b2a-4427-9224-9a1665bf3369", "comment": "Malware payload", "value": "44ab97d9ddf5cccbebc5d83f32696490", "object_relation": "md5", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "Zinfandel", "colour": "#0ABF85", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949156, "uuid": "fa4c556b-0a76-44ca-96ca-52184e986b14", "comment": "Malware payload", "value": "c3ef8c053530fb8763a06f50848f91a7b8820778a68c1ac0652fd2bb103788f6", "object_relation": "sha256", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "Zinfandel", "colour": "#0ABF85", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949156, "uuid": "dad82f3d-4776-480e-86a2-6ca8d5aaee67", "comment": "Malware payload", "value": "8bd5e1d421ad003d219a4aa47fdc32c5e44b7591", "object_relation": "sha1", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "Zinfandel", "colour": "#0ABF85", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705949156, "uuid": "e5002c29-5473-48fc-803d-3fef3330abae", "comment": "Malware payload", "value": "1a06b2223748f877463a162a41558e3f6723b9e2460aa4c65788a636b6acc7203c928119b298a274fa4f94b7c973d2dc", "object_relation": "sha3-384", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "Zinfandel", "colour": "#0ABF85", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949156, "uuid": "21bea67a-2eb7-4e0b-b6e2-68dd82b9bd25", "value": "T14CF533FC65A78F01B85DD8F28CBE7391200676429F09ABC7140E1D9DF9905C8BE86B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949156, "uuid": "8ef1eb24-097c-4547-a98e-73fdd90fe114", "value": "49152:U7llDFQvGKVxNKiGPY8s7ysvipHvQPYsv7P2ClbMXvaiyLvScdMlpfLIJuLF71+I:Gll2v98DHviCClbMXvuypfs8LFpnXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705949156, "uuid": "75a7b9da-1003-4c9d-8049-30a5241012e8", "value": 3602977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705949156, "uuid": "f04dfcf6-9e0a-45a4-b0d8-8a31fa3b3eeb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705949156, "uuid": "7ecde0fa-55de-4cf1-b57f-101acaaa09ac", "value": "MainFull_Setup_2023_As_PassKey.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83704028-b976-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1705962915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705962915, "uuid": "acfbee48-c5c2-40fa-89a6-c44522ebfe22", "comment": "Malware payload (Arechclient2)", "value": "07256d661e730a414482da334819fc36", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705962915, "uuid": "4469a34c-c152-4896-9719-908fa98ae8f3", "comment": "Malware payload (Arechclient2)", "value": "c3f742bbbd33c7638fc3ead2f7f3ca089e6e79c3277d58997f28bd19efc10050", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705962915, "uuid": "7d3de9a1-fa6f-4825-8a31-d631eeb787e1", "comment": "Malware payload (Arechclient2)", "value": "d66936b189f6e12a5f5ef997e794976dd7b9d9d5", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705962915, "uuid": "609a14ef-0d6d-4b49-a2ca-7e968f3c4270", "comment": "Malware payload (Arechclient2)", "value": "2f3d81b536fbe76e933c033291068b6177ac1a7d0888286d97b0446d6c376aefe584dcee7df00227b87bb0a9c4b5b573", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705962915, "uuid": "853abff4-dffd-49c5-9080-a88a465d6c74", "value": "T16E055AFF7A87ED22E9ED737C84FF5D4992A452A75890520B298C98D01F9432EC709BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705962915, "uuid": "96cfc930-3a29-4d12-b7b2-42d40b2f9de7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705962915, "uuid": "db41f2cd-b198-46bd-b37a-179af3a7ba12", "value": "12288:GdLwWCn3QrAIsj0AQki7u4YiAoorWv4BqUPCdCCGG:Z3QejkV7u4zorNqtXGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705962915, "uuid": "166c8af6-7cde-402b-ab04-63d815065f4a", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705962915, "uuid": "bf2f28ee-068d-405c-b818-9edd0af27f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705962915, "uuid": "ad8cd9ef-9de9-4be2-9ad5-40710a46cb95", "value": "07256d661e730a414482da334819fc36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808fdc9b-b95c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705951744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951744, "uuid": "d3e1294d-b985-4493-a966-79b9a910bb09", "comment": "Malware payload (DCRat)", "value": "813189503ba0d948993203ca259d5810", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951744, "uuid": "14f01f46-e5a2-4176-93fb-18ea7dd94a2d", "comment": "Malware payload (DCRat)", "value": "c4ec5d7b7a9bf60de2c201ebaca15ef8da3590033d4abc42fa402bcd2e5abd79", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951744, "uuid": "5d7b2eef-139f-4bb2-9611-c5355cc86207", "comment": "Malware payload (DCRat)", "value": "5553917d633963716eda6954c50a8ff0efd01cfb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705951744, "uuid": "7bf36006-19fb-42ba-8716-e7c13e8b37b4", "comment": "Malware payload (DCRat)", "value": "5d18212e2d59c9eb8d0ceb7355c73ea6c16fb8fdf26b719c380e88846678904c17ec3bd4ba1f5dfeece35eec10b4786e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951744, "uuid": "cac2c786-a2a7-470e-adfd-311fac3fcd62", "value": "T173759D417E44CE01F0191A33C2EF55588BB0A85166EAE32B7DBA336F65123A77C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951744, "uuid": "34037a34-376b-4ec9-b861-6f5728e1a1a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951744, "uuid": "d4e896cf-3464-46e5-85a3-0842ff56f30f", "value": "24576:ceaMajUi+6C+mDjn7gbkFaSH7Wu4mIWGE1Sy/fBEXTHhaTEEER71RM4I13:ceaj9bHmMbkBHVdGE1Sy/ujhaIh+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705951744, "uuid": "ebef8c04-df11-49bc-9adc-d73ffc51ffae", "value": 1601024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705951744, "uuid": "28160a72-d441-4631-a8aa-ac8e561a58a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705951744, "uuid": "d31da14e-8a7f-4264-b4c2-41f2f5e83a84", "value": "z2DYSM12rQX8EmA4l5Eobd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8fa9ce-b92d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705931493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931493, "uuid": "97b69993-5d6f-486d-9f9a-fb7c6737a636", "comment": "Malware payload (AsyncRAT)", "value": "c601f4fdbc435ffab2020ff601f4ef12", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931493, "uuid": "52df71c4-4e05-4d45-ba8b-97fad5f19ded", "comment": "Malware payload (AsyncRAT)", "value": "c58f1838bf16c0e8143e5c95ecc2e305c2100b9a282a8392f63cba5932267faf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931493, "uuid": "a421243e-5df9-4bb1-8325-809e0a538199", "comment": "Malware payload (AsyncRAT)", "value": "f69d32b69418ca452af068e2111048cfad6390e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931493, "uuid": "319b816a-ebc3-4772-801f-24033a1bb538", "comment": "Malware payload (AsyncRAT)", "value": "3591cf09640eefb893d7e1da061e28c38f6175d3b826c2149e00e504e4bbfa5fa95fef413a625756a010364ee119ae87", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931493, "uuid": "6de8a9cf-7d11-49f5-a592-afae33acd61e", "value": "T1567633067AC94C76D66315361775E679213ABD604D39824A97EC4EEFFF63AC08830BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931493, "uuid": "b8ea5ef9-34b1-4b0f-bf23-5335ef4b16e2", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931493, "uuid": "ad85c7ae-d6a7-4933-9a28-dac8fed2232d", "value": "196608:MKnpi+O0IEWpDT+egt9QrsIesIB7qDxsWjYgid73Pl4Opjae:MK80vWpQqso4qDxsWj5073Pl7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705931493, "uuid": "2d74c1e4-f0d4-4287-8532-da486f4bc0ea", "value": 7488435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705931493, "uuid": "0048ffe5-d2e8-4ddb-8ca5-fcace6a52811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931493, "uuid": "6e7a74fe-f6d1-4dc0-af52-8d3bd7d4e79a", "value": "hangar.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251656e8-b91b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705923673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923673, "uuid": "2d3e6578-1558-4e41-be2d-3d0eb18b28e1", "comment": "Malware payload", "value": "423a07fc8178d3a61d686655a671a9b5", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923673, "uuid": "2b193329-9341-441c-b9bd-8e7411ad7848", "comment": "Malware payload", "value": "c5ebdb316681ecf95d56312a9dfbd1718c1d0feae299265d1af3b4ac13dc5087", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923673, "uuid": "81c8bc92-ca81-4eba-9a2d-ed81e2140f63", "comment": "Malware payload", "value": "9e353298df99acdb52500563e66db49cd512267b", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923673, "uuid": "285a97af-d481-438b-a52a-bafa15650245", "comment": "Malware payload", "value": "dfb1e39d847c51361a37061d2ff291dadd32a91c995e61c73ffeaa0550bf62432d31b44bf5fde693d3187aa4635c9742", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923673, "uuid": "0762973f-92f2-4083-9269-c496cabe1ba2", "value": "T1AE25E97974790127E931E7B78AE7F437B07A9CAB3421EA2854C777654BB364220C312E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923673, "uuid": "375589ec-e14a-4e55-92a3-dc05fdf35ceb", "value": "12288:MWXI3A9DypXySDpzbgx9bNEb9fLLsQGffu+KNq9sKtJa49QpCw:HKstNifjGX9KAXtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923673, "uuid": "2f4f8ee5-4b3d-41a2-91ea-94657b4aca2d", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923673, "uuid": "af603816-5740-459e-8f77-eebf06c518e1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923673, "uuid": "77686555-141d-436f-9d7a-97c931cc1ac4", "value": "nxF3wienie Z2300076_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b90265b-b8ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ScarletStealer)", "timestamp": 1705904974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904974, "uuid": "968c9d46-7b86-402d-93c1-15502ff8641a", "comment": "Malware payload (ScarletStealer)", "value": "a103b2605d0fc1c0bf26a17192eb4a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarletStealer", "colour": "#17AF71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904974, "uuid": "acafef02-b9fd-4754-84ad-ba92ec12e617", "comment": "Malware payload (ScarletStealer)", "value": "c75cd13eb7a8c65fd95f5f67ea8558f07e6917dff5162ba3d16d216dc719aea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarletStealer", "colour": "#17AF71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904974, "uuid": "82ed0834-5025-448a-94f2-4f2e9978a702", "comment": "Malware payload (ScarletStealer)", "value": "1d62105afc20e57a6954485fbec61dd57fe33b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarletStealer", "colour": "#17AF71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904974, "uuid": "87b011cb-ec15-4939-9cb6-ae4bc887aa8f", "comment": "Malware payload (ScarletStealer)", "value": "7f54d6af6eb2cd9b30e6f99f5256aa703d8a65214c9ae928d3f70279d52890ba295d4a6aa16c43d91409afb160f72c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarletStealer", "colour": "#17AF71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904974, "uuid": "846cdd20-f4c3-48e5-9668-93e96059729d", "value": "T1B1667D47FC9545A9D0EAE234C9B69253BA717C485B3123D32F90F7382E76BD0AAB5310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904974, "uuid": "5d3e0964-a21a-4f13-b588-d09e7d4ecb48", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904974, "uuid": "ce0f749c-2bc7-4e8a-a769-fdf7e654b806", "value": "98304:PEy1u8S5iS3KiE8zCL/qTy1AFkCjBrC1qe5IWp:/S5iS3Y8Y8FrjBM7IWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705904974, "uuid": "bae15486-7f58-4009-8b8f-00dd29cda405", "value": 6970880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705904974, "uuid": "7551aabb-f447-40be-8fc5-797510cf16e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904974, "uuid": "726dba84-9f64-40ef-81b3-623ed716ac37", "value": "SecuriteInfo.com.FileRepMalware.1518.1840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e6b136-b8ce-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705890598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890598, "uuid": "f479e9f1-6a1c-4cb2-a0d1-15506899b4c8", "comment": "Malware payload", "value": "988fea4af75b42ae08f6e3e73c136079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890598, "uuid": "c060bf60-e52f-4a42-9e2e-0911c3ce6fde", "comment": "Malware payload", "value": "c983f4316a72cb64ff50258ba34463aa6313d7a41c1c1b5442c7e3d73a2718c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890598, "uuid": "dc9c2a61-1e0e-46a2-adbe-068b3a3a6637", "comment": "Malware payload", "value": "cc46c578cd7137ce8a0b87e7ce3f7107757b867c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705890598, "uuid": "11b83b2a-1e59-4e59-9096-0e06bb9cf59d", "comment": "Malware payload", "value": "b98da6d477c7a7a8ac96adf70bcb00c0d9e2ba752d1255ef9f4ec1037333872697d806c7fdcd143ae98b80ab2dbee7ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890598, "uuid": "687e2c20-7fd1-4384-abb2-cc62d4732fed", "value": "T193836B2B7A0804E9E46B90BDC6774E89D372B8661F0187CF0770134A1F7B6D56DBE2A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890598, "uuid": "51acc211-9279-4173-8028-85aee08ee0a9", "value": "579a473ef51b01fa8c6e911a3557a042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890598, "uuid": "57238414-3bf6-4770-8854-520ef9c07aa3", "value": "1536:ijMzIrBbq2uGoDIm4kDHS/uuhxvZGKuA:ijouQDHS/uuhxvZGKuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705890598, "uuid": "574ae6c0-92de-42e3-b8b1-9acd8ed52112", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705890598, "uuid": "92428d10-6926-4fbc-8f11-a037758d608b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705890598, "uuid": "0b4f754b-b6dd-4f13-b025-cd6897b3a37b", "value": "SecuriteInfo.com.Win64.BankerX-gen.12027.30160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c4e979-b96d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705959018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705959018, "uuid": "cb1b607c-5dd2-4eda-989a-36c6120cee93", "comment": "Malware payload (njrat)", "value": "1236c0ef970171094fba3b7895a4d3d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705959018, "uuid": "ac93f6a2-3cef-40d6-b807-d6d599c1c4e9", "comment": "Malware payload (njrat)", "value": "c9aa5dc253264f3c11f4c87187ed9003bb83fb9382693aef3fdce55ac6f99cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705959018, "uuid": "8e89f7e3-c84b-486e-a780-0e31fd7dc785", "comment": "Malware payload (njrat)", "value": "bca356e243b57232faabd82aaf1b94e9e620ce82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705959018, "uuid": "f63082e8-0cea-4781-8768-b42a4f677d83", "comment": "Malware payload (njrat)", "value": "5df90875c37609f6bc694a1cd2bc6c5b44c5cadf15fe43682ebd639b0ac47bf17a2ab7becba9e255c7b100d77c2a74c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705959018, "uuid": "7bc26a85-6e5c-4391-95fc-f2c857b9b8d9", "value": "T1DB032A4D7FE18168D5FD067B05B2D41207BAE04B6E23D90E8EF564AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705959018, "uuid": "c92d02f3-eff2-4c36-975a-47892b56e1e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705959018, "uuid": "5a5454c0-df9e-4d50-b51a-cb621144710f", "value": "384:QuSvEiTbTvpWNcZ0y8fvCv3v3cLkacJE0rAF+rMRTyN/0L+EcoinblneHQM3epzx:VS7TZ38fvCv3E1cprM+rMRa8NuUpit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705959018, "uuid": "278ad799-2993-403d-8ade-d6fe9eb24676", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705959018, "uuid": "24e844f8-8a4b-4c4d-b868-4c165d810512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705959018, "uuid": "1cac0642-c090-496c-9fab-81dd4cb01d92", "value": "1236c0ef970171094fba3b7895a4d3d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bb18d0-b909-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705916183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916183, "uuid": "60b5372d-6288-4f5f-a03b-f63df1223052", "comment": "Malware payload (Formbook)", "value": "e882b8df405f9651962b3e983ed78274", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916183, "uuid": "8dd621e6-0f25-4f35-bf56-848c35919d52", "comment": "Malware payload (Formbook)", "value": "ca2f01c6f516bbdf05aed26b9da20d6710a6c2f32e846a2ded654bd5f09cb01c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916183, "uuid": "26db2bb1-2f7f-4bbb-8c57-4599de4f20d4", "comment": "Malware payload (Formbook)", "value": "698190d6b80c99e4e73323e8cfce0c9265b68d14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705916183, "uuid": "cf4da624-7189-4963-8efd-0970415093b2", "comment": "Malware payload (Formbook)", "value": "5a7d7c77044539b6a65a76db3ac4c54bd17ab5e6fe59069701b5f65d958f43e9a4c09f1d53ce214426f3dc2d4cfc3e7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916183, "uuid": "1ab71083-6636-4615-bea3-32c90f56f1bb", "value": "T1ADC4221133BE5BA7D97597FC9C26212813B13429A6AAFB684CDB38CF1460F458D10E5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916183, "uuid": "a2e2dad7-79dc-4e47-9f29-c6dfc0b4de20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916183, "uuid": "bccd6d37-7a0a-4ffd-9a2c-930910f055c4", "value": "12288:sE7+Q549dCqWkCW9zV9fO7X3TPetnzUMaSr:Br4rLWkNV9fObDPetzUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705916183, "uuid": "e6aa0c6b-94dd-4abf-8510-9660741825d8", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705916183, "uuid": "f1088556-9655-4a7e-82cc-15ac98a29288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705916183, "uuid": "f80993be-adda-4e71-9c41-0b72cfb7892b", "value": "e882b8df405f9651962b3e983ed78274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6711c6-b901-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1705912542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912542, "uuid": "71d24d90-020e-4f99-9764-98361bd02dc5", "comment": "Malware payload (QuasarRAT)", "value": "610192e00d62ce9e96a5ca4900cbac61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912542, "uuid": "431083a9-9352-44d3-9149-36b336d6fe88", "comment": "Malware payload (QuasarRAT)", "value": "ca3a409333d884580e6ccf5ba616ab5d27dee98e0b991c8e416fa25e9f9dc54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912542, "uuid": "3ef89dbc-0ad4-41c8-9db0-4ad44d55aff8", "comment": "Malware payload (QuasarRAT)", "value": "cd0c73d4a9302990d1a8d274ad2ad4aa58d27cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705912542, "uuid": "8bca2591-4026-4301-8733-f373a8e091a6", "comment": "Malware payload (QuasarRAT)", "value": "113a1e51196e39249989dff556e140485cf30cbe6a0ea1bba33400a59cbf9b61fd03b57e0d4fd9ae242d57a0a78c1cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912542, "uuid": "d22a26fc-d779-4b87-aa24-c35adc3f1f0d", "value": "T12CE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912542, "uuid": "699b17cb-a812-40ef-9bb0-b12f18b3c238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912542, "uuid": "b8e50e2e-8581-4534-846f-8256a2f0ad9b", "value": "49152:qvft62XlaSFNWPjljiFa2RoUYIvtR16JbR3zoGdDPTHHB72eh2NT:qv162XlaSFNWPjljiFXRoUYIvtR16z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705912542, "uuid": "45d60b62-1cd6-4586-8d30-cbb414c6b395", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705912542, "uuid": "8a96089e-35d0-4fb3-a748-9087ca86a43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705912542, "uuid": "8e4ebe8c-9d14-49fd-96ee-a35ac24c031f", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb26d832-b8c5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705887095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887095, "uuid": "0d4f7f83-390a-42de-beb1-5d5023a4ef5b", "comment": "Malware payload", "value": "9ca6d3bb1192477d6abde2bc9c62635d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887095, "uuid": "ea4dc054-0e97-442e-a836-e94898039c61", "comment": "Malware payload", "value": "cb0bac5e95ae5693b21c749c6b6564d9e21395788c12fbe543f12071ca047635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887095, "uuid": "964e02b5-1984-4c1b-9c0a-0dd00823e216", "comment": "Malware payload", "value": "2eca79ea4072d5249d8bff35b6f38045f4f71fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887095, "uuid": "1b072ae5-4689-4ef5-9537-aca5aaddb07a", "comment": "Malware payload", "value": "925cbba925a5e7dd7a3a7da8f8c9865ed5d302224051722d4f24226e9e3d30436bf1b3b905aa884bbb0ffd9ea62d8625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887095, "uuid": "35feb370-b381-41e0-bc18-4e3084874148", "value": "T11A531A89B3879221C7A51AB480F3D51503F967AF2973D6893D8013C75E23BE6CE5378A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887095, "uuid": "c7aeaa1d-c675-419a-8676-dbb8b18a8aa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887095, "uuid": "29df27af-f7ea-4efa-8ba3-6c2df8ed0632", "value": "1536:GSK5L8cKBlzsBahMFFeVJB0xj4OQYt7z:TlIBa2+VJ+943Yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705887095, "uuid": "1e2bc6c8-f721-4dd2-a25f-4dc1bd8544c5", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705887095, "uuid": "65f6dc5b-0759-4957-9a81-eae3578d14a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887095, "uuid": "9e055834-7cb2-42ac-b296-0d31b34ccc4b", "value": "SecuriteInfo.com.Win32.WiperX-gen.14480.14084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0b4239-b919-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705923149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923149, "uuid": "1e094856-f423-47b8-afb2-c5fcb9ec3019", "comment": "Malware payload", "value": "31f23a8d8378012e8b2e01f0c15861f0", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923149, "uuid": "1ba92101-87f6-49ba-9d1b-135dba096579", "comment": "Malware payload", "value": "cddcaf66531b2d09fc8ad3da1a28a41161d5906677f6a8561a36b6953e392a85", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923149, "uuid": "9f0ded0f-a27e-458f-9555-2b7cac15388c", "comment": "Malware payload", "value": "9e6327f101b0d895ed79cb85c405758a9ee10cd0", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923149, "uuid": "dc270201-2e00-4f62-8b1d-1458797ba75f", "comment": "Malware payload", "value": "e04015eee19b84d4f842b49762c793bb41cb9854afe7fde9dd0656a2855c43a6553be7c9dd76c14d29f876e996381e53", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "autoit script", "colour": "#BB811F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923149, "uuid": "7a16c79c-7dbd-4ec5-b1ac-97cbbeee87f7", "value": "T1E2E5332B5BE8011BC6289FB39948774E16DCDAA0D6D8F90324EDB4E7111FDD8F4E42A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923149, "uuid": "8abeb706-bb75-4290-ba28-238136b90366", "value": "49152:eEsbgGc259z0J7u75vl4gG+AfxKkvDvezrEMerDpSWA/dB01bRmLS/9mrHJL2U3T:DsRc25R0JV5Jre/aD8BSlmLChOXC/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923149, "uuid": "3d7d202c-320d-40d7-b18a-6267079d29f4", "value": 3039340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923149, "uuid": "99e2798e-e6c9-47b6-a9b3-89853b97bff6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923149, "uuid": "798c1303-c2ea-4b96-aee6-95d3961818ed", "value": "TempData60746284478.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114cac99-b92c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705930941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930941, "uuid": "b650e088-d8d1-4980-b15c-c2eea00b730b", "comment": "Malware payload", "value": "633ccb76bd17281d5288f3a5e03277a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930941, "uuid": "e3b12fc1-b7aa-457e-86d3-65cfe69a14be", "comment": "Malware payload", "value": "ceca49486dd7e5cf8af7b8f297d87efe65aba69124a3b61255c6f4a099c4a2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930941, "uuid": "3254796d-36bb-460e-b78b-5c55d5e5017b", "comment": "Malware payload", "value": "e986b238cb5fe037718172d965a41c12c85bbdd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930941, "uuid": "0c609732-7352-4e06-90dd-8c5ab1db5902", "comment": "Malware payload", "value": "9083e78d72976a52903dffd53a0764bc4adeb4546e852296372c7dccaedb644bc9f3bccc5cf25b6ddc2f0d563effe8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930941, "uuid": "db38141c-11a6-442b-bde3-0c3e3ca1951a", "value": "T105935A5BB2F504BBE5728A39C8674E05E776B8111621EF6F13A4424A2F673D08D3AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930941, "uuid": "9893e729-b770-470f-a85a-d1864a97e62f", "value": "18a80435a998455dc2b9fe6b38692c2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930941, "uuid": "58b4f66e-b861-473d-83b0-aa9476c1acfa", "value": "1536:aMAkpnnVzXXlEm4H/oekSlCIr9cOUKCDdvdawsWEMd09dlMJybdGJ:3AkpnnVT2AbSUICONavcKMsYdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705930941, "uuid": "1607fd85-f50d-4355-a1fa-25cb4fbe67ec", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705930941, "uuid": "eb0960e4-3f5f-4560-a06d-74ee17d40166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930941, "uuid": "a8d12ae6-a1e2-466a-b841-4f346ab54bc0", "value": "HPCustPartUI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1b46d5-b951-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705947017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947017, "uuid": "f0177a1e-0f0b-46f6-b2f8-2ca018a0e1f7", "comment": "Malware payload (Amadey)", "value": "ec2c94a21a52027c229a7824d4a1c5ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947017, "uuid": "df66582a-b367-46a8-9088-28db841dcac8", "comment": "Malware payload (Amadey)", "value": "cfd185173a9199f41d4819c7479cd868f6d913b0ca02a37ef93a802939889a6e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947017, "uuid": "ed9d65a3-db0b-49c3-b55f-fd2dcdd7f98b", "comment": "Malware payload (Amadey)", "value": "b17aa25017bf7d0af7ffb946bcace0d51331d351", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705947017, "uuid": "a09ab540-3f3b-44d0-bbf1-682695d2e4ae", "comment": "Malware payload (Amadey)", "value": "e7310e892964b6199531bc20f0063452aa54a715dcbc1db986cbc4453b34282255bb707e6e582ff4559cbf67aa36495c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947017, "uuid": "d8e8e1bd-3a16-4626-a6a5-8d810860260c", "value": "T1AA0523BB6207CB56D039C9FD4C8F69904A6C3CB9D29A5B284DAF90E50CE15CF97125C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947017, "uuid": "f64ed2e0-30ba-41d2-947b-d060126d355b", "value": "7515ecf8c0dfa4d230ad835fe0acb57f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947017, "uuid": "d34d83cd-4bbd-4413-a72b-89f1fd7de8a0", "value": "24576:Skt2zwjdnAwQ4x2K3yWds0JkKyV0+mZbmNrUCV+7d9/1:PnnAlpadsLK+mZSgfpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705947017, "uuid": "2385eb10-d585-4974-8e45-583f6695d9b3", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705947017, "uuid": "2d7ab496-5e1c-4db6-9c5c-e9d9ffec8ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705947017, "uuid": "4a737597-167a-4f61-b70d-9f3652f74a09", "value": "ec2c94a21a52027c229a7824d4a1c5ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3179e2-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911956, "uuid": "299cff1c-3d2f-49de-83f4-d2ae016e1433", "comment": "Malware payload", "value": "48433f100a4e1286165732ca7f43a93e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911956, "uuid": "6de7c221-5333-474a-bd38-d25722c4947c", "comment": "Malware payload", "value": "d07beaaf598934f780f6d7a3e7b25326a97e51f5bcb91774dfbc089386958970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911956, "uuid": "8448df32-a300-409c-8b76-99845b6850d7", "comment": "Malware payload", "value": "1a1142ca49c12e57f261987203d2a339691fa239", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911956, "uuid": "d57845c9-e3b5-4c4b-85a1-aa24dfe34e1c", "comment": "Malware payload", "value": "daa390dbddf779a75d744e364876ea064324f3af19d14e0c10ae3b9ebeaa4e2c784455b4e67eec633ef0a3101be2bcf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911956, "uuid": "c5163187-427f-4bfe-9258-63b9a8a3eac3", "value": "T19406335C364B6B9CC75FF6B78B84821C71786E889041661CDD3EB6AF13B412ECC98179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911956, "uuid": "ea4ac5f0-f784-4f6b-bae9-7981f07582fe", "value": "5f32870985596a1998c6198d85c7db12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911956, "uuid": "37c423ca-cec8-4128-a5d5-a8ddeaaaf959", "value": "49152:56EQvc/OPpm4X5rXZMY3cq6TY/0QmSXZ5O/sA5dVqp3OJdhqX1Ccead9pwx6c3MV:t/OhJJV/HnmEYdV63OgFCc5Jw42Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911956, "uuid": "1b80f143-7bae-41fc-abea-fa5305474f58", "value": 3837968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911956, "uuid": "9b99fc8a-e5a6-4f84-9111-f7ef1ee7d6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911956, "uuid": "e063bc1c-b6ed-4e21-844b-832d0b46b7dd", "value": "SecuriteInfo.com.Win64.MalwareX-gen.13745.24929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b3f771-b923-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705927246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927246, "uuid": "4dd9429d-adaa-41aa-a214-468da45e5677", "comment": "Malware payload (Socks5Systemz)", "value": "f4d3e3ba5f756633a8960474533b1d9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927246, "uuid": "f3b6dbdb-44b9-418f-b9f0-e0d02b27382c", "comment": "Malware payload (Socks5Systemz)", "value": "d0cf717baf93f6468452a387e76ec96560fbb8cb79bc2b080afd253cf3ad24c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927246, "uuid": "72dece93-3669-43f8-a8d3-dce7306bf3f8", "comment": "Malware payload (Socks5Systemz)", "value": "67cb75ad3aa72c2fe33b7cf4f710210735f5db9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705927246, "uuid": "1d85662e-4022-4c1d-b39f-70bd5c90a58c", "comment": "Malware payload (Socks5Systemz)", "value": "58f861cadc8ee7690c202934cd9861f8c023ae5a07e158cdf0fd628ba15ad80bb443cd7631d296c5bdee642434dc2946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927246, "uuid": "c950a4d8-abb0-4812-85f0-0b3006876ae0", "value": "T1B5363312BF44AB76C1A01B30ECF1731D9AB1FE1D1A439606699FA6DA2CA47D04D3B7D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927246, "uuid": "a8b05951-14a5-4add-b642-6a903bd364e8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927246, "uuid": "d018795d-2815-4a3b-ad0b-cf467b74e05f", "value": "98304:Cn98jUacXVZAJ35Wf12cQjGgQjgR1ve1gnrFH51UB2/r2ma0bPnvdd358:Y985CVZAJD2gQUWgnrFH5eBQ2fqPnvdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705927246, "uuid": "11d43820-80fe-461a-8944-bed543eae60e", "value": 5298535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705927246, "uuid": "c0ee8d6e-c232-4446-a0de-18ce941ddb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705927246, "uuid": "4884633f-64c4-49a5-b176-897580818a66", "value": "f4d3e3ba5f756633a8960474533b1d9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88653a02-b903-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705913531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913531, "uuid": "d039ca63-eb45-42b3-b98e-cdeffbc4125a", "comment": "Malware payload (AgentTesla)", "value": "0342b58eb13424f7ea9d67b06c2c2b76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913531, "uuid": "1b38af12-4f09-48ad-8632-58530be15bcd", "comment": "Malware payload (AgentTesla)", "value": "d16e5bfac8d055e63727b7894a312d8b81689d83923e9222f311a70a2a1f7ce9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913531, "uuid": "471123b8-0faf-40ff-abf7-5c72e92d8f67", "comment": "Malware payload (AgentTesla)", "value": "46479354428400284dfa173f7f61705bfa28fedf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705913531, "uuid": "ed5fc7f7-cf80-4ae4-8f3a-df1d1879f87c", "comment": "Malware payload (AgentTesla)", "value": "b0b39a6336950c747571395a5a48d37910fca3f0a8b7a15b25cb33b576968376b698dcd9255e4333e871564b67a6b413", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913531, "uuid": "03ac0cf0-a768-45b4-9f64-aa0e6a13dd3a", "value": "T141C42303F5B902991A1BEC8E25ECAC933A8751E1E56B4D6114C71D85370FFB1FE7860A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913531, "uuid": "821b26a5-a56b-4135-9040-5a45853fc50f", "value": "12288:tL0rU3qMx0QdZsIg99tSPl3V5W5LlBhzZz0s58LelI8Gh3Ms:tL0Qtd949It3V5WLNZzR86lI8Gh3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705913531, "uuid": "890fd7e4-2e78-4f2f-874f-d1224aa15aeb", "value": 593780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705913531, "uuid": "9d79621f-3fa0-41d1-a3aa-22c133764ab8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705913531, "uuid": "6dfa00de-f72e-4ea0-a241-6843f7dc012d", "value": "Swift Bildirimi 10000.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dc18e2-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705923599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923599, "uuid": "4e741513-0a2e-48c5-bfc3-1113fc17ca59", "comment": "Malware payload (Formbook)", "value": "903c93f7e4155a4f6448fd6dd55cd4ca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923599, "uuid": "0ddc71f8-2dd9-4541-b63d-7865f4ad6167", "comment": "Malware payload (Formbook)", "value": "d1d0c276240473567089e1e98423fc04bc9f178fee1e7a81b46eb98bf809994b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923599, "uuid": "40757407-2312-4769-9535-590c4eaf3f38", "comment": "Malware payload (Formbook)", "value": "a0b6b2ad17430c9154cc1090e1dbed10a7a175ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923599, "uuid": "39679549-3939-4594-a775-892ff1bf90d5", "comment": "Malware payload (Formbook)", "value": "4977ca14ea75d1636c97da6e8e93f72e458991c1a7fa38ed397a21605a211c430b8c4337610cf0b6dd240d3bbd5c9dce", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923599, "uuid": "8c692cb1-efa6-413f-88cf-0c04de4c409c", "value": "T19045232179A9834DC6A703FA116030941779B503AF67DAD9BFCC22CA8F177069F51B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923599, "uuid": "d9960bbe-7568-4753-8449-0df6776e4482", "value": "12288:zOAx6X60bYMBlXZvnFoCc54poj432UFHNDeXD+vvuTpmE24m:zlaLZqQpvxeXD+kpHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923599, "uuid": "b21b384d-105f-45d2-a5c4-2f9589078c4f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923599, "uuid": "3afe3747-0c4f-401e-9426-a97f9fccdb98", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923599, "uuid": "ce5eb129-42d7-48bf-86a5-27007cd2f2d7", "value": "nKYC 17012024.