{ "Event": { "published": true, "date": "2024-04-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-09", "timestamp": 1712707381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7167bfcd-d665-4edc-9ac7-5e071ca3ab52", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c13e40-f661-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660697, "uuid": "56a6ba42-cdf2-45c8-928c-4b7c7c4d093c", "comment": "Malware payload (Mirai)", "value": "f78f0aa68fcbccd4f08a1bb7a5ba3923", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660697, "uuid": "af215ffb-ae8e-4067-a496-de1d1b69932b", "comment": "Malware payload (Mirai)", "value": "0006869fa82c97fe7c8d5d109f8bfecad89efba59b633e5ab1bf4f5378903837", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660697, "uuid": "dded05ed-4a37-44fd-82a9-f1738ab1d0ff", "comment": "Malware payload (Mirai)", "value": "d2e7d2958515ccc7534729306bdc07d3ea41acd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660697, "uuid": "db595df6-9e89-4cb5-a382-49417f74268f", "comment": "Malware payload (Mirai)", "value": "9ead35f6796cfefaa73057caa8b63f54d15c476c2ec4df93a89411cbf6d7dde25d4a9b7b440e5a7ca2851ca6ba2f493c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660697, "uuid": "bbc85b27-0475-4db6-be90-b2e4aeeb4e8b", "value": "T172E2F172DD2E1C00FF26CF798DF09AF1A7D16F8FA2D688C4514ADE8016342262547ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660697, "uuid": "ca7a6891-8e23-42f5-8908-894e70f1d377", "value": "768:9w7XVaXOVaZiND5Z/toyqETLs+yZdkS7qhpjRmAft12n4/im4uVcqgw09W:9w7XEXZZuD5XbJsebIAl1gEN4u+qgw0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660697, "uuid": "5a31d50b-2dc0-4efd-b9cd-ec141e572841", "value": 31160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660697, "uuid": "3d4561b3-2f81-46ac-b046-da02254e62f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660697, "uuid": "cbd74da0-6db5-4b6c-a017-d0a7a098b5ff", "value": "f78f0aa68fcbccd4f08a1bb7a5ba3923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95dfcaa-f637-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712643022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643022, "uuid": "19284b77-1245-44bc-8089-131100758a2c", "comment": "Malware payload (Socks5Systemz)", "value": "915cc2aa4685c14248da62070f0ae0ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643022, "uuid": "73a89c68-c2cf-4b4c-a05a-4fe92d6d5abd", "comment": "Malware payload (Socks5Systemz)", "value": "016bafa425a7059d11b7fe26ab27ee2a67856ce0ca69942822d67477c51370d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643022, "uuid": "59996ee6-239b-49e9-95af-d52a48f3c800", "comment": "Malware payload (Socks5Systemz)", "value": "35814e99a26b0755e3cc6772d229f22d3bb69a7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643022, "uuid": "52e7d079-29d6-4135-9864-aa137f81f0a5", "comment": "Malware payload (Socks5Systemz)", "value": "375cb5137f36dae697b3df41c7fa279b4ea6b58eadcf9f26e1685f9b6b7f2aa3a75f864d86f9463efd151e0a74a6ebe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643022, "uuid": "b93ab961-36bf-494f-ad7f-27c1dc1dfa59", "value": "T1381633B9F0FD4D31D69EAFB06E51E0636333ED5408EDD9AC28E94996EC22704E216707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643022, "uuid": "c50e7cb6-b3ac-43d0-9843-7901ac4a9024", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643022, "uuid": "cb6f0e00-8ae8-4cdf-8914-6a0074f0c674", "value": "98304:miPbAs9QjRxrpwNm2IYMF1sg9E95lws7ZT+DexydT1iWeA6qVNkhb:D8bjrK2vsgi8iZ6DexcZJeA6qVN2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712643022, "uuid": "9c6b9191-df52-4e2e-80bd-b4b6f4edc303", "value": 4308393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712643022, "uuid": "a95ec87c-4642-4e7b-b919-ece700040874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643022, "uuid": "dd5b3b5a-0be8-42c4-923a-72b60d36717d", "value": "915cc2aa4685c14248da62070f0ae0ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b66410-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692671, "uuid": "0bfae83a-fc83-4ca4-8e1a-b2eb2be682e3", "comment": "Malware payload", "value": "c2da676fc2acce43dce2be9b78db0220", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692671, "uuid": "ef530735-1ded-45a4-8a9a-58c2213fe19f", "comment": "Malware payload", "value": "01b6c305fc65cca6806df3cea024ae52231fd43b5e17d643e4ed47bc66560670", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692671, "uuid": "4daeabed-281e-4d04-a5bc-e6c67c595b20", "comment": "Malware payload", "value": "61a581577055ab60b7a045b4c7ceb60a29169eaf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692671, "uuid": "6495b7a9-e8cc-4957-9e2b-a3b4b376fda8", "comment": "Malware payload", "value": "296f3bff9adea8cdebbb5d20cf559df5b35eb11cbc0234a851712a412f534580008889ed3e13d539cc1123ffa47afdcd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692671, "uuid": "84d42e91-693c-4f70-8670-df8b7fe70459", "value": "T10C85AD63E56084B2E92C2538CD7D273ABA74B5DC0925CBE3E395DF751C32A909B2710E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692671, "uuid": "f576f038-7270-4417-97c1-e19f80381899", "value": "dd5204082ad3a8e7d9c8a8c517f0afd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692671, "uuid": "083e9162-74b5-4ce9-8400-11a4bc0c99b3", "value": "49152:TOZC1fj26Q3o08mH6N/Iyx0fBST1WDCyP:plj26Q3sN/7UOWDpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692671, "uuid": "dafb4bb9-cb34-4dd7-95ec-64abb3b11c4b", "value": 1720877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692671, "uuid": "3bf87177-0d6c-4fce-95a7-94dc6594b63d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692671, "uuid": "6e9930b5-0b7a-4577-a2fb-8e38bb19598f", "value": "01b6c305fc65cca6806df3cea024ae52231fd43b5e17d643e4ed47bc66560670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a554d9a-f617-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712628931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628931, "uuid": "7c3c1151-42a6-494b-8810-18f26126c2f6", "comment": "Malware payload (njrat)", "value": "82873c08ec1a2cacd5cb1916edb259b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628931, "uuid": "ae56343e-8d0d-46a6-a237-e82fd3a8ad5b", "comment": "Malware payload (njrat)", "value": "02424a493edf7b2f67778c64d2edab2edf41a5469a6973ca8702a65ae3392a90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628931, "uuid": "2d6e6047-26cc-4bbb-be4b-d9e757e6fc1b", "comment": "Malware payload (njrat)", "value": "a759f941a86e4353cffe25d53a57c2d025e8071a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628931, "uuid": "d4a15188-9a46-4a18-a62c-bac841636a20", "comment": "Malware payload (njrat)", "value": "5e6cabe0f2baa3335fc9af07ce8f916ef8ef53efa629e55525f38bbbbaaabf232906f98b862974a3f891d4f178dc92bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628931, "uuid": "d9730c7f-7cfe-48ad-a485-24b35a022d84", "value": "T1F0032A4D7FE18168D5FD057B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628931, "uuid": "1d253232-47da-450f-b630-29a09188b60d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628931, "uuid": "998bfd6c-203d-43cc-b726-06f64ba720bf", "value": "384:RCSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXr:YS7TZ38fvCv3E1cQrM+rMRa8NuHft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712628931, "uuid": "b6b209c8-f343-496f-9dab-cef031bc79f7", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712628931, "uuid": "31ac2c0a-c6ce-4463-949b-f712a9c40e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628931, "uuid": "6321c2a4-9821-480d-ad24-2f9017749f25", "value": "02424A493EDF7B2F67778C64D2EDAB2EDF41A5469A697.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66d6c85-f6bc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712700194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700194, "uuid": "3fd1a823-b3a2-41c9-8a37-c6b3c8fe264c", "comment": "Malware payload", "value": "cbfc0d493896d95afc54d0e15ed6f03d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700194, "uuid": "046610f7-d244-474b-b7cd-6f530d22df1f", "comment": "Malware payload", "value": "0242b16d15e0d3e087be37fb4d1a4f0f08f1c737774488dc943c6599d0307278", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700194, "uuid": "8d61291b-a94d-4749-a6a1-f4029162ae4e", "comment": "Malware payload", "value": "f0789962c1fea2b597466c24e5ac3f61f7bdd5f4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700194, "uuid": "39a8e07b-e067-4897-b512-541dc731258b", "comment": "Malware payload", "value": "2e74a909cc0f375bdac2ca3289b0f1d2a28f06d895d6d8be3e6c60d0f7354eceaa2cbc2e9b0eb801f796161db49d49b5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700194, "uuid": "312ba735-3faf-4f51-90a5-b6df8ccec89d", "value": "T10E55AE29379C03D5E177A17D8ACA4B89EAB1B405032197CF05A096AD2F27BF44E7F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700194, "uuid": "ad2e93ec-81ac-44f4-b7dd-23dabcf2bf84", "value": "5be5c0729ba1156c48a7f08a7314848c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700194, "uuid": "ef16af3b-c194-4680-a10d-1c08824a7ec7", "value": "12288:33FxpE2JEBvhVP3dUgJJpWtCKIPJuWRXNdMTNHWsSPtWKHEpr7PTUCIDg/41i2:3j2BJuCXPMhH/iGprzAC3/41i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712700194, "uuid": "12dfc961-a941-44c7-89ca-e933342e23a9", "value": 1317864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712700194, "uuid": "f765a187-ec4c-4ed4-ab7d-dda9504cce49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700194, "uuid": "0e71b876-fb0f-4b0c-9b36-46ec74db9213", "value": "cbfc0d493896d95afc54d0e15ed6f03d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a9af64-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692673, "uuid": "f6ba0bfa-d606-4d31-b180-3baa2db586b9", "comment": "Malware payload (Adware.QQpass)", "value": "8617d30760c7c362d1668d4d9726fed2", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692673, "uuid": "a13781cd-6cdb-4b5d-a1b9-2840791d9c3a", "comment": "Malware payload (Adware.QQpass)", "value": "030d5d197784ee0df38f139891ba73ae81eba0d2c77d802d05d958dd5a8cbed6", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692673, "uuid": "7d9ec6ef-8b46-4410-972c-edf486e44c3b", "comment": "Malware payload (Adware.QQpass)", "value": "ac74fad2b579978f4560514e3cb995a6c26bbe6f", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692673, "uuid": "107dc7e3-26ca-4d23-a408-f504458d13c4", "comment": "Malware payload (Adware.QQpass)", "value": "8ba5ea437f6466fcca3d03ff1c089ce7dcbec0455d8d51fdb102162c656a964e1774777d9174fc022ad0652755a3b653", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692673, "uuid": "7c594726-f97c-43b4-9493-7b6710d98a87", "value": "T11494D813B6229491E1145BF66BBA073869B8836038B1CE13EFF0DDB2BD71531975E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692673, "uuid": "8d8c8832-cb7d-423a-bc12-e8e70957b4a9", "value": "887d6de026e86320108f5c946296e1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692673, "uuid": "17a60925-7a4d-4a96-bb6e-8a89b7133631", "value": "3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8k7:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692673, "uuid": "e99097f2-c953-45bb-af14-a8d30448e9b0", "value": 447360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692673, "uuid": "cdd1e475-aaeb-41a4-935f-eeba0b7f67be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692673, "uuid": "b5f717e7-4786-44e5-88c3-7ec5bc188d59", "value": "030d5d197784ee0df38f139891ba73ae81eba0d2c77d802d05d958dd5a8cbed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a6dfbf-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692675, "uuid": "de272a57-f1c2-494e-986a-6e453d30046a", "comment": "Malware payload (Blackmoon)", "value": "55fb5c07f0d184ab79095c8b5d4a2d6c", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692675, "uuid": "0485140d-ecb7-403d-ac1d-963314f7e0fb", "comment": "Malware payload (Blackmoon)", "value": "0406ee7c7c39d3685855524c126195f1560aa90a16f25da71066186f90e43f67", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692675, "uuid": "698ee0e2-be41-40a9-a03e-c19a983da3a8", "comment": "Malware