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fd854d-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705910518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910518, "uuid": "9430b809-2a02-404e-be24-eac45f65b92d", "comment": "Malware payload (SnakeKeylogger)", "value": "3a9e75accf2f17fad6f0c4360fc4a884", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910518, "uuid": "86f0afce-7d63-4d7b-b381-69bcce838e6b", "comment": "Malware payload (SnakeKeylogger)", "value": "d242d322e6f2c585ba3ac266d344151999f81b6aa1be7313da59a381402ce0a2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910518, "uuid": "fb4e225a-4812-420f-b3dd-8685d3bda5bf", "comment": "Malware payload (SnakeKeylogger)", "value": "57acc3577a60cbbbb9d3d91314f4c2ecd22effa4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910518, "uuid": "a8c45152-359a-4baf-9423-77e514ef3f58", "comment": "Malware payload (SnakeKeylogger)", "value": "7e22aa96dc2fb7786967ebb2eece901de0c0ca8aaeb7d67957ebefe34d8db12bbed98212a776282fc935abba5c3aba15", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910518, "uuid": "8fa99ef8-d542-417a-b7a1-b20c056c2040", "value": "T19524672DD34B01998F625337AB1B1E5542BCBB6EF38452B1306C437933EAD39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910518, "uuid": "3b161116-009c-4141-8b43-3cb17150bfa1", "value": "768:2wAbZSibMX9gRWjtwAbZSibMX9gRWjXsDDZYllFJFt7ZizijsuLsWbbEDvrEA:2wAlRkwAlRzDCv74ijDLbEHEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910518, "uuid": "cbb5b6f0-f482-4dfe-9300-478eac67def6", "value": 215141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910518, "uuid": "7f40c15c-def4-4bfb-abc0-635da7be79aa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910518, "uuid": "e75308e5-8dae-4f22-a0bf-aa7495dd430f", "value": "BL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d02ef9c-b94e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705945537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705945537, "uuid": "588f2bbc-11ed-43cb-8bec-42e9fb44c5a4", "comment": "Malware payload", "value": "e178a4f116c74fe8ed2432e8942e2e6f", "object_relation": "md5", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705945537, "uuid": "7c855194-40ba-426d-9c60-42ade708f7a0", "comment": "Malware payload", "value": "d2bf6f28f137b5c91e661484ef5cc6d627e8399718302cbc060357f22db63900", "object_relation": "sha256", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705945537, "uuid": "5f22d31b-7973-414a-90f4-a991e92da177", "comment": "Malware payload", "value": "b1fd45196a462fbd6b8c3d7338756373788e984f", "object_relation": "sha1", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705945537, "uuid": "831316b9-e278-4074-a20a-efcd2da9283b", "comment": "Malware payload", "value": "54d5ba4cd6145acdfb7c04d1496b205321bc5e264f530445b7fb17f9483ca53e1d889b10b75e716c092769f18859c600", "object_relation": "sha3-384", "Tag": [ { "name": "2024", "colour": "#593211", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "WHISKEY", "colour": "#947A0B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705945537, "uuid": "13c5228b-4856-4c9c-8e56-91bd3ad18685", "value": "T107E6337A0ABD47A4557E791DABD0326403F11F280633CE1229A466B1ECBFE73B61F215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705945537, "uuid": "bb1a0221-af12-416c-bf29-db8ed470bb9d", "value": "393216:4qWTmXgSbdNuy3wN5t4AaO+l8YKVlUaT71FLKiyYmH0:7ZgmNuyScgm87VlUu77hmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705945537, "uuid": "c726b17e-f715-4bd3-8f32-ad27cb30d09c", "value": 14100702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705945537, "uuid": "5dc239df-4661-4d58-b53b-43e566d9c013", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705945537, "uuid": "b5f04052-9b98-494a-a539-b4985d634318", "value": "Apply___2024_As_Passw0rdzs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0005bbc1-b934-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934348, "uuid": "ac76c54e-d169-4660-bf85-813f609cdccf", "comment": "Malware payload (njrat)", "value": "5bd281cc49f41e21469be915c6cb5a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934348, "uuid": "524d962a-0479-4266-b5f8-bf080e02d08e", "comment": "Malware payload (njrat)", "value": "d399c0e21b4898a4089df84581aeaeae7086167e36865dcb05efd4bc30e3e811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934348, "uuid": "b32aceeb-e83f-4699-ab7f-413328320044", "comment": "Malware payload (njrat)", "value": "1b938a721da3435dac7ef158922116077683f102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934348, "uuid": "7c355dca-2be0-4088-96e8-15cb533a1651", "comment": "Malware payload (njrat)", "value": "3f82c6346cf54f22b6f952add929c21c2b940360a5c299ec9a2c01664376ae0b6a6fc16acb86ee07b59870d929d9e153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934348, "uuid": "8f395d6c-e8a4-46ec-84c4-15ad0ea6768f", "value": "T132F21A5D3FA08162C5EF2BB44AA2D72142B2D1075A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934348, "uuid": "eb154515-ad12-4201-acbc-bd52692bb8e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934348, "uuid": "f929a537-d88b-47d1-8f55-c2ad51333701", "value": "384:HLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LEbsyvGj:rizrecPEZeK45SssSvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934348, "uuid": "26621092-a9ca-4c55-8ccd-bc9c4387fd25", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934348, "uuid": "ef2c9fd2-b7fd-4d6c-9715-1e41984a6019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934348, "uuid": "4b22f2a6-3152-495a-8e1e-95b8d683e823", "value": "bTdD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39b1b79-b937-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705936045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936045, "uuid": "4e5976fe-f15e-4aa5-8cf4-ee04f4df7f13", "comment": "Malware payload", "value": "eb06612e81d5fec0c2c26af6035fa6e4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936045, "uuid": "4078a50c-6ff2-4edd-bbd2-c379d06748dc", "comment": "Malware payload", "value": "d444ada61b5a34a58b7b13ae58638fdb9c34f0203151ca2189d142cd33dd50c5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936045, "uuid": "e3ce8e4d-3548-48da-99d5-e591da88a494", "comment": "Malware payload", "value": "af565fae1ae8af45ebdaac01de60113c65b8ac29", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936045, "uuid": "3e44573c-537e-436a-b78e-a0ac55252a6f", "comment": "Malware payload", "value": "f2ea3b28d90da74a9bf865927973c4d4da8289b7a99378997252e3027024a3756b2550d53ac07a35a6594f6e3cbf41c8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936045, "uuid": "99881d46-f150-4279-a13b-ef6a0003cc7c", "value": "T180851253F671AC2FC831D2B22569533520264D18CA87EB8A394437BD74BBAE88FC57D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936045, "uuid": "9b4264e7-b38b-4aab-abad-1f4fcd0fe443", "value": "24576:UpT0PcVXqk/z+UmgxB0O8t9UDpE4lNVdIHwhiYXrs9Q0XPW0hHDaiLw1EjP:gzJZmgxwOE4rVdIHwhiQGZV2iLEEjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705936045, "uuid": "03745412-e36f-43b1-84a4-3b0126b36462", "value": 1749930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705936045, "uuid": "b2dcb088-0c17-44cb-a686-c60007dc5f6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936045, "uuid": "53f623db-bd78-40fd-871e-0b9081096156", "value": "idm_download_with_crack_64_bit_2023.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d160e48-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705917297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917297, "uuid": "692bd07c-bf31-4e4d-b7a4-90c89dd004b8", "comment": "Malware payload (RiseProStealer)", "value": "84fea97325fd08250863bf947e3a0825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917297, "uuid": "69cd595e-a863-4bdc-97ca-853acf5156ec", "comment": "Malware payload (RiseProStealer)", "value": "d46d0fc06e3b9bffe399971067b3f82b24da42cea3817439fc04155cf6e3d22b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917297, "uuid": "5c6db648-71f2-4b90-8688-4dd4c32b1f2a", "comment": "Malware payload (RiseProStealer)", "value": "73bd18d098c0443aa17e48aea10afaf9e2848af8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917297, "uuid": "f9e11198-d16b-4580-af48-02da8a8f89f0", "comment": "Malware payload (RiseProStealer)", "value": "6859879d090655cc33143879367e1b78882c4c621df9a609ef6393b8c6da3d31cde5299d5e3038eba07b1b76d3a5c68c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917297, "uuid": "f36dc6f5-39f8-42fc-aab8-4b29d9e30d2b", "value": "T1AC4523F44BB7991AE0276FFC85492E4194EB7C2791684524A19BF3814F7C4FEA383E42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917297, "uuid": "9fbcf437-b92a-4546-8b26-f64a2ea483fb", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917297, "uuid": "87545486-8570-46bc-b913-7c8d7fa47a79", "value": "24576:lXhxeyqAC2yKdNSG8+ZYwQqBaWnBCq2S/tKbUzJZbmNrUTBeOmE:lXhPmqdx8RlqBaWnt2S/IotZSgTBeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917297, "uuid": "f3347f09-7ed4-404e-a653-85a74fe907a1", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917297, "uuid": "00281c3c-e3a9-4702-9d5e-bfaaba08dd7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917297, "uuid": "d7090c29-af3b-4d65-94ba-a88251b445c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d25ed63-b931-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705933216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933216, "uuid": "8204fd73-3f74-43de-999f-0a0e547d7a80", "comment": "Malware payload (AgentTesla)", "value": "dc0b367639df52200f44db582e89ff42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933216, "uuid": "bea854c4-2b35-41c7-9bf0-c9f5eadf8211", "comment": "Malware payload (AgentTesla)", "value": "d4de5078a15d847876ba1af8c9d49b5449eaf21515b7a70307d42ced8c335ebd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933216, "uuid": "fa2f3f0a-2e05-456f-b988-3cf82ad6b470", "comment": "Malware payload (AgentTesla)", "value": "d95806e423b1c2feaba4c467775fbddba35ea735", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933216, "uuid": "c714d544-1c2b-4ecc-867c-fbed128ddc63", "comment": "Malware payload (AgentTesla)", "value": "ed4e47d7862071e6764509c5adef8523d89288c8b66dcde86a6d57b11c1eb24a302ce8f8de9b4aed3bd659182473f01d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933216, "uuid": "d79054ff-21ac-42cf-9135-46700f1cf5dc", "value": "T1BAE40118BFD1A69DC9D0B2F518B1D1CC53317FC646E6EA88698130CE4D63B0DD906BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933216, "uuid": "41de361c-0332-4061-8053-592a176dd0c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933216, "uuid": "1f582ee6-2f30-4a92-a64d-e902e40f89ce", "value": "12288:CvQ9M+a3IL99FhSymUmZR14JxFdNMT02N9kvOJ:CvQ9T95i2JxFdNH69p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705933216, "uuid": "e3f218ed-3b69-45a9-9f86-efa67c8a7a93", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705933216, "uuid": "d0e922af-233d-418b-b4b6-9f4f82436434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933216, "uuid": "3af2c985-d217-471f-8040-fc25954a8634", "value": "HBKMC 56376 E127-EXP-MCE-231127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5b2b34-b931-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705933213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933213, "uuid": "79588a66-c919-4c01-a84a-42ae99c56cef", "comment": "Malware payload (RedLineStealer)", "value": "a2d38635434cee60e3df60bac2edf1a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933213, "uuid": "48996c41-2f6e-4129-87d0-7ae84b19243f", "comment": "Malware payload (RedLineStealer)", "value": "d5f214ed4a1a525261ba2a4891b3878d7f6ffadb780bf320e0be5085dd123ca8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933213, "uuid": "139396e7-5b9f-4b62-b51b-89c72cf294fd", "comment": "Malware payload (RedLineStealer)", "value": "98ceb2be09a10f13152fe59659b0f0c200422adc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705933213, "uuid": "87cc861f-2038-4911-9c9b-8ca1965c0770", "comment": "Malware payload (RedLineStealer)", "value": "736168401a9035262c80593b6da7e5276ca55a113650992f48084cb2d615a90660d9b7e2abebf96bc9b366210a6910a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933213, "uuid": "ad6bf037-29c4-4fb1-88d7-fd714f5f2205", "value": "T17F9412A2739B6B32C18D553884CB852927F6EF4326B3CF4A389952F54DA23D4D681FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933213, "uuid": "1067c393-f762-4601-b544-c7c80a38c584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933213, "uuid": "74f19758-0d17-4245-b03d-09384dd317d2", "value": "12288:CwdAqFwqldkbCuP862qKhaJ/UHQ7fSnfocIl:Cw6qV8CF6tKpgKnQcIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705933213, "uuid": "bbb06162-d076-4927-b76f-6c7bb7b9ef5d", "value": 419808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705933213, "uuid": "ff1dba32-7b51-447f-b019-441f073c7dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705933213, "uuid": "d1dfe045-1041-4669-a72a-f880eebad0ce", "value": "a2d38635434cee60e3df60bac2edf1a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a1b67c-b907-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1705915106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915106, "uuid": "26dc2953-d946-4830-8546-5d2394d0719b", "comment": "Malware payload (IRATA)", "value": "1150d0bf3a077be4f33eb487129d389a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915106, "uuid": "fe00a588-6fb7-4ad0-8236-2a2dccaaab2a", "comment": "Malware payload (IRATA)", "value": "d852f48e1c8a37d11f9dfb90f339316a5a3fa012bf152db43de1e81b45a69ba7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915106, "uuid": "a7689a23-1d15-4819-8155-6b3cece767f7", "comment": "Malware payload (IRATA)", "value": "0fc8c1e2c08fd3dc83ceb72a4848c9aab66b7d57", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915106, "uuid": "4b641089-2f93-4d80-a8e3-fb89a14745d0", "comment": "Malware payload (IRATA)", "value": "d1ad079d5d500e2212c1f39a708690278606246d6ae64ed205199aff21f658e511b7a1adcdacedba5bd8d8a8ef8c3bc1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915106, "uuid": "cd9d787e-e728-4dc5-b570-a83a9e211cbd", "value": "T1A93633D1F0B392DBF66B4073E4334709CB3A488ABE54185674F7736086E76CE9729898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915106, "uuid": "7ed245fc-f108-4ea3-8dc1-8f9a1fd97b99", "value": "98304:V9hinlhin6Vhinahinx1hin6hinshinUhinwFWKeUzE4b60sgPo8vI:VbCzC6DC8CxjCcCyCKCwFPecO0dhvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915106, "uuid": "d274e664-b841-475d-9083-112edcb276a5", "value": 4923574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915106, "uuid": "f7860c8f-28a7-4983-b0c7-50cbab9aea31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915106, "uuid": "38ccaea4-aeb9-498a-9b51-bd5f518870ef", "value": "MediobancaToken.