payload (Blackmoon)", "value": "d2f16c3f216fada88c79dac508d3fadeb0e282b6", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692675, "uuid": "e835b047-9150-4323-b907-218dd49b73ed", "comment": "Malware payload (Blackmoon)", "value": "790a79ffcaec0d2c01637cec8bfa8fca1132b04d34bd71f227b4dab64b71da855d2c283749e7090ed479a55222053a9f", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692675, "uuid": "4405caec-ef07-4d19-b346-192096275727", "value": "T1CCB4E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692675, "uuid": "332f0690-7f97-4c86-af23-1a525d1709d2", "value": "6144:6cHpJfHElepVuWwP5YcQfg8J+ojs93J+o:6ifk0GPacQfxjQ3J+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692675, "uuid": "fda92f9e-885f-4f1b-ada4-3a146dd7e424", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692675, "uuid": "5bffc13c-0787-4678-87be-8d87768ae9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692675, "uuid": "ce43fab8-b065-4132-8da8-4ea8b5dda487", "value": "0406ee7c7c39d3685855524c126195f1560aa90a16f25da71066186f90e43f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d04cff-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692677, "uuid": "9f6832bf-e71b-4496-98aa-5581f12ba5f7", "comment": "Malware payload (Adware.QQpass)", "value": "43c0d43b7a01e2389ccd6df41dc8c3f1", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692677, "uuid": "e174db9b-628d-47c7-b0dc-650c8aacc8fa", "comment": "Malware payload (Adware.QQpass)", "value": "04a30c940fcd5eb7b4bf5584914cb0d88f30613f89b8a0953ca93670fab96a78", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692677, "uuid": "13782804-93d4-4fd6-93a0-470baad81441", "comment": "Malware payload (Adware.QQpass)", "value": "24b3b8fb39844910c2f460fe6f30152139375b7f", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692677, "uuid": "ac8370c0-186b-4d3c-b95b-42c61295a26a", "comment": "Malware payload (Adware.QQpass)", "value": "5da47bb7b93e54a66a454b2a5972f4b6e6a36005a126c11207c469dbe12f0735ed9ac4e14d17815dab0b8fa13f5a5ecd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692677, "uuid": "fd779fda-7dec-4521-a819-489630ed0231", "value": "T103A4A61372319491E1595BFBA7BA433879F8836438B0CD23EBE4DD62BCB5122971A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692677, "uuid": "d8d341cd-4c1b-4b90-b816-ebd6c5ec4328", "value": "d070a98a3bb72e151251c216b80dfd90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692677, "uuid": "1120cf81-1013-4815-94a1-bc22ee3f6b4e", "value": "6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZ1:/vpv/R6H3U25fehHpAW+yOBOKCZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692677, "uuid": "f9e5e55f-4c00-4d7f-bda6-d18213dd619e", "value": 462902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692677, "uuid": "71ff7bd8-4836-4ce0-b956-582508fc7faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692677, "uuid": "06b10c81-8cc9-4312-af46-42c53e7c64be", "value": "04a30c940fcd5eb7b4bf5584914cb0d88f30613f89b8a0953ca93670fab96a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58061188-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669863, "uuid": "e0d30050-2f4b-4042-a220-c12a909196c1", "comment": "Malware payload (Gafgyt)", "value": "e3392b0c3046b89ecf3200a1ebd3abb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669863, "uuid": "cd5be564-ce13-4495-b38c-7f48f627afb8", "comment": "Malware payload (Gafgyt)", "value": "04a880c4fe383fcb4fd6537b04898701f72b06368e29819a872c64ced3c9c94e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669863, "uuid": "a6cbe028-f2e7-4f50-b472-d84c83a567bf", "comment": "Malware payload (Gafgyt)", "value": "3d1ffc1bf2fc4d96352058b0d1bb8109b119140c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669863, "uuid": "1367e537-e21b-4f84-ac6f-a421881bfc34", "comment": "Malware payload (Gafgyt)", "value": "3f11a3b645d42e89c93dacffeacd8dc1f96e679a014d9e868cd1d708a58cdf78f1458f4738b588e63ccc03c9ac0c9b52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669863, "uuid": "da874556-ead6-43d1-8c42-351e8cfd7b12", "value": "T138044B43E8655FB7C1829EB621B75A700753E9520B4B1B8AB13AD9F0464BDCDF40EFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669863, "uuid": "f32ef382-a9be-4745-b6b4-0a3aa7413da5", "value": "3072:w8jmBengWm/FuGmkc7WcgkJJotmqWq+5/AfurPse9GXo:VmB8gWm/FVGqcfJJotmqWq+5/AfurPsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669863, "uuid": "070aedf3-4a99-4eaf-bebf-32cacb6e4bca", "value": 176169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669863, "uuid": "c8f5deed-a39f-4552-b47b-fe0b29af1194", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669863, "uuid": "c8212048-b0a2-4fad-814a-446d4ee04266", "value": "e3392b0c3046b89ecf3200a1ebd3abb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c27f14-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692678, "uuid": "a1542a14-4826-439d-9fde-7e0849b4e94f", "comment": "Malware payload", "value": "eff8463786de7f0ec37486bbcbf03f08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692678, "uuid": "68558747-772f-4e2c-88cd-81394ce4195c", "comment": "Malware payload", "value": "0612b73b6a2ed1f7daaf992900b2f4c995729ae8af2b9dad694ba3cc60d35950", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692678, "uuid": "29e64c31-e94d-4864-85a8-527e08ad28b5", "comment": "Malware payload", "value": "f56ce3186aeed2be7ef2c634f987b09dbf49be6f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692678, "uuid": "833a89da-7959-40d6-877f-58fbee89bee9", "comment": "Malware payload", "value": "5a420ef8e92b53600eb27f05fdb91af5f527bb09665e23a514d3b4e2265677b5e479115262ddc56e8da71ccc443f65c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692678, "uuid": "99f270f7-5813-43a3-bd2b-dc6521ad9d09", "value": "T1437496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692678, "uuid": "0de09b43-87ff-4140-a240-57bde78f3834", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692678, "uuid": "7382ba7e-3151-45fb-b297-a837807896c4", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxs:IXdaAqvRwWoe2XjSVvUYuyHWPBsxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692678, "uuid": "5d912bbf-611d-41c7-a78d-a1bcdda4416f", "value": 348116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692678, "uuid": "dc13b62f-a9bb-4748-b3bf-96d478851a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692678, "uuid": "89092597-3be9-4daf-9f8f-46fb7efe7288", "value": "0612b73b6a2ed1f7daaf992900b2f4c995729ae8af2b9dad694ba3cc60d35950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b2abc8-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692680, "uuid": "cdc4f20d-d044-4583-89e4-33315cfcfc69", "comment": "Malware payload (Adware.QQpass)", "value": "7178521deb920043a3b97166b4e883c5", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692680, "uuid": "d92b4cb2-f3b2-4fdf-b0db-f3a614ae6e8f", "comment": "Malware payload (Adware.QQpass)", "value": "0720c78ddb25e6fe1f5163f07bcc503d908ffa3f2d7697afd975a52a5643dc07", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692680, "uuid": "a2f207c8-fd08-4460-ab36-9d13f9c6b419", "comment": "Malware payload (Adware.QQpass)", "value": "79ce17bc4f77f5b87d0315f7ae331aa6f043f633", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692680, "uuid": "ba5960d9-53b1-4ded-8fbf-d25801ba480f", "comment": "Malware payload (Adware.QQpass)", "value": "3310e41d4a0700ccb95cc19a6522df6427cd7796b1c882f24a649b2320b6585432705943e5f382a4bed7f6037a726c52", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692680, "uuid": "3f63293e-38e2-403b-8da8-191ce24e2ae7", "value": "T17D84960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692680, "uuid": "e1f6e6a9-5403-4ff3-b74f-3c4f9d7dc100", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692680, "uuid": "6c13a88b-1ee6-43c0-baa5-1d75347a6762", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22V:7vqWQub2lrE0B55FpekPdb/22V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692680, "uuid": "01c78d4e-8c58-4219-a32b-8b3bb830983f", "value": 406205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692680, "uuid": "ed0e964b-b7a4-40df-b4f3-183409aba1df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692680, "uuid": "de6c70d8-ba07-44d5-b565-52a340a18313", "value": "0720c78ddb25e6fe1f5163f07bcc503d908ffa3f2d7697afd975a52a5643dc07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a17c38-f628-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712636275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636275, "uuid": "85096a4b-de16-4673-a52b-7ba3d301064e", "comment": "Malware payload", "value": "c0261a6d5e0cfdd52b1ffb44b29f6462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636275, "uuid": "812ceb88-6e13-43b6-9804-401915c1d828", "comment": "Malware payload", "value": "0756cd32c252a6b4334960666c6d3928b6ea783abff2308b75947ebbb62f9861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636275, "uuid": "431705a0-f1d6-40ea-8d37-4db6787b933b", "comment": "Malware payload", "value": "77fe78a9619194be04b57b50eb745552190f101f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636275, "uuid": "9ac55fc2-6557-451f-bad6-ed9c8dca8f3d", "comment": "Malware payload", "value": "ea53c04c25b7a30683b06d1461041bf16067d049a427c144369a00e66c499be8de8aa2ee26716f514a5a615b8e6f25c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636275, "uuid": "f37be21e-cc0f-402d-bf2e-bde8841fa240", "value": "T1276733BDF8247812E27A9631B1F45ADFD202AE39182347E663D34A8E3C1BF4465065DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636275, "uuid": "7fdc0c0c-a514-44bc-b092-9a97002dc388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636275, "uuid": "7e812df5-6e97-45db-ae46-c231b9f26e7e", "value": "393216:zkhCXK5ss04oWsF6HR8xgI63p7DXFRrXrI+i03JFRYEaiZpRB+BcaXe3Tnw7W8:gCws14oUu2I63p7DXFeaZXYOJ00/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712636275, "uuid": "49e0b2a4-7752-4669-8ec1-392161524fce", "value": 31761584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712636275, "uuid": "df827f5d-68a6-419f-bf08-92e07b6753b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636275, "uuid": "33dd579c-47f1-4412-a168-30123f79d689", "value": "SecuriteInfo.com.Trojan.MulDrop24.56436.17805.29816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b831b3-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692682, "uuid": "025fdc10-491a-4152-b4b8-380b6dc62bcf", "comment": "Malware payload", "value": "455dfbcee6b052278a1cee6adfef61e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692682, "uuid": "ddbddf7f-5db8-4766-ae57-76e87cf77f99", "comment": "Malware payload", "value": "086c3549f8a32a546814806081f870920dada88365fae110d1c821cb37de3b4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692682, "uuid": "08e41d39-bf12-4cc5-bdbc-45c4ff88500f", "comment": "Malware payload", "value": "2f5b1e2c82b333873e827bb2c0bd985cd89667ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692682, "uuid": "d333e66d-c05c-4fc5-a3ec-e11d20488940", "comment": "Malware payload", "value": "cd405f9e9975da20c84a97e82ea5c09327e9112ba21be08ce392e73fef3e996354836a0bc1ac644dca12b722fb060c90", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692682, "uuid": "e932cb7d-0394-474a-aa44-159d4fa91b88", "value": "T1B07496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692682, "uuid": "8a10e878-3251-4346-a5b6-5a76c52b04bd", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692682, "uuid": "42e5272d-5125-481e-aa4c-3450a9301492", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxm:IXdaAqvRwWoe2XjSVvUYuyHWPBsxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692682, "uuid": "07fc4b69-3940-4283-908a-70b13ea17b46", "value": 348068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692682, "uuid": "6a987ee4-c690-439e-bae7-0c5c4eb68576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692682, "uuid": "1116376a-67c6-4400-804f-7e47517a6a58", "value": "086c3549f8a32a546814806081f870920dada88365fae110d1c821cb37de3b4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e8dfc8-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1712669617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669617, "uuid": "962a24ab-fe10-4bb5-8d0e-93b6d8d27a37", "comment": "Malware