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a34df50-b92a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1705930124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930124, "uuid": "6602f57d-6623-472b-95e7-d6460560f691", "comment": "Malware payload (Arechclient2)", "value": "f9207fa62b24e8b22604126d8e815d0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930124, "uuid": "5f610303-8d1c-47e8-a0cb-c70c5c8f9d1f", "comment": "Malware payload (Arechclient2)", "value": "d8d80724c96bf38d42612b755e8f5ff3cf034a08e933c7081fb9ed4a502c07d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930124, "uuid": "d67e18ab-9701-44ec-bebe-c402ad2202bd", "comment": "Malware payload (Arechclient2)", "value": "db838ff22096c725747e568c552b4389f06aff05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705930124, "uuid": "857d2c8c-715a-41b5-8298-688e9c26d852", "comment": "Malware payload (Arechclient2)", "value": "d8d081656e047e3356c4ed47854620651adbdd0483a4e80bf8a789a568e844cb2237effc6780a5faaccebbb9bd83d494", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930124, "uuid": "8f0c1826-1cb2-46d6-84f3-c275ec689b3e", "value": "T1AE669D13FF549E12C15D2A37C2D7141887F4D8D22323E64A7ACD2399590336FAD8EADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930124, "uuid": "fe41189b-d02c-4b2d-980d-8db911c04531", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930124, "uuid": "d8cd7923-65a3-448c-94f0-dcc80a9a71eb", "value": "98304:c+vH2+Fh+cWGi8Ff6aw+1qEKq8MEq5K66qceLE13IWkkmy:rvdh7ygf6aTx46RcD31oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705930124, "uuid": "255a1bac-4901-4c9f-bc94-f4b54bd6ba2f", "value": 6895552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705930124, "uuid": "a3b078f7-98b0-4f18-a4ef-4cae3cb864cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705930124, "uuid": "7ee20876-ca81-4f09-b551-f83230bf9642", "value": "f9207fa62b24e8b22604126d8e815d0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b17739-b965-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705955512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955512, "uuid": "b6b2c3ff-940f-4c80-9745-fd767720c1ca", "comment": "Malware payload", "value": "aeb4ffa1c4b01ded498966ffa062069f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-gxv3", "colour": "#5CA066", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955512, "uuid": "e37ff24d-25bd-4b34-97da-3422b91ed7f9", "comment": "Malware payload", "value": "d964e077e5e38d35253acece0651873b82b4254cbae6b8f8f5f5c8f299c6ae78", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-gxv3", "colour": "#5CA066", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955512, "uuid": "85e2259b-3581-45f8-8b09-b43ab4d6b779", "comment": "Malware payload", "value": "89e805d566d3b6cc80f7b29de4d0eeb191679243", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-gxv3", "colour": "#5CA066", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705955512, "uuid": "6ba60d23-1270-46d6-b967-b87ee158e568", "comment": "Malware payload", "value": "1e81462a5ea9675be9322abc8094b2c1b3c96923b44ad8aadb974c918870c6e15cced648378d1e0fd022633b52ba8080", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "Crysan", "colour": "#0DB0C2", "exportable": true, "hide_tag": false }, { "name": "PureCrypt", "colour": "#405C45", "exportable": true, "hide_tag": false }, { "name": "pw-gxv3", "colour": "#5CA066", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955512, "uuid": "8d72c906-2bdc-4c5f-b793-6608903ce162", "value": "T1A9C63398D72D4982F142FC86FED1DD01D4FD67A0C091C93C30BAB53D1A6CB627A94A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955512, "uuid": "837665bd-f27f-453e-a368-261a775520ab", "value": "196608:hgAKVYwx/uBERVN9ECE8ZJMsa906kRCWaTI3C5t/AJkVlt0Dpgo91rhWUPWAh/c7:8Vt/uBERVrEC9Ba906LANKVfY1r5eAp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705955512, "uuid": "870e35b5-6182-4ddd-8795-e9a4f0e3ca68", "value": 11940535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705955512, "uuid": "8bd7da02-9ca0-4050-9169-34378f303f2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705955512, "uuid": "9ef9ec34-e184-4924-9e3a-919a4331621f", "value": "GXImageLogger.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf8bfe8-b8f6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705908009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908009, "uuid": "f1a03851-0391-4536-b829-3c916270860c", "comment": "Malware payload (Mirai)", "value": "0ede2083d64019dc003a5d57e0694e0b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908009, "uuid": "7d51dbf2-bbe0-4002-beb4-6ff2b7c0b758", "comment": "Malware payload (Mirai)", "value": "da8dac615b992e129a200764d2f25be9704e30781be062a5744e6c32b615eb4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908009, "uuid": "f5c76684-a5b5-4162-be0e-7007b20fe910", "comment": "Malware payload (Mirai)", "value": "310390563269cf777827df0b35d2e87037f5780a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705908009, "uuid": "e785ce9b-71df-48dc-a430-618dec55cfef", "comment": "Malware payload (Mirai)", "value": "f97fde3c8b8fe619a7f81f877c43bd9c32990bfdbbee9a7a4dc418be80983128d052b04349d0450c5c12264d9560c299", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908009, "uuid": "817339ab-2680-4c57-b650-f4e8dfb0b6ac", "value": "T1C2E33A46A7408B13C0D22779BADB42453323AB65D7EB73069928BFF43F8279E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908009, "uuid": "fd4f20e5-5313-4190-b8bf-5227cbff2a93", "value": "3072:uYhfPEqg9RJ3aLpiWwrF95g93Sy5gBKfQbL5+M/9dcw5Ii:uY9PEHX3aLpiWS5ISsw2QbLEM/9dcw53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705908009, "uuid": "d04b8d3d-a199-4b56-b8c0-01544f94c41e", "value": 154101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705908009, "uuid": "b03ceb3f-7501-429a-a41e-85b45614d279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705908009, "uuid": "a11b2811-b7e9-480d-8419-a7a3480ef962", "value": "arm7.nn-20240122-0720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1c202c-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705910479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910479, "uuid": "f7e08f29-b18d-4cde-a644-7bfd40e3e688", "comment": "Malware payload", "value": "6dbf943c1313d219a7356cf45babe562", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910479, "uuid": "af6e51d2-c0fd-4d9e-834c-aff3ae2b5f9f", "comment": "Malware payload", "value": "dae60e2e948c1d4028f9eec23b1f190b84190d2e65f086b75585e3fa3d331882", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910479, "uuid": "1104e0fe-9967-4a40-9c2f-6d2c1ce08ce5", "comment": "Malware payload", "value": "62e05cc16d4a6054c72eae4d963db536517c8d96", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910479, "uuid": "3478df20-65be-4764-b31f-8fb8f77d7f3e", "comment": "Malware payload", "value": "b996fb2ee80e31709582621e23699b9b3a0c89eccfaf6a676995f54b70e2a7c9d56e8de8799de5def31d2fba1581dedf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910479, "uuid": "aa96f9e3-9c60-4054-88be-0b8f8e6a6ad4", "value": "T1DB35AE42B3F400F9D1ABC138C6569617E7B274591320A7DF13E48A642FA3BE26A7F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910479, "uuid": "b89d597d-d5b2-4bd1-9784-bc5a06b7f5e4", "value": "bc5e0d16984f2b0e533107512438bf64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910479, "uuid": "705cc30b-762a-4898-862c-f52f7f7ae1fc", "value": "24576:QGNCJVfijppjB/5XhQ2mXvBhj71xvh0lhSMXlrqnoW7Biu:QyCUppve20LxOunlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910479, "uuid": "d6b70453-0f7c-415d-bae9-d36203e70c48", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910479, "uuid": "a4878c5e-7f97-4962-8827-5a46bf09e712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910479, "uuid": "7dd6cd0f-85b2-43c0-9867-4e470c2ac68e", "value": "6dbf943c1313d219a7356cf45babe562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d82b1bf-b92d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705931472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931472, "uuid": "65d64c2c-4db6-4363-9e9a-e07ffcb84f9b", "comment": "Malware payload", "value": "ca7db2d555e67ba1f4560e68d5bc5b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931472, "uuid": "abc4b427-0788-4b65-b321-02c7b1e5334d", "comment": "Malware payload", "value": "dd21a9ce1d87e3a7f9f2a592ec9dd642ca19aee4a60502c8df21d9c25f9acf86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931472, "uuid": "689852b1-2416-422b-998d-d385c53315c9", "comment": "Malware payload", "value": "1ad7bb1ce823245df636fbddc8895816340b3458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931472, "uuid": "9702610c-b741-4e03-aa53-1ed868bde880", "comment": "Malware payload", "value": "6a6d944790f4a67c3fcc1f153f53d8a6108be7c486bf9157e6b2932b4b37d0c6789f70ffb48d0f76d17a7d0114201dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931472, "uuid": "ecb1bacc-f379-49dd-88af-3542d2cc8550", "value": "T104E33A1BB2A400BBE176C239C9535A26F772741617219B8F13A843761F237D1AF3EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931472, "uuid": "8d7ba1f7-4a9c-458f-b1f5-0a30a5929fa6", "value": "3cf9d9411f7e32b18cc6240f71434d75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931472, "uuid": "6a6fed88-591d-4af2-aaff-4f3c7be72283", "value": "3072:wg3Qshk57FUvPaY+0h59xnVVEAWF7mub:wgA57FKakhSt7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705931472, "uuid": "b6e4871e-5e6c-4871-8aa9-c25fcac22c18", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705931472, "uuid": "c0fc2d60-929c-4243-ad9d-401b13b023b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931472, "uuid": "7b040cfe-0f90-41b8-ad08-1ed6a389ebcd", "value": "dd21a9ce1d87e3a7f9f2a592ec9dd642ca19aee4a60502c8df21d9c25f9acf86.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1a0784-b8d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705894428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894428, "uuid": "3448740d-1066-4b5e-8ffe-f40abc6afcf4", "comment": "Malware payload", "value": "4d6333c1486b44affc174a60576ac0a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894428, "uuid": "0069b4d7-764e-494e-8115-ab650887ba0b", "comment": "Malware payload", "value": "deca217baeb4c2c8740a4b03cbdca257c0cee4fb05cd100f87552be8a04610a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894428, "uuid": "544fc63b-c8c4-4ae8-a9f5-4cdc3a7d1f04", "comment": "Malware payload", "value": "bf424b723695b72e1b8469e20c7ce601cdf808c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894428, "uuid": "3bfa69f9-27be-4b7a-9a38-893d3f9ccf0a", "comment": "Malware payload", "value": "40916cf71851fb1cba8220b224211d74f90f65d4c0d11f16545510ce7b8d03d3fe093ac9bd28a3207a6b33b4bded302f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894428, "uuid": "8489332b-52c9-47a3-bd16-79bfda0a46ec", "value": "T1B9532A09B3C79760C66446B8C0F3949523F3AB572B73D74A3D8052D60E677E68A43F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894428, "uuid": "4a7b1ebb-8f7d-4115-ab38-7292dffd91bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894428, "uuid": "c27c9456-2fa1-4b3c-a375-937f6c000427", "value": "768:mqYL8/1AiI/yYHHhvwxUL73PTTuHvgcoKozkO/hC+lNx23rIRQfPWhOr9xVh2fG1:eKENB7XgqKozBQEk3rIRQ3W0ph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705894428, "uuid": "3b2d090b-c5d8-438f-b10a-b02028adc107", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705894428, "uuid": "01dee3d5-d4e3-409b-ada6-d88a91f89e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894428, "uuid": "87870155-3641-4e8c-b47f-7517c675e31d", "value": "SecuriteInfo.com.Win32.WiperX-gen.18938.28404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf639c95-b8bc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705883129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705883129, "uuid": "dd6aed3c-b023-4ca5-a32f-8841dba56e84", "comment": "Malware payload (RiseProStealer)", "value": "1c8918482b9cd613ba75ab7a16463e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705883129, "uuid": "98ab4bb1-e22d-441a-8d8e-a7b59e245754", "comment": "Malware payload (RiseProStealer)", "value": "df0ec97472c0e4c62a37dd91c4b53e2b982a3bab09edc0c81294901789569389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705883129, "uuid": "72c34e9b-8d23-400c-a139-48bf27afbed2", "comment": "Malware payload (RiseProStealer)", "value": "4d4aec00fa8590829d47989fea4df33d32c17515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705883129, "uuid": "f8bdd851-dc88-4ec7-b7e5-acf29ab41020", "comment": "Malware payload (RiseProStealer)", "value": "eb02a02dcee8f4bf64845182e590ac9e62151779aa9dc5d5cd7f00d6bab8be7c1aa9695c5cf0eea2f6b0da748994ec92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705883129, "uuid": "2941da4d-f028-46a8-a0be-1f6d0e1501a5", "value": "T151558D71B652C075D19203F1316E6FE0469CBA3257A188CBB3C06E399A711E3757AF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705883129, "uuid": "0620136d-b6db-44d1-ae0a-fac52e62264a", "value": "30e61d50d6efffd7759aa76925b3b42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705883129, "uuid": "38088722-fa2c-4080-b58e-a522825b5314", "value": "24576:yyy2zzUyHpK+rQg+9K0kHZNgYGwKCrxpm9K4PC1ZTZiyzGP3Ff5s:mMFHVQ4Swnru9K4PC1ZT5zGtf5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705883129, "uuid": "5c8d4ee7-8d99-4c2f-9305-c33c600c85ca", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705883129, "uuid": "9de5ee05-af1a-4a7e-ada2-0aba2fc11440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705883129, "uuid": "45ab0fd4-fcca-491f-82fa-541f693c8878", "value": "1c8918482b9cd613ba75ab7a16463e18.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebd0ec9-b8d7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1705894429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894429, "uuid": "34eb5001-e1a9-4ae7-b8e0-5ea4d44adc6c", "comment": "Malware payload (Mirai)", "value": "4d17b5b70204482374e8b075252a9c4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894429, "uuid": "fee747e2-3b30-456e-95f1-c065bfc5c103", "comment": "Malware payload (Mirai)", "value": "e0148350e8356c7c568ca43654bdde0c576bf5fd2950d57c75a5eb14f39ef9f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894429, "uuid": "6ad89ead-9542-48f7-9f51-caeb0b1b9527", "comment": "Malware payload (Mirai)", "value": "0735c02434ea016411c7734fb4c9f31655d7254e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705894429, "uuid": "10ac2c12-7ed1-4173-adb1-705b0aaec7a5", "comment": "Malware payload (Mirai)", "value": "3dee987ad981c22af0049fbeb4725e7c410633a8860a4ead4d3cdb41ee25bebd721ae5bd0935e54a142d7ea898b9239d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894429, "uuid": "21eb4d64-05fb-4feb-bfb2-53e4507d2c00", "value": "T1AEE30845FC509F26C6D621BBFB4E428D772A1768D3FE720399255F203B9A85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894429, "uuid": "8e089498-2716-4c3a-b270-8a24cd3e8294", "value": "1536:upn4yjDTCKgxcANjptCsj2jARdBAD6ZuTSISgS0zHTHORpZaqrK6I2+20+l5Owyo:2j/TDq2j6AouGIFS0TyhKJ2DzSbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705894429, "uuid": "ed05ec00-0581-467a-a03a-fa459d979962", "value": 146048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705894429, "uuid": "a79d069f-59de-4f4f-835d-116d6d99cae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705894429, "uuid": "a5365ec4-a06b-4a18-8be2-9600582ff0aa", "value": "SecuriteInfo.com.Linux.Siggen.9999.8723.18308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20169ed4-b91b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923664, "uuid": "7b30d372-9487-458b-81cc-7200f6884006", "comment": "Malware payload (AgentTesla)", "value": "e0c472ca06db9de81526e12ebaa6b0f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923664, "uuid": "8b755767-f432-4cf5-b967-d53007786c1b", "comment": "Malware payload (AgentTesla)", "value": "e0254ed7b8bbae69cd4745b252edbd19571bc510aed598b4b860d68b04ae56c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923664, "uuid": "9f0844d4-92be-400d-ba36-545b1c2230ba", "comment": "Malware payload (AgentTesla)", "value": "758df82ccf89aae0767a4429b93f2559dc584b29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923664, "uuid": "384804ed-c361-40f7-8c4c-4a434d7dd929", "comment": "Malware payload (AgentTesla)", "value": "0819a5361d7a7b375f8355bab11e0ccca77dc6e8e857a6fc4643f511a8ae6ac6af288f0f41f0672539d9efff05df9f64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923664, "uuid": "426ad68d-c2d6-461d-bd75-09f23b28de0a", "value": "T1B025E87974790127E931E7B78AE7F437B07A9CAB3025EA2854C777654BB364220C312E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923664, "uuid": "92322c65-045a-4be2-ba91-ca73e459d949", "value": "12288:r88ycK86/z4QbAd9opRXm+TsEKtqA9AvjkgO4/rn2UJa49QpCw:QNcK8Uz4QGgdK8jO4TjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923664, "uuid": "453f0ae6-590c-4ce5-b64c-e787074e2010", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923664, "uuid": "78b710fd-a559-486a-a170-09806000642a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923664, "uuid": "a3fb8df6-f5be-407a-aa4f-b0fbdb556493", "value": "nORDINE 2301518_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f47ca0-b945-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705941847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941847, "uuid": "df41afb2-9d54-4fde-87f6-0d5ab6e015a5", "comment": "Malware payload (AgentTesla)", "value": "f1c461c6f971459994b7252e7455fa08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941847, "uuid": "ef75dc22-1148-489e-8745-9829b90165c3", "comment": "Malware payload (AgentTesla)", "value": "e081ca8b5728fb597ab6ef5853adbb58e3e576386bb566b48dff5e3b92dc02fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941847, "uuid": "09ffb8cf-fd1b-40ab-b7ab-994dc96c62f4", "comment": "Malware payload (AgentTesla)", "value": "1b353efbca36a3e8401c8de2998075b3c2e90db5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941847, "uuid": "2a204d27-beec-4ecb-a5ab-686fafb2bde7", "comment": "Malware