payload (MarsStealer)", "value": "9c62b2cace38bbed4e624bbd2d36ef42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669617, "uuid": "1545736b-8fae-4670-a6d2-18891facc852", "comment": "Malware payload (MarsStealer)", "value": "08c1d7fdcdebaa5fe76dd7c18d96ba32ee6577a43f3d4ed68d0b360531980f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669617, "uuid": "bc72652c-c2db-4a46-a97a-1ca42f6851d0", "comment": "Malware payload (MarsStealer)", "value": "d2a023ed67b4fb0e77e54ea835f1cec763e03e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669617, "uuid": "5c96dcc4-51e7-4062-939b-af4945080a98", "comment": "Malware payload (MarsStealer)", "value": "f88284af3ff606dfcb7d79d36d13f195f5c63751afa78662405a52121bdd63f4f750530463582f3997790031565fe625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669617, "uuid": "edd249df-d90a-4071-acee-d95468f6fbeb", "value": "T14F442270D77C2364D57BF1B0742878529BB063DE859D322B6AAC11BE372C3C98618B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669617, "uuid": "e4085b45-2eda-4c6a-9c7b-78f3f54fc947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669617, "uuid": "f543037d-c66f-4766-841c-c907ff3e1ea8", "value": "6144:wnvS4O81rXwZ6+FHuDcudzEZlOt1hgpA8yaiT:YXxbO6+FHuFelOWHtiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669617, "uuid": "b1c89705-ebd5-4f75-86fe-1addcf3b3815", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669617, "uuid": "59b25574-b444-482d-b128-71719aba79f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669617, "uuid": "958f2a98-f8c0-466e-8cb8-8fe1f7c05fd6", "value": "SecuriteInfo.com.Win32.PWSX-gen.22336.13850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67361ea-f6b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694906, "uuid": "cd4123b1-8294-43e9-827b-d51d1058e769", "comment": "Malware payload (Gafgyt)", "value": "eb9cf9f0b48f7ed4e2f676aa21396f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694906, "uuid": "55a07340-ead9-4029-804d-b729cbd9fdcc", "comment": "Malware payload (Gafgyt)", "value": "090871b654f9795237025688153034ace0645395a64f6f19eb1a9d14bae2632e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694906, "uuid": "64b1f92f-7f54-4820-80c6-20d148907da0", "comment": "Malware payload (Gafgyt)", "value": "428274909c8a6242ebad4903a4b668ad080c33e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694906, "uuid": "f76944bd-1afc-482f-a859-0cb9ac6ba4c7", "comment": "Malware payload (Gafgyt)", "value": "fe7a361e4e07de0349eb0dff0be718428ecb5d733bc52b2d5155038adfe14b933278ddc697c985ca6203c348057b4b26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694906, "uuid": "8d3eb7be-6b07-4017-b4c1-0fd256c5f220", "value": "T1A0B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694906, "uuid": "b8b9feb9-d125-4b0d-ad79-2c68cc454ab4", "value": "3072:WD3l+XQzPeV91310pWud3KakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWC3ypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694906, "uuid": "dd04d192-a74c-4b9f-9f3c-61b1d1618968", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694906, "uuid": "a2d450df-03e7-4bf1-b58f-ba1207ee44ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694906, "uuid": "0fcf6c8c-2154-400e-a2e9-fcf10327bcea", "value": "eb9cf9f0b48f7ed4e2f676aa21396f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69db88a7-f6c3-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712702965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712702965, "uuid": "85f0b30b-86da-47c7-8de9-f59cc988c622", "comment": "Malware payload (RemcosRAT)", "value": "c64376d815b8e57d6a9b20a97e6bd5d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712702965, "uuid": "f668933d-5487-42bf-b879-8fae5776f8a0", "comment": "Malware payload (RemcosRAT)", "value": "0986af462eaf8a1a2fd770259b663e0c82539764fc49f03755a0a8034e239231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712702965, "uuid": "91071c6f-8d82-411c-8674-0d240ec8083d", "comment": "Malware payload (RemcosRAT)", "value": "e3ce3036c9fa24209ee3337dfbd668449e238788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712702965, "uuid": "997d0c51-a669-4ab4-9fa4-474b975d23b2", "comment": "Malware payload (RemcosRAT)", "value": "d27c1f10a02977cbf3c15a0794eb8cdb48f7b42ab94a53e172e002e1f637cb8a146b0cd20a56ca941bdcdafd595d5aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712702965, "uuid": "d3286cd4-e8c0-49da-996d-75e592dd0e8b", "value": "T120B49E01BAD1C072D57514300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712702965, "uuid": "08e1fff3-e6a1-44e0-ad48-37018c455e74", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712702965, "uuid": "3569e34d-fe16-420b-a908-8bf3b6b8370b", "value": "6144:6XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNv5Gv:6X7tPMK8ctGe4Dzl4h2QnuPs/ZDqcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712702965, "uuid": "aaa6cb4d-bf68-4285-8ade-a6fa09e23420", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712702965, "uuid": "cb2b56f0-4f07-4e6d-a6e4-4aebbf7da544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712702965, "uuid": "32389d5d-99cb-4b3d-8f0f-1a19e8e3e60d", "value": "xw8oKxLrOnt6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f191a62-f66f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712666922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666922, "uuid": "ae504bb2-bbcd-463d-ade4-cf8627d130ac", "comment": "Malware payload (AgentTesla)", "value": "f520439484a0e8c8c6e67cf92991f966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666922, "uuid": "9212c639-e51b-4423-a54b-366e3d1814e0", "comment": "Malware payload (AgentTesla)", "value": "0a05e24cd0e22e748fa7aaaf7525411b652ae412e46cb6f66c47fe0baf892432", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666922, "uuid": "26286db0-1dc4-4c5e-9874-06d9742adf71", "comment": "Malware payload (AgentTesla)", "value": "9ca6539d294a16dfe468bc4710325e12eb3d6a7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666922, "uuid": "e9f7e656-529f-4c4e-a3e6-20ed78fc03e5", "comment": "Malware payload (AgentTesla)", "value": "7606c632aad044a4880ed8e81d3c4cbb419748442e71ad8634ed9179c5fdc53807bc6e0f79f92d12fe34215effc200a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666922, "uuid": "f7d43857-a8fc-4ad7-975a-cab6118e68f3", "value": "T14945AE0373B19022FE9B91328F5AFE115EBD7D260123A51F1398F979B9701A1463E7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666922, "uuid": "9136604b-e897-4548-b11c-3de41f283377", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666922, "uuid": "a5625f10-399f-488f-9ad5-b9002d84a50d", "value": "24576:KqDEvCTbMWu7rQYlBQcBiT6rprG8aH8T1uBDkFGd:KTvC/MTQYxsWR7aH8TQRkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666922, "uuid": "ac49ef47-cc04-40fa-a716-0b65f77e98ef", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666922, "uuid": "50668a7d-e8ad-4bd2-a367-55443ec27304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666922, "uuid": "fcf7eca1-be93-4f14-bb6c-81362e3a614b", "value": "0a05e24cd0e22e748fa7aaaf7525411b652ae412e46cb6f66c47fe0baf892432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79abd4ec-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692683, "uuid": "661de974-e2b1-41cd-93bc-e579ac942774", "comment": "Malware payload (Blackmoon)", "value": "5b1f4fefe31c2caa1966ca56d71c282e", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692683, "uuid": "b8dbd838-8997-4e8b-8167-be1dc5d3de42", "comment": "Malware payload (Blackmoon)", "value": "0c082014d003b257b490a56057bdb94b58be290da213befe8aae1d3aab6f10de", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692683, "uuid": "c351cdb3-88ec-4e6c-ab82-2bbd663cdbef", "comment": "Malware payload (Blackmoon)", "value": "2c3606619bee88a144e075e9486fb812ecba1a79", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692683, "uuid": "20986051-630b-4f49-a2e5-e8e6a21baf7e", "comment": "Malware payload (Blackmoon)", "value": "ac0f8c031bcfe36ba55112890142946c5616c53a9da20b09c5cd655ff3b6cc959f5b53922227aa4e75b88d7f42d578ff", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692683, "uuid": "d5f03d5f-8a1b-43e8-8404-4fcc02ab7b89", "value": "T15CA4A60376219491E1595BFBA2AB433879F8976438F1CD23AFE4DD71ACB1121871EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692683, "uuid": "f63858e3-7ced-4177-8fd5-b5e79f549a3d", "value": "391b34fdb03bbbe961a380d74dcff2da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692683, "uuid": "9234d281-8879-47ec-bbb8-4ee537fe6d07", "value": "6144:uvbuWQu/cuaS2l8iE0B55FrJJJekPd4/2OAgerHO:uvqWQub2lrE0B55FpekPd4/2rpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692683, "uuid": "a6826363-92e7-4b33-9f91-1605a984a3b7", "value": 469766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692683, "uuid": "a7ece1f5-7c35-46fc-9b97-e592bbc6599b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692683, "uuid": "a8b7b369-7114-44b0-bd06-c9db26b3a5ff", "value": "0c082014d003b257b490a56057bdb94b58be290da213befe8aae1d3aab6f10de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cac258-f68b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712679152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679152, "uuid": "676cbbec-c8a5-4fd6-8ebe-d1e4abb55300", "comment": "Malware payload (Mirai)", "value": "c83027ef513da123c50320801dbd5223", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679152, "uuid": "5897bbdd-0921-4027-b7ac-5e3759cda7a5", "comment": "Malware payload (Mirai)", "value": "0c46089aff1bf063a775e25d142e3fab2bae72d74e0459d6836fd6b01b254570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679152, "uuid": "d5d971a0-3e23-4288-a5d4-b384ed64c658", "comment": "Malware payload (Mirai)", "value": "fcb72f8c501543d1d014a6fb6bfbd19fe389c12e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679152, "uuid": "af7bb1f5-af86-4b12-ad1a-a21de3ba8957", "comment": "Malware payload (Mirai)", "value": "2c9f5826e20c080fd7be952cbbc87badfe3e9c968cecb9fb4d129eef14bb7bc971a13787d3091099d2a4907f9f2afbed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679152, "uuid": "8c1aaf67-51ed-491f-a53a-aff4b41bffad", "value": "T18F24A71E6E224F7DF37C873447B74A35A76923D627E0D644E2ACC1145F2029E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679152, "uuid": "32630ae8-1f7b-4d42-a558-ab11b295fd09", "value": "3072:qMNJK6t3sXYMl6Dwqw0zYuTOEbzsWJrERnaOJJ1m:qMNJKrTl6cq5qbWmRnJv1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712679152, "uuid": "98347680-d32e-4cab-8c6d-773ed4d0a1ec", "value": 213268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712679152, "uuid": "5d68c3b9-2ab1-4540-873d-843ae6c739d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679152, "uuid": "f97d39d6-011a-4569-b296-743d8fa6ebd6", "value": "c83027ef513da123c50320801dbd5223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fe401e-f617-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712629189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629189, "uuid": "999ece98-0fd7-4761-9ed8-373ee31a2f5a", "comment": "Malware payload (RedLineStealer)", "value": "c8edf453ed433cefb2696bb859e0f782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629189, "uuid": "20a1d069-7a3a-4b8c-af9c-0964de1395c6", "comment": "Malware payload (RedLineStealer)", "value": "0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629189, "uuid": "8b831ee5-f0c1-4994-97e2-a340fb6a5d9c", "comment": "Malware payload (RedLineStealer)", "value": "e34cf939d6c5a34c7bedfd885249bb7fb15336e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629189, "uuid": "bd816f03-172f-4602-a886-363587768869", "comment": "Malware payload (RedLineStealer)", "value": "4b481cbb51b31b6ca9c134bd69006b093cd42e85294122928c9f9edc3557e0e1bdf84ceccd2c6a4bc5588031bd867157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629189, "uuid": "d958fce2-9bb3-4a1a-ac0f-8959bdabb881", "value": "T10FB4A02A2182B077E51B0EB2206772743D1AF071427F0DDB97A4ED7E57602F185A1ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629189, "uuid": "32d296b3-57c9-417f-886e-f1dee6f84528", "value": "7ea8dffd703d941f5f072a5931c9ade2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629189, "uuid": "23f7c9d2-5fa3-4754-a73b-5c9ad2520344", "value": "12288:ypFy1/EXmhwdmojNcp/yhBxrQWQAxfUyD4lIx:ypFy1/EXRdUqByWQwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712629189, "uuid": "6867a556-e434-4bd5-b945-591be3aa7db2", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712629189, "uuid": "37aa7df4-f2b4-45e7-a953-b71350e09827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629189, "uuid": "61c609a7-7c4e-42b5-84c2-56a6dc265aa6", "value": "SecuriteInfo.com.Win32.Evo-gen.37.9213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3198d33-f6b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694900, "uuid": "e50ea498-868c-4b09-8c4b-6421df3a7c09", "comment": "Malware payload (Gafgyt)", "value": "41e5aa992b8679a8ea9db3f5b4b8e498", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694900, "uuid": "74b3ec69-ec9d-4774-a616-ecf298f35f24", "comment": "Malware payload (Gafgyt)", "value": "0dd879d2525029beda5335f0085cf73e40f7f1b7ed48c6a9647543094016ea39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694900, "uuid": "19a2d516-26af-4091-9489-7bccc4714173", "comment": "Malware payload (Gafgyt)", "value": "4f5dbee452bd200130983d6218198bad9786e4d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694900, "uuid": "07189561-91ed-44b2-b834-beaeb05474ab", "comment": "Malware payload (Gafgyt)", "value": "029620291582859a4a823cb76053ef4d2d7fc7b849a76800551f11a09c0f61ceca20a2e13fbe64ae729eba3d3fc3a83d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694900, "uuid": "145c87a5-6e1a-4c61-8207-5cf9d78d42e1", "value": "T140D33B60D458631FC2D21379A68F4A6C3F261B9AD3E733114638AABC1FC57897FB9520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694900, "uuid": "65ad5afa-a927-4885-ae6d-7cd4e22be2bf", "value": "3072:tW9aFN+0Vx2hTQV/uyDmV5BbCZmzQiYSwXviN:tOaFN+0v/uyDodCZmzQiYSmviN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694900, "uuid": "1ffb2e23-8c6a-4e96-955b-0bf3b003fa06", "value": 133550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694900, "uuid": "99a348c1-eda5-4301-8d22-03635ad4bf61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694900, "uuid": "e94fea05-35a6-4f01-bde7-cf4e93fad1ae", "value": "41e5aa992b8679a8ea9db3f5b4b8e498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb4d298-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712669764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669764, "uuid": "240bf917-9ddc-4fab-ba05-d84ae7908711", "comment": "Malware payload (Neshta)", "value": "89562223ad08c64afab5ac2e7d2f5c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669764, "uuid": "b08d8705-9201-47a3-878a-c5083a917b4c", "comment": "Malware payload (Neshta)", "value": "0de78bf97ff1864cbbf7c0f6c667911e03857364fe7bc05460c5d23f37f8e6db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669764, "uuid": "cf00215f-0c82-4b37-943e-37707c746c8a", "comment": "Malware payload (Neshta)", "value": "f26d3f226ea390a9dddddc499af92027d4c430d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669764, "uuid": "344c7f90-229d-4ea5-815b-f9493032ddc4", "comment": "Malware payload (Neshta)", "value": "319d87018f137c32dbc9791a4658f59de8d40c2033e4901fe8748f531a7080900fd9f7696f0ed7aee83d6f2cbc9ab72c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669764, "uuid": "65dd4177-f39e-4c8a-8549-681860a0f6cf", "value": "T1C9A5C00B7304169EF1769F30E5ABDA60272EEC2B3949571932EDF600ED7A3565A3F006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669764, "uuid": "fa41cab2-aab9-4799-9956-aaedd36fe9eb", "value": "e825d68af3cdb34011c7358624ed4328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669764, "uuid": "c18b9974-6301-4cac-ad26-88a2a21ef1a4", "value": "49152:YbdYAm4zKbdYAm4zVbdYAm4zFbdYAm4zu3AmQEQkXp6fNAKNhRS51qzms2PHM:SdrAdrldr1drcAnEQKQNH4nqzKPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669764, "uuid": "e70f868c-fbb9-4640-8538-34f54f67677e", "value": 2158592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669764, "uuid": "78629b67-3081-4bff-bb51-37d04a3e03eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669764, "uuid": "8a0fe13e-39d3-4566-9fb9-4401d11df9f3", "value": "0de78bf97ff1864cbbf7c0f6c667911e03857364fe7bc05460c5d23f37f8e6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a2b590-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678396, "uuid": "4f0adc94-6c37-4169-b764-5f7e93d0849d", "comment": "Malware payload (Mirai)", "value": "d79d2db8983f753d7b76599f44582047", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678396, "uuid": "079335eb-4c74-49d2-af93-dcb2e3df2587", "comment": "Malware payload (Mirai)", "value": "0dfba49df668f3aa7992c94903a56033f55cadcdc9b0fb77b63cf8e66136620b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678396, "uuid": "a1d09ca5-1bc8-46ba-8ed1-cae8acf667be", "comment": "Malware payload (Mirai)", "value": "62add1a6281c2eb501744f6121f80cb5c1aeeeea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678396, "uuid": "2cabfd73-ff79-42a1-b8a2-f8d09c143931", "comment": "Malware payload (Mirai)", "value": "f5e8179bf0c2d118981896583c96c6d9f72465d2c09d60eed225b0d95a7f7fa8f383225af6848c1d15757d872894f4c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678396, "uuid": "8d8351e3-4e3f-43be-b224-06f6b41d1be3", "value": "T1FE63E751BCD18A6AC6D423BAB96E10CE3321B3E8D2DB3217CD241F5476C651F4EA3B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678396, "uuid": "597fdfcd-f851-48fc-a251-b00fb3677035", "value": "1536:9mECQsJIGeIVQFBPWQKImEzRc7YAq6WhKh8Cw:9mNQsKGkncJqBh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678396, "uuid": "c3eae914-ee5c-4fe8-9b44-3b53bcfb56f8", "value": 70892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678396, "uuid": "ae666589-4cc4-42a0-8031-3cca1549edb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678396, "uuid": "231bb2e7-eafd-4117-aa5e-4259d49d2700", "value": "d79d2db8983f753d7b76599f44582047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a930751-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692685, "uuid": "30564265-ed61-4255-97c3-1927c343a4cf", "comment": "Malware payload", "value": "d001dcaf7535eb4f417fbe4d5dbb525a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692685, "uuid": "431c16a4-680a-40cc-8f73-7db0f47b0cb0", "comment": "Malware payload", "value": "0e4ae1da9cf677f0901f29c0b41d63678b308713913eb62e8b14ace26d066a02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692685, "uuid": "8e9f92d0-67d0-470d-ae9a-07fc47d3eb9c", "comment": "Malware payload", "value": "7520416e3a5fe8c7a67dcdb36a9d0834670b01a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692685, "uuid": "94fb1b99-6dab-4763-8571-86ff3431bc86", "comment": "Malware payload", "value": "6fd4b87f655d74e047ce65e3a5dd345f5ac1011c313996ab6acc689ccc9bc554860dfb1ec8c6b31ac0d21b2eabc479b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692685, "uuid": "10ac7b4d-5c4d-4df0-8fad-087c548d2d5b", "value": "T16074950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692685, "uuid": "d762977c-074a-4c52-9ed3-4bc372c097c8", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692685, "uuid": "cb6061a3-ba8e-4141-9a03-5d8a2351c503", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudet:b5/Q58drihGiLhmGNiZsx0B/zkXoet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692685, "uuid": "5d7f62c2-be9c-42e5-914c-c411276723bc", "value": 346616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692685, "uuid": "ad906508-8320-4b57-8bc5-f4fc4f9eadd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692685, "uuid": "79451e85-bc8f-4592-b671-cdcf28064941", "value": "0e4ae1da9cf677f0901f29c0b41d63678b308713913eb62e8b14ace26d066a02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34121361-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712671951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671951, "uuid": "5a3ab52d-952e-4b3e-9a87-9efb6687b5ee", "comment": "Malware payload (Kaiji)", "value": "9fcb12331ec25e948a52c24172fee37e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671951, "uuid": "89a601f1-3d19-4071-91bd-af31891d94f0", "comment": "Malware payload (Kaiji)", "value": "0e8182c34da9590853e44c28fcad26ff8be404763773ab8c7e0d6f05d8b7c077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671951, "uuid": "898bd1e2-fe8e-461a-b3ca-7958b1064419", "comment": "Malware payload (Kaiji)", "value": "9d570da911bde4bd25ae38f40c57872cf0cfb7dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671951, "uuid": "0e94a9c1-c3a1-4934-89e0-d2679aa80dbd", "comment": "Malware payload (Kaiji)", "value": "507def511bef15171729828805606e07a449c564ea1801dd6f2d38a84d46bc4f9096dd043df48f74a1027e88aa5821ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671951, "uuid": "74ca9dd1-9b86-46e4-b704-8a29dec6e64e", "value": "T10F362A87B8824682C4E4367ABCBD81D533630EB9AB9752576D05FE3C3EBE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671951, "uuid": "a09dd07b-8a97-48b8-9725-91c5e7795ced", "value": "24576:f0hITSaxCsmLTRScFkLwYgib6kEVtQ2gLApZf3vrTXKWXDReUHxeR7j81v9oT19e:GsLSjzCX1H9qzaiKRFjIIlkK1VI1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671951, "uuid": "0b9f55cc-1f71-42df-87db-df2d01a0e040", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671951, "uuid": "07d77a2f-55cf-478a-9881-b7ef8d623448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671951, "uuid": "8e3ab382-dcac-425a-9488-bc9a7c6ef012", "value": "9fcb12331ec25e948a52c24172fee37e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9bff2b-f694-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1712682726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712682726, "uuid": "07f7f2be-4a70-412f-92fe-335d77036fab", "comment": "Malware payload (NetSupport)", "value": "92e0df65fd2a3625bae13026b0c7f2ba", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712682726, "uuid": "f6d331c9-e93b-49a3-8dea-763dea39526e", "comment": "Malware payload (NetSupport)", "value": "10c856efbd5a399811434f59eeb3a02617e085b68fa41c29e653619aa73edd5d", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712682726, "uuid": "bedffc15-caf1-471a-a8d6-8412f406f8d6", "comment": "Malware payload (NetSupport)", "value": "eff69b8cdd236b6a4fff39ff7232aabccbdd08a2", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712682726, "uuid": "f3ec6cd5-95b4-4205-ab24-23e542d4348c", "comment": "Malware payload (NetSupport)", "value": "adfede556d2abacd329f1cf45382bed7bfac027c4f60e79ec5f5262ef610a8bee7fd18948b4b1d6766fa9d6568d19596", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712682726, "uuid": "5edaaf30-0018-4786-b446-df398a7cf11f", "value": "T191F533594F5243F3F13650BC41656F274064A23D22F8B42778692DE7BCBBB71E60AE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712682726, "uuid": "35556ca3-d469-4bf3-b938-a6ad1b9d42fd", "value": "98304:Z89i7JDmWKwOA4qJtVqFLCrjL6BP+UIm3F2:Z8oDmWKqtcLCrSld3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712682726, "uuid": "d2bf5f44-4e64-443a-83d4-9522a3549b83", "value": 3433829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712682726, "uuid": "8fa04814-3c7d-4f30-9777-f1937b7f04a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712682726, "uuid": "796e7ae7-c420-48fa-9fda-6a07f8412972", "value": "BB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb52131-f6b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694894, "uuid": "115fa82f-e0ef-4bfa-af71-ffb0ecbfa9bb", "comment": "Malware payload (Gafgyt)", "value": "f7af3de8074e94cbbdfa2decf4e3dbe2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694894, "uuid": "e6e3da9b-42fd-425d-9e64-30e337431774", "comment": "Malware payload (Gafgyt)", "value": "1103eec2ca3d9dc46ead77fec120d56c6526a4912e36a417139851df45661ce0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694894, "uuid": "4706f330-1a46-422f-8590-208eee2af962", "comment": "Malware payload (Gafgyt)", "value": "1a7ce2a2d4beb3ba954272368ef75fb4d8b417