payload (AgentTesla)", "value": "6a0c3d242ef51a59e3cc30364fba703d059a07cd5553c5e9b3150be8fe6e85c777d259a0adf6ae0915e4441746620949", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941847, "uuid": "710ead7d-ce25-40a5-a734-f88e7dc97a40", "value": "T179081296B6B89F32D8FE67F2401094054BF1A8EBA876F75E5CCA60EE1412F540E90F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941847, "uuid": "1c2102b7-17c5-4de4-8175-448d9e39dc98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941847, "uuid": "d066c7ad-46a7-420f-98e2-49f92ad0dafc", "value": "12288:SH+0P2MkJ02BSIkQMEdWxQxb7kzT+MH1p26qDA8h9:Sp7klBSIkDqRxb7kzT+upDqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705941847, "uuid": "c1d632f3-2939-4b7f-960d-d1dbdb83b402", "value": 83886080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705941847, "uuid": "6f7fb916-75e2-4e44-9e9a-03a3140a9a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941847, "uuid": "b094ecb8-aec6-4f2d-af3a-060b0b272ea4", "value": "SecuriteInfo.com.Win32.PWSX-gen.21147.31604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa84c7b6-b8c5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705887094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887094, "uuid": "e4ec9b0e-9c24-4c5c-815d-60f9191a5151", "comment": "Malware payload", "value": "583c707d849198ac93da1da600d4ef5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887094, "uuid": "5622348d-e580-4f21-a9d0-1ac3f8587559", "comment": "Malware payload", "value": "e1a94b1966260525c7576ac64c722e9c612ed0149d6a7d274f5a912eb1740ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887094, "uuid": "00592857-1bb7-4e75-8599-1ce0c209151f", "comment": "Malware payload", "value": "3ab76e60daff8d82a93bef1b44cfdd80af083057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887094, "uuid": "638a17d0-8947-4712-bebe-a7991487563c", "comment": "Malware payload", "value": "cd53e81d29109770e64af63a6f4fc09825bd6cb27a31272f20742a219c2a3a2534378381507c0506313fc3aa7c856fa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887094, "uuid": "150d23d7-ea69-4b45-a1f4-6304770641f8", "value": "T1A88633A0ED606CB4F6B6CD7483A2DE666D2E2D5004CFAD778B27B059FA87753601C4B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887094, "uuid": "60609fda-d4f9-4068-8c1e-d88a5d1ceb53", "value": "61cb50930618cbd689faa75c133604f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887094, "uuid": "2878666f-b503-4915-bd7e-108edc05bc0b", "value": "196608:kKLZCopfZSkNGrC/zQy1uuZgHTgHwGPloh:igYC/MyxyHTgHlah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705887094, "uuid": "6c8500db-0466-4b40-9a84-84f8493b6779", "value": 8098104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705887094, "uuid": "60820530-37d6-4149-9545-c363e46fcf45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887094, "uuid": "b9615e69-b2d2-4b66-8623-fc0785a4eddf", "value": "SecuriteInfo.com.BScope.Trojan.Hosts.2995.27226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9521250a-b8da-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705895943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705895943, "uuid": "41db62ae-5c8c-4a56-9085-96819c3ab260", "comment": "Malware payload (GuLoader)", "value": "0e0e99a2c48c48746b45f597780256f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705895943, "uuid": "952b787a-9aa1-4be0-ac68-60231f872262", "comment": "Malware payload (GuLoader)", "value": "e1be7b23cd76177220b4e03cae44abe132ab153875d64f49f82c52bfc16cae61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705895943, "uuid": "c5e07fd2-c723-4864-aa1b-cf8042ef479c", "comment": "Malware payload (GuLoader)", "value": "95eacaea9205b3a07c7a9a0c84c34c9702516c18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705895943, "uuid": "ae23d2ae-f058-4bfe-b4c9-b07e0b64326f", "comment": "Malware payload (GuLoader)", "value": "6d80ac65deda6ff9bc7d1488814e6745fbb5c13c3eead65aa87ea8d1ef2f2e1487589ac3ae3537d7d50c3c8840153d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705895943, "uuid": "f8c3edf9-0676-4b24-94a4-3de0b87ca4a2", "value": "T1A315125F3294D98AD9F64C72DE35CEF082E0ECA5DC9A26033A857F8E3473215652943B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705895943, "uuid": "b1365110-b54f-4657-94b3-9779e0bb6a55", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705895943, "uuid": "5b228483-92d0-4010-ad14-19ad354d964a", "value": "24576:b1xuZOWVgmqYiBLw7pAAINU/rqGGUIqpmyaXp2owCyXdIqIF:76VzCLO2xUjpmv2BCyX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705895943, "uuid": "79eb2123-b3a6-41d3-8254-15289e60fb4b", "value": 921945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705895943, "uuid": "bf5f2460-4946-4fef-b4d3-12f44a1b4926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705895943, "uuid": "3d7253e8-f292-498e-9fe7-1ebdede8df0b", "value": "best.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0acb7f58-b90d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705917616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917616, "uuid": "4e045d0e-9e94-4936-b591-7328424775ae", "comment": "Malware payload (AZORult)", "value": "4ecfc2179cc495e4b7b3f75e7c6bd28b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917616, "uuid": "10201aae-338c-4769-9525-56075649b4a8", "comment": "Malware payload (AZORult)", "value": "e2ed0fc294f7ba96adc7f11fcfd6b1c92744e352a6c5ec1d845185d688e520ad", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917616, "uuid": "89dc7085-bb8e-4064-97e4-0662f5234294", "comment": "Malware payload (AZORult)", "value": "24ae8637aabb0d43db208a67cf9483774058debb", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917616, "uuid": "e777b6ab-25b8-490e-8644-55c450a2268a", "comment": "Malware payload (AZORult)", "value": "968ee46aa495c4b417d342ba465d046b0a80b9deb7c5e22ff8ec5051f818b0c31bc449686e651af7158379bd9f6c88be", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917616, "uuid": "8e436069-aee1-4e9b-886c-a3f45cab7b0c", "value": "T10994E0157390D40AC1ED4A709DBFE2FE5E68AE076D60461BE6C4FF5F3872AC1B849209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917616, "uuid": "a88cb0b1-2933-4d84-b3c2-c02289dbf231", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917616, "uuid": "d62e4acf-1e12-4f93-9e31-1a27107729ad", "value": "6144:f4t6Lsvq5WSBHHvd7wNHH98uUkyiSp3hWD8+y8Vog6cjmSlJeL:fkvqcSBHHv6tH98uxZjAympcCoJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917616, "uuid": "53b203a0-c93c-4624-b597-75bb8bdf3fdd", "value": 423584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917616, "uuid": "ef754967-7f48-496b-a112-08950742ce03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917616, "uuid": "403fc8fa-1a6b-4160-82bc-750f7fb80abe", "value": "IMG_20240122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ec4346-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705950684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950684, "uuid": "587a4264-4acb-481f-aed4-7aae0930f597", "comment": "Malware payload (AgentTesla)", "value": "bcf9819a393ea7998a2d0c50990c0902", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950684, "uuid": "5452204d-ef5d-4f37-9264-0f37601cf635", "comment": "Malware payload (AgentTesla)", "value": "e396a491c46153d0b7b52bb077674ff0742525e437bb828674f561e55d7342a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950684, "uuid": "be1a568e-f723-4c93-acb7-18d06035c600", "comment": "Malware payload (AgentTesla)", "value": "4161d67ec465f0d0b826847cadcc0e632626a479", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950684, "uuid": "31525923-6ed6-449f-8e52-063799ee82c1", "comment": "Malware payload (AgentTesla)", "value": "0d73af904a8825433cad7465699e26d27fc6c59dafe556f44a5824b5e142e1186358e51c7e9f06398ef5c0f0a662736d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950684, "uuid": "a05b5bd8-e34d-4c1f-8059-ee9e38535281", "value": "T15735AE0277818022FF9B95334B56F6314BBD6E260527A51F13D83DBABA701B1163E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950684, "uuid": "9fe03bc1-665e-4856-b50d-656167a4f728", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950684, "uuid": "88845bf7-cf11-4e68-a0a7-a540e84870d3", "value": "24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8a0rGCM6DQkP:CTvC/MTQYxsWR7a0yK8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950684, "uuid": "bf5d3dbd-7bd4-487d-b4d3-98c76069095e", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950684, "uuid": "adca8b00-327d-4522-9bbc-8fe39bcc81ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950684, "uuid": "e46f944b-29f4-4c66-9e8c-e8a52529ec9b", "value": "PO_00876 Nuevo orden.pdf____________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e48e2c-b8c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705887330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887330, "uuid": "de1332fb-1929-4014-a62f-aec43e6355ca", "comment": "Malware payload (njrat)", "value": "033d72d6e8bb60eb73c0f2d728190205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887330, "uuid": "61624dd2-3d4f-457e-8039-c9db256367d7", "comment": "Malware payload (njrat)", "value": "e589a6a7a03642ccedf7b1a6d5dd1b72e3a12f9fa9d3bdd35da0ae02c9878c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887330, "uuid": "4a39da57-6a8d-4659-ac6e-6df63278a4d9", "comment": "Malware payload (njrat)", "value": "4448197bcf0ec719069586fb177e21b0b025c002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705887330, "uuid": "27ffb7e9-1873-49c3-994f-71bf92957a78", "comment": "Malware payload (njrat)", "value": "5a5fb47ee82e41e8217c3de293cf7f7315afb8a5a9f944d6342d0264f6b31e9fd8363e1fd9c69528cd100a01cad50455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887330, "uuid": "5bc9b6af-a678-41fc-b076-41be6c973649", "value": "T1AD45336CDD915F12CBAF5B70604CC413DE7518816E1623081EAFDA108CB7F97B7AAA6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887330, "uuid": "c6f9c23d-08ae-49c9-8a1a-de24a6198df4", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887330, "uuid": "f7a01007-cc45-4375-8fc1-b9bada35e11b", "value": "24576:+kL5gmvyAFCBaqNcbQ9GL7qSp+sAhXZMGZerZxG:+k+EbCafso7FVEZvZmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705887330, "uuid": "d3a93c55-90ef-478f-a28d-4fac6dbcc5c5", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705887330, "uuid": "ac64a65c-339f-48a0-bfa1-e1f33435ede8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705887330, "uuid": "85222f0e-5899-4dc6-8e7a-04e322364ba6", "value": "033d72d6e8bb60eb73c0f2d728190205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f1268e-b948-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705943241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943241, "uuid": "b7df36d3-c97e-4431-b4f8-1384e070ad47", "comment": "Malware payload (njrat)", "value": "a4e43b5b2605e7c9940502d2d3a67192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943241, "uuid": "b05e2345-bb81-4b71-8858-746c76b21781", "comment": "Malware payload (njrat)", "value": "e5d52eb607a215419fcfeeb58a8ab61680da4cb480598de4bf4299624e19f4d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943241, "uuid": "6ce6a873-4760-4181-a23b-d583a558c7f1", "comment": "Malware payload (njrat)", "value": "33c463c9e815d4eea5cd11b150fa5507a7c0af0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705943241, "uuid": "599fc064-66ba-476e-a3ca-07811ab02e6c", "comment": "Malware payload (njrat)", "value": "636460ab85a4f3ac9fdf279cf980e2c0a8fce9c297e026654b444fb214def4afc576e7d40cb6116316e12b40f41c129b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943241, "uuid": "6a36adbc-4cc0-493a-b137-7aadf505a2ce", "value": "T164E208067BE94215D6BC5AF88CB313214772E3438432EB6F9CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943241, "uuid": "d6a23a0c-7d09-47c2-b8f0-9908a41b8e8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943241, "uuid": "9f5998fa-b586-452a-bb4e-36da8a763a45", "value": "384:60bUe5XB4e0XyOpjw0Q0mS03AWTxtTUFQqzFtLObbl:jT9BuxC55dI4bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705943241, "uuid": "ff6df61a-15ca-4ff2-a525-21a60b22ca93", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705943241, "uuid": "57cda6e2-1d07-4bb0-8bd6-4eee6e2deabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705943241, "uuid": "0f1a72fa-bb72-437e-aa1d-d695f0d1b44b", "value": "bTeR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25338b5-b919-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705923158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923158, "uuid": "a2e214a4-d1f3-454c-973c-f5245e82cf70", "comment": "Malware payload", "value": "1a8193ca96aa5b7bb8669b388d546a4d", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923158, "uuid": "2dbdfd8c-d8b4-47fc-922d-67e6551feebc", "comment": "Malware payload", "value": "e5fa5e96d60d08c5630323becc33fcea1e73273d4c6d5f900b7a1bcfa0243dbb", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923158, "uuid": "c56d6b56-4a0b-4e8b-9010-475c00d24205", "comment": "Malware payload", "value": "3192083d28e9d143a1ac2552ebc0cbf2b18c5d2b", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923158, "uuid": "74da61ff-63b9-4b15-b77c-0eac5e7a34c8", "comment": "Malware payload", "value": "b4ae624569e7926a871998db543af9283edb8bf45db2fa0d0a6d815e66c00fbc2bab9ed0d4938199a3827f781e1d99de", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923158, "uuid": "70fdc7f1-5cb1-4557-b2df-e6e240064103", "value": "T1E6447D0673D5437AE4D702311B9F93628F72EC788663422B1699760E3DF1594B7B32E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923158, "uuid": "520c706f-a8ca-43e9-840e-50d9758b7a43", "value": "3072:JPwIY993DQY5AXU6ij4qpXqnnDibAJBVkkMcB3RUN46ILJ9+ZB5yOanVE:JoIS3DQY5AXTqp4nwEkrWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923158, "uuid": "4d76894c-24fd-4147-a518-bf35c10a95ad", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923158, "uuid": "4aa7dd53-d7a2-4acc-96ad-4aae2d498ceb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923158, "uuid": "6c850e22-948a-40c2-b316-53a07ed2b23a", "value": "744787985728297732483.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b51f03b-b8fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705909912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909912, "uuid": "734f233e-e942-43cc-8208-0c9d1d2828eb", "comment": "Malware payload (AgentTesla)", "value": "37802219d55b02363d3feacd7f27cfcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909912, "uuid": "a5088482-d9b8-4d38-b429-c834e7d4c5bd", "comment": "Malware payload (AgentTesla)", "value": "e6a007a4e5e663a370f8ce396f8b62b74afdc57d13874523f99824ebcd554341", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909912, "uuid": "b2158501-dbe2-4820-9642-080f70cdec69", "comment": "Malware payload (AgentTesla)", "value": "90c00a76bf7d851c8e3bb23645a5fa84b1935b26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705909912, "uuid": "ee6d86f1-0c5a-4db3-8d29-587055339156", "comment": "Malware payload (AgentTesla)", "value": "961253d8452c49c072d7d70a0b993a1d184bec8da765bb2035eb986b6d659ee0edb2da2803531a1c26c3fa7a802a2ee0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909912, "uuid": "111b20cb-03e4-4ec6-8a47-db140181462d", "value": "T1F8C42396215AC2BE47FC68FCD714825DEF3960B834D26B3B69DD062AE4C1F15CB8194C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909912, "uuid": "29225c89-17d3-4815-9c2c-7f7b976d7e7f", "value": "12288:DMnZr1xu4ndbRoxDTuTbndlUT1u8Uto/08K6SrcnRvyGi15ByltbzG:DaZrrgCXdlomxMRvyGi5BUzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705909912, "uuid": "f8dc846f-0cca-4034-b475-726af1785446", "value": 591268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705909912, "uuid": "f4f08a36-4e14-4661-b28e-a7daca01e9fc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705909912, "uuid": "0a67dec0-6c06-4130-b04a-679c2003a741", "value": "Swift Bildirimi 10000.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26fc308-b93d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705938513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938513, "uuid": "2a383bdc-d95f-47c7-9c61-b1345200c802", "comment": "Malware payload (zgRAT)", "value": "149fe784ddd552aa6e989abb6de9e27e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938513, "uuid": "787c7028-9af3-4a16-add6-1a2c26dba7f2", "comment": "Malware payload (zgRAT)", "value": "e7583882961b541180ce58c3c839fb57e80e467407cd4b2cc7d3ec039a220b62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938513, "uuid": "eb09cc24-e574-46dc-908c-1648a1f94f8c", "comment": "Malware payload (zgRAT)", "value": "ec5c4892e7a018c63b5e58cf132f99e67005d866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938513, "uuid": "75c32668-7f45-4609-a573-f373d2dd2fa0", "comment": "Malware payload (zgRAT)", "value": "9005b18af204040b780813537ef394d9ba267c7bd47a038f23ffcc39db3f875b13bbf5b6a3e12b3bc19d7a3ebebc3d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938513, "uuid": "a4218f3d-f80f-4be5-a2f4-1a7e0a32feba", "value": "T109668D43BA49DE12C1685A37C1CB101443E5DA917777E70B76C9679A2E033AF9C8E2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938513, "uuid": "01888ec3-8a39-442b-8d3d-eaddd2d5520c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938513, "uuid": "1fdf66f6-7627-47e0-9425-ee6048d834ee", "value": "98304:SuXoHEmH9gj8mAbSUH8r6k3/NGVFqRA6gM28XawbTCa:jo9H9gzT+8ek3/NZRVglgawaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705938513, "uuid": "e41a8606-862b-41a8-aa78-6ec175dc0cad", "value": 6947616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705938513, "uuid": "af4213a9-f220-4d79-a81f-25bfa87b1904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938513, "uuid": "1f291532-b3df-44fd-bfec-476637077aa0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b819621f-b93c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PoshC2)", "timestamp": 1705938093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938093, "uuid": "21f565af-c0db-4794-ae60-2f6727b7136a", "comment": "Malware payload (PoshC2)", "value": "91d6123f8c63d298b7640d688a153c7d", "object_relation": "md5", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938093, "uuid": "a8708fd9-ee5c-45d5-a16c-38eb6aee8105", "comment": "Malware payload (PoshC2)", "value": "e7e7806d23b660ae2b9d59277003677682bf32834882eb3e781ec93d86e09be1", "object_relation": "sha256", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938093, "uuid": "32dbdea9-993f-41dd-bd00-48e7d8a27264", "comment": "Malware payload (PoshC2)", "value": "28b9fd9db2609c8f425c6f98ad16100cd277ca12", "object_relation": "sha1", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705938093, "uuid": "fd977ded-c605-4745-b4dd-9e7e54a968c0", "comment": "Malware payload (PoshC2)", "value": "d668270df9bb3dd2400f6f364b3d4ad857bcb78156d884885001f9a38fbd119b5e77e6d23c1b82f8958a45a4c21d19e5", "object_relation": "sha3-384", "Tag": [ { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false }, { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938093, "uuid": "068b1ff6-1512-4647-b73e-fd57d50ab6e9", "value": "T1FD4176F1F323C0D04472A277ECA7D089AEBC806A0021150A7ADCC9DAF7B1D606272F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938093, "uuid": "c1e14459-2536-4c1b-b3c0-5c6863d5d8ff", "value": "24:VJYcgZRJANr1Vje1N7GFuNKOfvIPyIHWb3zlb19EZOVxD1cWyPsc3/FFO+gfj50L:8cgJMr1Vje11Z9IYb19Z/cPFFpgfqpg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705938093, "uuid": "9e94890d-253e-4e69-8964-7900e9d30cb3", "value": 1952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705938093, "uuid": "28164cd8-4445-491a-9326-2735fc414a8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705938093, "uuid": "01394a1c-c866-4b9d-986e-0532cc7282ca", "value": "nVX7Zrz0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a3a5b6-b96d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705958941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958941, "uuid": "aee38ebe-de64-4226-b78f-24c9bba0db18", "comment": "Malware payload", "value": "295f56fa129e760ec277dcb7931f632e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958941, "uuid": "fa9643a9-4697-4ddc-b803-7c48912c8f62", "comment": "Malware payload", "value": "e8342650ce33826afaa5383414e11c1e7ffe896ad932ab263e4c1751719d0f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958941, "uuid": "61be10be-632e-4fb5-8f40-c31436e686f3", "comment": "Malware payload", "value": "5bdbeff9e5f875656b2138760dcb8cb7fdc664a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705958941, "uuid": "278c98f5-c5b4-4ae7-9a63-78bcde557e32", "comment": "Malware payload", "value": "dbe24d3eb4019a993d74ebd694544a1a13727ecdaece08287687d7d1e169dc4f88b596b6bad807f6892ce0fe81ddc9a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958941, "uuid": "b9ec7cf2-c274-4caa-a954-ce49d05a06e7", "value": "T10DD77C5AFF43A4E1FE6B8631025FB739827989344034AFB3DF452585BC336921A1AE1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958941, "uuid": "1bab7f3b-50eb-466c-9073-10b478d55a00", "value": "7c844bef84b88f2cae48a04c7ab91fd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958941, "uuid": "b300f0f5-4896-498e-8a71-f27a72f9a715", "value": "786432:9Te9QNNDTFa44vUAPzK+D2QAPAbqWsj3U:9y9vUscz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705958941, "uuid": "9a3aef45-bdb8-441a-ad88-b43b6feddebc", "value": 59914752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705958941, "uuid": "95261cff-3766-4817-92b6-e22164e222ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705958941, "uuid": "e9bf5e82-ff6e-469e-8097-396f6e06f2d3", "value": "SecuriteInfo.com.Heur.22181.608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f08f57-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911964, "uuid": "767ddffb-65f9-474e-b1f0-b57e328bb5b7", "comment": "Malware payload", "value": "1123952f187643e4968470c0a123bef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911964, "uuid": "2bae8e26-f3f0-4e10-b66e-c240e70b2356", "comment": "Malware payload", "value": "ea1d55c5a30125bc7499ff47eb46fea512b6e38c17f54f81a1b8faeb0e7cbd6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911964, "uuid": "3d4d3ff9-4245-47db-9582-b90ab8fb14cb", "comment": "Malware payload", "value": "5abff1047f7b1a0688f17351f50e890fffc7c675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911964, "uuid": "4a13be73-6fac-4a1e-91a1-ea512fe4e854", "comment": "Malware payload", "value": "be1d49df65a190a560537e827cbc9f59fd1896a46452b7f2542029e2b468d58c66d267ae779879d826dd4faa9f0923f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911964, "uuid": "b6bd1aa4-461a-418b-bba5-a5853d57ff04", "value": "T14506337034EF1F9AFD3FB87A8DE1CA6424CE20166A06860C1D93174E6FC5998A918FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911964, "uuid": "f94f147a-c233-4dce-ade4-fab0282c991f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911964, "uuid": "88f14893-258e-421c-a84a-559341baa1b6", "value": "98304:KCsx25dRJqUzLfs32wF+Hk8jDSk+jhNTHfX83+qK3Tax:HgKsGdHkkSL9s1K3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911964, "uuid": "ddfc83f4-6215-47d6-b836-7f54a1bab7ae", "value": 3817984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911964, "uuid": "de751e90-80f8-4349-9803-4413b8490dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911964, "uuid": "7ca2ee39-4aa0-48f7-bbdd-a9fb7da534e7", "value": "SecuriteInfo.com.FileRepMalware.10045.129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2d394d-b908-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705915843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915843, "uuid": "7b071f00-3335-4988-962e-07d7a92c6ec3", "comment": "Malware payload", "value": "6b4d420a267dcbf73187842105db229d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915843, "uuid": "27887476-f550-4bf4-9ae6-71463cb698a6", "comment": "Malware payload", "value": "ea280153e73e7df72b60d075260b294ff6419742d7ff0226049027e3c5a6326a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915843, "uuid": "d0bee666-e53e-4755-97da-051ad65f0bf9", "comment": "Malware payload", "value": "62d5d8fb6789df7f291c5742650b5cba45aa4442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705915843, "uuid": "3a9466e7-a31f-48de-9111-883ab6054585", "comment": "Malware payload", "value": "106cafb5a6bcd181a58a473400b7cc7d07e1e84a90e415bbd47b033e0d3413b5d9ce9e2baf55ca8ee729a87ce6b93709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915843, "uuid": "cc26f53b-62d8-408c-bc59-e6fb87e7e211", "value": "T16CA302CC328187F6C27F23362E7EDA325D85720595AC7B017971AB8B6DF19328C6466C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915843, "uuid": "27b213a6-7b62-4028-8647-9ac057170d7b", "value": "03eb4788c31465a3ec96d0efa3e3977b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915843, "uuid": "7e2f86e4-e848-4b60-8751-d495c86677ea", "value": "1536:FVUEAyboFBv0UfRrCHRjQR546XmB436JbcIJ6AKihses6QfIfuAFcPvjv/NI:TZq3RuHZi5Q4KWHA4es6mIf1yvjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705915843, "uuid": "827401a3-142d-4238-abff-4bc8c09b5694", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705915843, "uuid": "ed7f16fd-6ee3-4c99-b50b-9bee4c1f902a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705915843, "uuid": "3d6128b9-dbac-4b69-bc78-8cff086547c7", "value": "SecuriteInfo.com.FileRepMalware.14535.26363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62f2488-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1705917474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917474, "uuid": "9aaa1d25-2781-4a35-bfad-80165d8cf3e1", "comment": "Malware payload (DarkCloud)", "value": "80b64000c05f3144658e05c696bae93c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917474, "uuid": "496065df-dfba-4c97-b704-04eff1a347db", "comment": "Malware payload (DarkCloud)", "value": "ea399759fbd83f80066105ff45bba9e5f4d2756eded1a0bacdc0bdf32a283af2", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917474, "uuid": "4c7e1890-586d-44ea-9305-e69d8e44f6e4", "comment": "Malware payload (DarkCloud)", "value": "6a0d78385a73d3e5357d124a2b67091d4b696889", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917474, "uuid": "e4d4cbff-4eea-4256-a7a5-dacd6e891ad6", "comment": "Malware payload (DarkCloud)", "value": "9553415a015b0936bf7efa295cd55ec59a3744d8c472695e16f7a85a56754dea256ce58de213704105ebcd8e24ee51f5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917474, "uuid": "662dd69b-cdba-4bb1-b9b9-8336a152d93d", "value": "T1780522A233FE0B77C8B9C7FC992154C547F4B99A1469DB489CCA70CB1462F85DA81E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917474, "uuid": "a61e1696-cae0-4a0e-a0a5-83267a27c96f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917474, "uuid": "6c2c1b36-49c3-4440-a1f4-ff0dcf8fdecb", "value": "12288:0p1+IE+qwVpR/UUzfy1ZjQtnJN5ouG0DDZMeYxgpTCv8aAq0dbVGzRxTl:UVE9I7DG/jQRJ7x1MlxOJNedl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917474, "uuid": "8846d811-0993-4e3f-93df-1750dac740e0", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917474, "uuid": "a522d771-8e72-4f75-bc7b-bb92d5921ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917474, "uuid": "9aea6da9-622b-471a-91e2-541622c2cb70", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e97d80-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705917448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917448, "uuid": "9f132c75-917f-451c-ba66-9a64da8cf829", "comment": "Malware payload (AgentTesla)", "value": "4ec840f170d033c98eed4fad56d6b6ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917448, "uuid": "a708cb50-ac44-4377-894e-d67ff5485cdc", "comment": "Malware payload (AgentTesla)", "value": "ea89d821d04aee27aa911b6004ef645d3119e8cf21a60fe180cd27a9b1472034", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917448, "uuid": "d3fe4271-bde4-455b-81f8-c892b4eb9f5b", "comment": "Malware payload (AgentTesla)", "value": "f4acc57216fff84590f8ff239beaa34907329d58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917448, "uuid": "2c2b47b2-67f8-4021-be77-cca164656bd2", "comment": "Malware payload (AgentTesla)", "value": "819e75b59444cc1bfce2c3dddc6cfce2b2e9b496530ec70dbaa327acfd6fa924c3cbb7d0d3587d692f11fde93ac23f87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917448, "uuid": "ce598afd-ac41-45de-be71-ce6483625d5a", "value": "T165D4124073FC9B26E2B7D7F226A190400BBE396BA562F31C5DC521CE5871F405BA2B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917448, "uuid": "f34d7f40-8cf2-40c4-ac8e-80d30d85cf69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917448, "uuid": "04a57960-fe09-4828-8837-81796d38e324", "value": "12288:/Voo+dfTzSFr+Rge+CC752Tkz3C/DbEpSmTLPx36Hs5q9+TfP0l7h:GurQG0Tm3UIpSmTB68Q+T30lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917448, "uuid": "27d0801c-86d6-41fa-9671-41aa3458d517", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917448, "uuid": "848f5fb0-a8b3-4553-ab0c-badf1761b5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917448, "uuid": "2552cdb0-9653-4cfb-8332-51bcf1ea16ff", "value": "FedEx Receipt_AWB#883053232014374654-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c362f93-b8ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705904975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904975, "uuid": "d49bbdfa-5c26-4ad3-837f-91661618bc1d", "comment": "Malware payload", "value": "34fcd26267eaa85dee6091e0236a39d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904975, "uuid": "bafed730-f520-4bf5-99bf-916a6c1f32aa", "comment": "Malware payload", "value": "eb20b41b9c969ca7e5c4723b19af1224ee0eefaf4d9c0abd91dc939213d262ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904975, "uuid": "631fce09-1dc8-4fa6-bbf3-3d1da16b4d68", "comment": "Malware payload", "value": "a8cb849fc8d3c48081c70106ecc12c98b9750053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705904975, "uuid": "52f48ac5-a9bf-4433-acc7-c80dad42e195", "comment": "Malware payload", "value": "b6c165b51c67200ab838b2783716d0e74864a3c2e1a231f77e0ec5725f6806fd33dea0c37d5fe1bf8bf1ba89d481a313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904975, "uuid": "806f0dbe-4fb8-4426-b2a1-698163516416", "value": "T1ED048E56B7A411FDE1778278C8511A02FBB2B82607609BDF07A44776AF332D09D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904975, "uuid": "b42c05e3-397a-4326-a0e1-398004bcec10", "value": "c19edf289857a8531923f1ad3ead6da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904975, "uuid": "74060f7e-4295-4406-ace9-df4e6bf28a3f", "value": "3072:DGI6AR215+WOgnzxnsAc2PxonN6KTH0ZnYYAY2JuKqIB0rw/:DGI6qo5+WOgnzxsAc2P+N6DlYYLCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705904975, "uuid": "ca7c5365-4013-469f-9086-621ea9e0267e", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705904975, "uuid": "752eea4c-37a1-4ffc-886f-7af8681bd294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705904975, "uuid": "9fb2a3bd-a920-4b70-8d79-548978b88181", "value": "SecuriteInfo.com.Win64.AdwareX-gen.13340.22395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edd951c-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705917247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917247, "uuid": "b9ce682e-3b62-474e-a4b0-5d56e3cede56", "comment": "Malware payload (Socks5Systemz)", "value": "2a0bbde123a10506498a83d206f01b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917247, "uuid": "e96e8bb7-de7a-4304-a713-53eb4e9a16f4", "comment": "Malware payload (Socks5Systemz)", "value": "ec3149e98f7f1a5134d8e1350abdafbc50716dbeabb02f37c931f7420f73d891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917247, "uuid": "6f99ee47-e31e-418f-a9d1-12c479084f13", "comment": "Malware payload (Socks5Systemz)", "value": "ecefba88307ba4b8dfe8922a8da10539ef4a64e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917247, "uuid": "6bd78cc7-ccd3-47dc-b8ca-a5c47092b60a", "comment": "Malware payload (Socks5Systemz)", "value": "f98bf8023c8cb589c8d09f9686cd352fbaf516eb68e99282f74f98102416d56d31fd7e2fa64503caf6b5f09db7af6443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917247, "uuid": "4854c41a-7274-4bbf-9dca-6149090dc009", "value": "T1691633117F442A36D2415770BCE2B710EE36FD4D2A626607384BE8CE2E267E45CFA395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917247, "uuid": "fa3af1a4-66ec-4ce2-b5e9-7a41be01179b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917247, "uuid": "8816254d-f147-49cb-8492-711279b59ab7", "value": "98304:6NOOfwGHkCwLKUHq2Wah2ed4/Lk3QJfjbU+jqnZKG7HW3d358:AoUkzzKzfed4i8fjbU2nGK3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917247, "uuid": "0b20aadc-b515-421e-a479-78d31c6b5ba9", "value": 4205706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917247, "uuid": "22814b0e-6dc5-46ce-9679-aa19c8c94b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917247, "uuid": "ca1c5f9a-ddc0-4db1-8c02-8c17e3c3a413", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbe143a-b8e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705898667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898667, "uuid": "7d9ddf5e-8551-44b3-8de2-b4716c6c25b4", "comment": "Malware payload (RiseProStealer)", "value": "b830d13559d936cbf5880b82bd540c98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898667, "uuid": "9b452835-73ab-4bf4-8fd8-9e98b2657ad7", "comment": "Malware payload (RiseProStealer)", "value": "ed9b4ee4cd298fd6de4e1fc6fe179bf946e628eb0e692ab7ef5e98d93ecf36f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898667, "uuid": "54f58eb1-ce5a-4471-b4e9-6128eeb71cd2", "comment": "Malware payload (RiseProStealer)", "value": "1e0d8d488347b23e57a71c1de06832ed47fd7c67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705898667, "uuid": "cf2e1403-983e-4887-9e3f-f0f11b09a29e", "comment": "Malware payload (RiseProStealer)", "value": "5b4c2fd55fce17ab73bb74e50c559284f762a8b2a508b1b778693bf595f31d2272137fdb5cbbf469e2e36f014783c76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898667, "uuid": "4a9ca10f-a301-4edc-a5f5-e3890c217db6", "value": "T15E4523E067376B82E12B57B45003219D1967BEFF9226A41A2EAFFA510F3C4BF1311E45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898667, "uuid": "c66849db-5b74-4043-9d35-2dc43929614a", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898667, "uuid": "45e52d46-95d2-444c-997a-3710c3de17f1", "value": "24576:FAMiaF2d0Ib5Cy3PAYqRwQriyIakELgsUxaym1+jImTM0:FA7aFOpb57PzUluL8gsUFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705898667, "uuid": "7b198f28-efc9-4128-a05f-6cb40b9ccac0", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705898667, "uuid": "db4e6ff1-82d7-4305-8332-0f77338ef79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705898667, "uuid": "40e3fcf8-1aa5-485d-b1bc-c6a0a2eb194b", "value": "rp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47109a4-b933-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705934221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934221, "uuid": "ca18b71e-3265-439c-a0da-3fa9006925e7", "comment": "Malware payload (njrat)", "value": "87a2490405f556305ebee2e3c82ec242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934221, "uuid": "eef1797d-447a-4f98-a1c4-0b53dc941647", "comment": "Malware payload (njrat)", "value": "f10476aa35038f54d0827f13ff719ad4c04d4b534332fbd455c27baf4af97b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934221, "uuid": "5dee7f00-151c-4a4b-ae8c-b0c730b8815f", "comment": "Malware payload (njrat)", "value": "292b814d255ff30a1fc4e3cbdc2ca67a4e214509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705934221, "uuid": "41dd3b3a-36d4-4f0b-892b-8afbc7058b58", "comment": "Malware payload (njrat)", "value": "736f7653469198381ccd32d6afdc8470310196b3a64061c49ae9558ee0695da9afd086cd3035f72e0c83660fce0b8ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934221, "uuid": "2866b5d7-5bd8-457c-8847-8850ed9f260d", "value": "T1F6F21A5D3FA18162C5EF2B744AA2D72102B2D1079A23EB5F8CC844FA6B777C14E819F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934221, "uuid": "d6b10056-c3b5-46aa-9feb-c2ee52028c4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934221, "uuid": "cfc5abfe-20b7-4935-9967-c9f91893d710", "value": "384:dLd2LzreBCAuKiEZePC45SY2OzRLTm3yilqr6LbbtyvGj:NizrecPEZeK45SssAvGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705934221, "uuid": "6a2b8ece-5f99-4fba-9b4a-fdf9ab6a8409", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705934221, "uuid": "bbb57e4a-eb03-4859-803c-1c65d2d87da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705934221, "uuid": "b6cc7c5f-fc25-4c6c-83b6-efa6466f230b", "value": "bTaE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee13de3-b958-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705950130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950130, "uuid": "e80bdca1-79cf-4341-84a9-15ee0e10b472", "comment": "Malware payload (Socks5Systemz)", "value": "296d6be541d741199d0dc1c943f47aa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950130, "uuid": "56ce2384-4436-41e3-a802-ea69f978bd15", "comment": "Malware payload (Socks5Systemz)", "value": "f1c7dbdc96ea0e85f6d2c5dc64ed2ff8b9f745fc8c1fc9302e1f9c84225e773e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950130, "uuid": "acf5c219-f2fa-479e-a5b7-f91f4a0fb3be", "comment": "Malware payload (Socks5Systemz)", "value": "58f78ae50519d8043bb8cfe839295cf083f33dfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950130, "uuid": "d963ea91-9e4d-4280-a8d4-bb71e2ba73e3", "comment": "Malware payload (Socks5Systemz)", "value": "20edf41b8c3442696479ff3867027d41ede797b8b1c975eae69e158f9e2725f6416665c3735823b3296b0fde41f58c40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950130, "uuid": "5162c602-73d2-4f1d-9149-f53728839c84", "value": "T14816020B3B2062AED15D53F4AC8BB0F2BF08FF0ED32155666259A36469E1781DF13E64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950130, "uuid": "e7237a37-13b2-4cc3-a5f3-bd11c2299f21", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950130, "uuid": "da2e506d-102e-4aa6-b321-042d38ab4304", "value": "98304:ustINOMZQTyqYe7Jm+RsjswAeIm6jWRKkWY8Sd358:hFYJ87JmYtjpjWRXkSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950130, "uuid": "7a470636-f715-4d9f-8d91-fe89572d4e94", "value": 4080053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950130, "uuid": "e168ec35-8a2c-43c0-9c17-e2851824d254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950130, "uuid": "a4a6fc1f-58ff-480e-9d2c-ae935e89f893", "value": "296d6be541d741199d0dc1c943f47aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624f4992-b92c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705931077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931077, "uuid": "23933c3e-999d-4643-a29b-3e9f9c82eb5a", "comment": "Malware payload (RedLineStealer)", "value": "8308d7088929d0a76c70576b714a7f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931077, "uuid": "ccc017bd-c93d-4e58-914c-8dc93636f89f", "comment": "Malware payload (RedLineStealer)", "value": "f2a16698dbde6f7e4c8be69906eddc1b53f4d6243f6253520d2bdbfe7bff10d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931077, "uuid": "f1b7bd08-ab35-4ce6-87d7-baea3abd8267", "comment": "Malware payload (RedLineStealer)", "value": "eb0effe0f0252f31bc500fec5885ea5dc948d07d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931077, "uuid": "c4ae606a-bbbc-4f6d-b567-b446f9bd3132", "comment": "Malware payload (RedLineStealer)", "value": "d0c112c93ab3cb623e684a1916f68a3ef23ce274b97605960523c8405dbd640d7b8e32c2f0d22438823316f5d0a3b295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931077, "uuid": "71c52ca1-e432-4c89-8e2e-8f8ca2f4f5dd", "value": "T184E5330502D7271DD195127AE10B7026A5F0A3D3D76F0A6FA4ED232DF3392E4DA0E86E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931077, "uuid": "cf5e5449-0703-46a2-8cdb-8ceee0adcadd", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931077, "uuid": "bb962d62-335a-45b9-9598-0a512f6d5ae2", "value": "49152:iSgHWLXt/+BudcsLP9dL+bGzQ8rnSCrCot9h+axRqZyajba8h2ctB4MWM5fNCRk1:XgHwt/+g7hNzrr1nHKha8h2c1WCARk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705931077, "uuid": "f3b7dc26-2046-4080-abdf-12b59470ec99", "value": 3244544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705931077, "uuid": "6658e001-5e33-47f5-8dfc-13f703242a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931077, "uuid": "a371c81e-471f-44f8-9272-443aa02a5625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0830f313-b938-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705936080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936080, "uuid": "c94bbb98-ad87-4804-a0e1-6665119176fc", "comment": "Malware payload", "value": "98259127433d3e18bf5f45305b18ca2c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936080, "uuid": "9b6b6fd6-3faf-4bce-bd51-2f208ab42bc2", "comment": "Malware payload", "value": "f35ba911aa3d61378d86fb232f5da5020c8118575d765b8bba3d188f738b3bad", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936080, "uuid": "e4e66763-3d50-480a-b16d-c64a4cf18cb3", "comment": "Malware payload", "value": "5a6faad7c2a9b0488fa19c976b801db178e53eb1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705936080, "uuid": "fc3b4620-2133-4fa8-8432-f3c6ff5c545d", "comment": "Malware payload", "value": "118b15a0ad1edcc2eba22232163a6a437148a0939c4d9de7c7dad3bfcbad7309eaf429282e28f057cca9676d9ea7213b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "PrivateloaderAPK", "colour": "#08E7D1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936080, "uuid": "384a5767-91e4-41fc-b829-ecd1d45dac46", "value": "T10C1812D2E759EC55E1F3A335D63551666A168C748B23E3B31E05B23C2EF39C0AA09EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936080, "uuid": "8d19c7d6-a310-4395-b058-73dcdf6caf01", "value": "1572864:/tPAW21c4s90MmDBPwpJ3HB3GicFE/1Mc0rHgTCgkzAdeWOLkBxhlB:1Poc0rD5KcFy1crHgegkue6ZlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705936080, "uuid": "ad1a5c46-3a67-42a7-adc4-715f998798d7", "value": 86567049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705936080, "uuid": "06efbd10-5855-441c-88ea-e72beab6b675", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705936080, "uuid": "84901150-800d-4afd-b3b7-e1e8240ac986", "value": "Important_update_7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e462d237-b8fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705910679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910679, "uuid": "439c3fa5-9fd4-4727-bc2f-24adddce0799", "comment": "Malware payload (Formbook)", "value": "94c54d660bda6416d96963b282e9f955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910679, "uuid": "5023bef3-7079-4382-a169-0ba1df912927", "comment": "Malware payload (Formbook)", "value": "f3a5efea9e3ad7f472315254cc658c776287ef2944bf08fe07a3c29ffc596598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910679, "uuid": "23e3082d-d506-4020-a3bd-b4f8e72beffd", "comment": "Malware payload (Formbook)", "value": "cf7bf223de8c2c3b8318e74789c3ff5450f1f874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705910679, "uuid": "4d4c9d6d-86f7-4a82-83ce-d89b77e78cb5", "comment": "Malware payload (Formbook)", "value": "f0f607a0d27677e88d77b6491c12e070e6e2cb95c1fe05e7cfdf40ff45ddc78550f53a8afb27517c79337b355757aedf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910679, "uuid": "5d924cd3-7151-4c3e-8ab9-3971144b0a91", "value": "T1B3A4231576D048FBC50B0AB0155B757AA73ADF918B1BE90BD77C3EBB4132383461BAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910679, "uuid": "09fc86c7-9849-4fb0-b652-c121624c8ff8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910679, "uuid": "dcc8e1b0-060a-4057-875d-7b439abf5a4b", "value": "6144:P8LxBfDAk8I6+ikxGvFGcbJntRSH6vCLliJdnzrA6UvPCQEwbfLbCaCQiYKt6eAg:MDAk8iKFbxPAAChiJlzYvREMCal8Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705910679, "uuid": "965b0056-6d71-461c-b1e0-dd569c62062f", "value": 452270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705910679, "uuid": "122c3d76-f74a-4117-9782-3df0b0ebcb7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705910679, "uuid": "30da69c3-2f18-40c3-a6d8-ddd277ce66d3", "value": "FGR-BD-PR-01-DSH-1022-B00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d87e310-b972-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1705961241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705961241, "uuid": "dabe5165-eb1a-46e5-9a41-c47f18a73744", "comment": "Malware payload (njrat)", "value": "8ff11b8b8e1c6e4dfb94aa8ec0ccd8f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705961241, "uuid": "9cd8559c-0613-4196-bd6d-9971d9689ac0", "comment": "Malware payload (njrat)", "value": "f4555621768e0c3d0fe825b7f237813a79f2da7b25e9b9025614b62453927da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705961241, "uuid": "8622e61d-306b-47e2-b2f0-977beac6b2ce", "comment": "Malware payload (njrat)", "value": "68feb6136b4e97df0fb7ff421f32d1d6080432fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705961241, "uuid": "f1d03e16-eb0b-47cc-bb95-838e3ce61a0a", "comment": "Malware payload (njrat)", "value": "2ca73427192d0861518d737dc1e1a5848f174ad2ada814819ee89ba1bd5c398c884cd4f979c4c8cdd38cfca19fd6e1ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705961241, "uuid": "07ec92a9-aec3-4614-805c-b07fc5b009d8", "value": "T150E208067BE94215C6BC5AF88CB313214772E3838532EB6F5CDC88CA4BA76D04655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705961241, "uuid": "a92ab76d-9ad2-4f58-bc33-0dc5d44627a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705961241, "uuid": "7fd92f3a-7667-4bbb-8df5-a356d05507ca", "value": "384:c0bUe5XB4e0XJgONvw0Q0mS03AWTxtTUFQqzF4ObbJ:JT9Bu9C55dKbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705961241, "uuid": "41ac5a6d-aa18-4c26-a6c7-27abcff6d961", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705961241, "uuid": "6c06ce2b-b6a1-49f1-9547-eb74edf66366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705961241, "uuid": "598096f3-fe30-4d56-87c8-77c679cf3d60", "value": "bTfn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8315754c-b90c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1705917388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917388, "uuid": "9da9976e-8a92-4bfc-bfb3-cc6e6575be6c", "comment": "Malware payload (Adware.Neoreklami)", "value": "95725039a7528ede31fea3d5c3f88f84", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917388, "uuid": "45f70b76-1d1b-4092-bfc2-70346c011f08", "comment": "Malware payload (Adware.Neoreklami)", "value": "f5de17d28b6ff6f1980517f1cb8f7dac2aea813029f7fa7e0b2049aeb8d934bb", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917388, "uuid": "3712cf06-eb9c-462d-878b-b75ff446abbf", "comment": "Malware payload (Adware.Neoreklami)", "value": "fe5913cf153851b5edc49c48a5c092bd13c8be3e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705917388, "uuid": "f540b1de-67cd-4791-bb4b-a0adb72bc869", "comment": "Malware payload (Adware.Neoreklami)", "value": "8050ed7e07faf8a3ad82064fc51d006737e5a697e9829e24e311690c677e7324903c19cd12f31b0e4ecce6f4bb8fcb43", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917388, "uuid": "7dce318e-07f3-4642-a0c5-16f26352ae5a", "value": "T11E7633063DD942B8E74C8930CDEC26D7D351A6840F314AD36BB9A66FDE7CA84C446397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917388, "uuid": "fbe5fd97-43d9-4c48-a576-fba12117185f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917388, "uuid": "83aa7ac1-b664-4ec9-8811-2961e94854a1", "value": "196608:91OaKhn87UcVVmgDiLoTiLdvTaTYCbF16qyp0MmQxx:3OBNkA+N6aTtB16qFpQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705917388, "uuid": "ffc59e45-7d08-4943-88bc-86f4e1256d1a", "value": 7604346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705917388, "uuid": "ee0a44cb-f5da-4268-b438-7af84204ce3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705917388, "uuid": "d14c1438-dba0-4f19-af1e-39454e753d6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec56387-b953-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705948090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948090, "uuid": "ddfdcee6-3df8-4891-ba27-ed704ef95d93", "comment": "Malware payload", "value": "c3119b0aa6ce06ba28fb7b40d51522fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948090, "uuid": "34595e6f-ab30-4817-8452-dff137f7f6f1", "comment": "Malware payload", "value": "f66549f35c3513fa1c83ca89b2e94b998e391dafec5d8a4ffadd90d2bbb56837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948090, "uuid": "d3fc018b-8f1a-47a3-bbab-cbbbb32c1980", "comment": "Malware payload", "value": "f5ec9044f6057b07a1249ccb3659cd41be1d1190", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705948090, "uuid": "e907be78-16aa-46fd-9f7a-88965b017baf", "comment": "Malware payload", "value": "063d12e43c43e198d38b93e4ebe619f9a868ced02279b8bc7813003dd34e46a481422e7ac306d0dea3f637a761fa7243", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948090, "uuid": "565d55b6-db90-4d11-a718-2dbde00d0143", "value": "T137053975EAC09D45C8C12873F42FB1C437C3D26ED2D936296D618730BE9F5991E2AE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948090, "uuid": "d83618f1-7b52-47b4-9402-0fbda64060a0", "value": "12288:+7K+82L+lP8OFqhcad/L9T0GEY7tBKZGY8G6aRONn64N12y7iFxjWJZvE+A6swVP:72i8fT0GEY7tBg6aROfd7i/2Bh/h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705948090, "uuid": "5115820e-5017-423c-938a-c674799ab415", "value": 854984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705948090, "uuid": "5d61f0f8-5bc1-4cfb-b3eb-28978069c96a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705948090, "uuid": "92f047b8-efbc-4557-991e-4e938d241ee8", "value": "SecuriteInfo.com.AndroidOS.Triada.9782.18197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50852640-b92e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705931906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931906, "uuid": "4268503b-10f0-447c-83ac-0ec70ff3677b", "comment": "Malware payload (RiseProStealer)", "value": "4c067d09553a34cc4adf01673e374078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931906, "uuid": "2994d516-aef2-4568-9740-81b87cb26bb2", "comment": "Malware payload (RiseProStealer)", "value": "f68914f92c25096d6f5339d6703bbb76da23579f83d11795fad499fccf0862cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931906, "uuid": "2265ec3f-30a2-4d72-a78b-d4543aa951f5", "comment": "Malware payload (RiseProStealer)", "value": "004c381db18868cd9594cd1efb13c374c4c98d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705931906, "uuid": "d88e02eb-844c-4624-893b-cd2adfe5435a", "comment": "Malware payload (RiseProStealer)", "value": "872ecb0dd2095b3a1750e6285f822ee260d9df50549130e1de5d71b466b377e7c71bcdbacc4a5ae4e75cb9a547a24f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931906, "uuid": "a23f661b-edf5-4a33-b101-8b19aa40b8b3", "value": "T1CC4533EA5B362980DA23F3FA111395144FA37E138055451F269FF7E84B7E1BCA31AE84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931906, "uuid": "54219c81-e6a5-46db-8d06-47f1fd15c545", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931906, "uuid": "8cb792d9-8cf2-4b04-853c-84e7f70e79fd", "value": "24576:F7r+6fWeC44XOwiO0/1d+3pPY6Je1wQRsiK3NeiQkSUDWeyf:F7v4Xj0/1d+3ORl+3Nevje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705931906, "uuid": "a3ee342b-ff20-4ae2-8c14-2efaa49483bd", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705931906, "uuid": "a0a9722a-5f44-48bb-b80f-286ce6ae8207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705931906, "uuid": "14322ee6-ba15-4f36-86b7-ce9c1dd8a195", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8539ef6b-b91a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705923405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923405, "uuid": "661b9646-bebc-42e3-abf4-20e9f801b1fc", "comment": "Malware payload (AgentTesla)", "value": "173b31dcb63678a0f298aef2b3526603", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923405, "uuid": "727a5b8c-7e92-4da9-960c-46a652d8ad22", "comment": "Malware payload (AgentTesla)", "value": "f73d8e041682d3644b6a271306ed612dace18d3e087934ed0fc65e9166af0b90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923405, "uuid": "829cd8b5-43f6-45e0-aa69-812d97c92a19", "comment": "Malware payload (AgentTesla)", "value": "7337513f7e47909be291431461396cf733d9df67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705923405, "uuid": "d48fa2f2-1abf-47b7-927b-05a2a404ee1a", "comment": "Malware payload (AgentTesla)", "value": "b57e5a9317cf601f97e94b4966179f85e57d5e2509d7cd125c6c32aa15ceefb5b1000dc85f0cbd4248e03332f6d7a8c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923405, "uuid": "c98880eb-7200-48a8-8210-d2576b5b65c9", "value": "T13945AE0273858062FF9B91734B5AF63146BC69260163A6DF13982BB9FD701F1163F7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923405, "uuid": "d36dede3-5939-48a3-807e-2fdec0143791", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923405, "uuid": "39d7d1e3-82b9-40f3-8723-48967594540e", "value": "24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aeGb8Ri3IW:5TvC/MTQYxsWR7aeGb8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705923405, "uuid": "678f8e5f-fd2c-48c4-b819-1ca60b306ffb", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705923405, "uuid": "0d2b357c-a600-43a2-975b-e6bedca955a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705923405, "uuid": "d79961a2-93b3-4807-8ea8-d261431d5cd2", "value": "z1ST05349032738-7838299227238_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b43c3c7-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705950715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950715, "uuid": "259f3642-4e7b-4670-9434-8ef05ee72a42", "comment": "Malware payload", "value": "fae4e4923fdb5a9079e873477bf92911", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950715, "uuid": "5fb15a1b-2764-466b-9296-cf72603b5d25", "comment": "Malware payload", "value": "fa248ec2c76556f7e9c71cc5979bea9f3cce8f565a44398b0e7fae3005f0b13a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950715, "uuid": "22bad3bc-45e0-4595-b6e6-e9f630836a21", "comment": "Malware payload", "value": "99dea9162447750cdd502fc0eb16f2ca7c54ea33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950715, "uuid": "36b4a2f2-4281-46e0-add8-d87cc6e4f6a5", "comment": "Malware payload", "value": "8878ad7203321acdafdc553a4d4193b782cf7c4a5c732b3f6f872db59d0e8f8f46fa6521ac445108a74ca50279503d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950715, "uuid": "8f123ce5-7289-472b-8601-bb5dad26417d", "value": "T1B975122463E94B06D5BB5BF42824505447B57A49EC26D74CBEC130CE9AB3F0AEB31E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950715, "uuid": "502f9c03-73c2-4ede-af12-1b5d54cc69fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950715, "uuid": "a19fc920-40a2-4d55-8b01-f009df227088", "value": "24576:iWaS+JEfphxW553sSntC6s+6qbU0saooQaPSMdLAWqY8fWFEIJ3VUPvymws5IgZs:eS+axysYC6syUkoPaPS2AJNyxUP+Mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950715, "uuid": "acc07804-8d61-4f7d-8259-f67d787f03fa", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950715, "uuid": "266adc4b-6260-479b-9b01-555823ee0057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950715, "uuid": "e50ab5d8-7494-4c09-93f1-87398e9e0263", "value": "PO3452302659 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3607c9c3-b913-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705920265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920265, "uuid": "f56a3518-e787-4b84-be5a-ddf361e1e9d7", "comment": "Malware payload (GuLoader)", "value": "df0c6018e50894692e02b8858386ac25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920265, "uuid": "d99b9b49-7170-4f06-b9a5-4b774b61da0e", "comment": "Malware payload (GuLoader)", "value": "fae283e4b242564d01fa9dd0f3014c9742c2529730c988c3774a136e6941f6da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920265, "uuid": "d4cbc050-262f-4559-80fd-80453b7659ff", "comment": "Malware payload (GuLoader)", "value": "d843d1c5eb74ae26978aaf9ad0cc99ec2cfbcca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705920265, "uuid": "1cc020f2-c800-45f2-8015-744b1df258f5", "comment": "Malware payload (GuLoader)", "value": "3cd561a9ff64ea7c35dd959330dd1acf4f9ca9b78185842342276854f6c3d88ff8ffe6504c739afa210793a231918bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920265, "uuid": "e83567f0-719a-4af9-8604-ff7310db6e97", "value": "T11E94E0147750E54AC1DD5B7099BFD6FE5EA4AE132E20420BE390FF0F3832AC1B959299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920265, "uuid": "f83ab90b-6687-435d-a6ba-0d95769ccd01", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920265, "uuid": "efd8cbfb-f951-4438-9699-60a34b04487c", "value": "6144:54t6Lsvq5WSBHdzKYFZHibnx2tTt6VNETAhuog6cjmSlJe:5kvqcSBHZKYXCbn8eXh3pcCoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705920265, "uuid": "c08d6de6-911e-4da8-b754-168929271ac8", "value": 417096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705920265, "uuid": "bc3d3840-4e0e-4fbf-8fc7-6808e4d808cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705920265, "uuid": "8aa54c98-f971-4414-a9fb-122a9f6d1b81", "value": "Densus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003a01dc-b95f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705952817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952817, "uuid": "1a1c655b-3492-41ca-87e5-21c3890032f8", "comment": "Malware payload (RiseProStealer)", "value": "33e56c1ec2795fd845e8a01b90533156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952817, "uuid": "e7e84b1c-4b44-4de5-b05e-48a5a68812a0", "comment": "Malware payload (RiseProStealer)", "value": "fcedfc42e2a17d6d74c16cd7432f890cc5145a01f2018533cd519b1e215ea1b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952817, "uuid": "38a41a73-1f9f-4df6-aaa6-93a1f345f54e", "comment": "Malware payload (RiseProStealer)", "value": "9867e4061d691fd665db9ec7c25706045991569d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705952817, "uuid": "b2d313df-c948-4796-9d20-03b6d76435ec", "comment": "Malware payload (RiseProStealer)", "value": "f75e41ef4f139448d639fc6d867701a8a7249937614a8cac8dbb9c8f2c3a7e5045d3cb44f6e3263ba89560eae4b0cebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952817, "uuid": "559cfd83-d97b-46c8-b080-d141296403e9", "value": "T1754523F51632A264D64733FC5A8A46D0699B3D2F7880404A25CBFB914FBCA7D536ACC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952817, "uuid": "66b7f332-ec70-45e6-a6a7-60ba711744f5", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952817, "uuid": "c45fad7e-74ca-4ff2-a7b3-1e59872f0c2b", "value": "24576:gTGpDMaiApcl1a3OUHNDEMqUmMYwQpRHW/nSZaV4IcAZoI:gCSaiJl1UOeNDEomPlpR2/SZm4IcLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705952817, "uuid": "f9fba302-d2b4-47fd-aeb2-053d865742cd", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705952817, "uuid": "c59e28cb-8dec-4bf6-ba7b-ca165556f5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705952817, "uuid": "0af45a97-b441-448c-807a-066f1230a5e7", "value": "xtra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10f409c-b8ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705911962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911962, "uuid": "a6887994-b29b-41df-9ba4-b02165925895", "comment": "Malware payload", "value": "009add3f2dde936a7e7ae04f5bff241a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911962, "uuid": "5ec022fa-1127-4076-981f-fcb430c7260d", "comment": "Malware payload", "value": "fcfc2a0fae14ff5c0ae6bff70afa77ca1eb4cd0356952eb8b9e86b1350171419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911962, "uuid": "d89b52d9-55e6-4d92-a99e-9cd32baa18f2", "comment": "Malware payload", "value": "84967b00ba79793f5d7d4391797ab6befab922e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705911962, "uuid": "63d7f104-e5dd-4d0d-8f98-d91508d18613", "comment": "Malware payload", "value": "2ee929662d658ce64eeceaeca5495fa1f456235f37b00df760ba560a9ad73f4466cd6ce966630400fef65401acb173a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911962, "uuid": "a2aff4c5-c11b-49cd-b781-d52fd2c16b16", "value": "T1CAF533FE9F00EC3EEFDE553626949ED923E0CA3E8252C5C421598D5D9AB75BAC104BC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911962, "uuid": "e31cc659-9c3d-464a-9649-ce42486c5b4a", "value": "4cbfb7106b2753a974880940b3163800", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911962, "uuid": "74e9a9df-3d60-4b4d-8235-07aea3bbb756", "value": "98304:PVUmCQfnDBuMeOTCaXFbp9Hzv8tMJWgoTBG4DWm:PVUKn1MOTbbbTvIg1oQ4DWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705911962, "uuid": "7a7a301d-3cd9-43e4-8af6-121aa2375b7d", "value": 3557904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705911962, "uuid": "175fb3d4-76a7-4264-ab59-5e265028cdf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705911962, "uuid": "7e06c497-39c1-49cb-9ec1-6f4cd3ed124a", "value": "SecuriteInfo.com.W64.Trojan.GKA.gen.Eldorado.9795.9321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daafe167-b8f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1705907227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907227, "uuid": "1e4e1d16-71f1-49b0-944d-130f9c910c37", "comment": "Malware payload (DarkTortilla)", "value": "af4c57d9414400d9efebffe5a3ccbce3", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907227, "uuid": "4b403433-8f0e-46dd-abf1-dbc9a2718676", "comment": "Malware payload (DarkTortilla)", "value": "fe3182376591ab48521aa3c795de3f9bbfdc05559c525ea75f4125e011c9e656", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907227, "uuid": "3fd5ce90-ccf2-4b82-8a5c-5538773c9b15", "comment": "Malware payload (DarkTortilla)", "value": "4a16e94a09946968b59cfc4fdb97601205f89ca1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705907227, "uuid": "e8102e0f-faff-4b67-90e9-d8029d37fe24", "comment": "Malware payload (DarkTortilla)", "value": "eb4a801b6c4c29565a817c483f046e6bbedbce543fe2361fc99caf10b91eaec1a8f10b2cf2412b022a6d18199101bdfa", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907227, "uuid": "5c62153c-3b08-4099-97a2-d9388646da26", "value": "T12E15F17EB7C4BEEAE6392D76C453190583F0C4E35B37F60B6CE819E2A9257059A0F016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907227, "uuid": "5552549a-9248-4b7f-b730-4268c4e21d25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907227, "uuid": "20bae5d0-6d73-4308-95c5-df53f040b899", "value": "24576:41s5KNvUy2MKnolTrpzFPWZK54gvF4zFor:4PNvUZMKnolTrpz54gvF4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705907227, "uuid": "a663f8d8-8435-4392-9cd0-6a6109b3dfdb", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705907227, "uuid": "327b3c61-d35d-4de7-9e95-7e9a80c11d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705907227, "uuid": "e5a342f5-41df-4528-a18a-9e7396fcf4e3", "value": "INSD0004.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5ff01a-b945-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705941836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941836, "uuid": "d6fbd282-af33-4876-9f51-d7e984af7404", "comment": "Malware payload", "value": "5e79d7640c021dc7c8e18d25c4985f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941836, "uuid": "01a8ed83-830f-4a48-9eee-5876c4a5f972", "comment": "Malware payload", "value": "fe658bfa35746debb348dbcea5f6d93d22df9211ca340ac21f756a955a9be481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941836, "uuid": "d86aa5ff-e270-4bcc-bd6b-8442709405ec", "comment": "Malware payload", "value": "0d6e64814944ca0f29937edb2ff2f7cd4a506794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705941836, "uuid": "e2807703-8524-40e7-8f86-27b5e96bfc9f", "comment": "Malware payload", "value": "492dc78ef86ecbbb96611cf8bb05efe83435c6ba5fa95313447d95a0559d26a3a4961b065e1c72e4abbb2f75298c2a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941836, "uuid": "b9f7548d-c0fe-4d7f-98fc-33ea658e5107", "value": "T1DEC4171366ECBCB5E1B216706B7797E1DB7EFC201D30C91E22D0051D997C982BA21BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941836, "uuid": "7a1c8218-f23d-44a0-84b2-5f9594481dc4", "value": "4bbd4adfc99174f1d7d82430fab6116e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941836, "uuid": "59d635e2-39ea-4e4d-8114-e82beb79621c", "value": "12288:yubj5je69oqAmj5oMqKyKAuqOAP0wuTeMb01JQntLOCIXo0H:yqhe29AmjkKuuTemIXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705941836, "uuid": "a1f2fe8f-01ad-4559-b527-2f7f3c1a6842", "value": 559240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705941836, "uuid": "49130c8a-b157-4208-8495-28dd4b464841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705941836, "uuid": "304ebbfd-2957-4fd6-a91a-e1a08d662764", "value": "SecuriteInfo.com.FileRepMalware.17500.31509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23984722-b95a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705950729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950729, "uuid": "0a9ed335-b9e5-4591-b779-6cf82604d7c2", "comment": "Malware payload (Formbook)", "value": "ccd2f694d9142139aa8a0a268682800b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950729, "uuid": "a8ec8bf1-8eb6-48df-8266-49bb2344a324", "comment": "Malware payload (Formbook)", "value": "ff8a33f612d8a5b395c770106457287d423b9b637e1e900e21da789bcfffd761", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950729, "uuid": "633e4fe1-00fd-43c6-9424-3aa314f5c208", "comment": "Malware payload (Formbook)", "value": "99adb887080336164ea80d1a57418f535b08ffba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705950729, "uuid": "d646794b-52e4-495e-a7f6-dbb485d4e9a1", "comment": "Malware payload (Formbook)", "value": "cfe9f7c710728d97d0e9bca3f9c710323c4e28ffc366f6281c8218b32d0639996509f9955f9c43f2f13ec517b52d646a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950729, "uuid": "a7f87a28-d440-4dcb-92aa-2a576fbe611a", "value": "T185E42319316C137BC67963FD68605A781BBEE9934A64D23CECC9A8CEC1627038F05767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950729, "uuid": "30ebd817-b2f9-47ab-a0b8-00e547be865d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950729, "uuid": "3877b8f5-1b1d-40d7-8a3d-bdeeaa42452b", "value": "12288:6agX6X60ABJKVgDRUCVmjWkfWvvgEkGVrGxIL5qYMc:6ag/BJtD/glf6gNGBGx4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705950729, "uuid": "ab905a11-9da3-44b0-9afd-5960c2c28974", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705950729, "uuid": "7641a7f7-8469-40c1-bc2e-dff79c8e23ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705950729, "uuid": "3fe27e6e-d40e-4997-9678-dbf6d5bc2d8d", "value": "20220829_PEDIDO_22073M_PROTECO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }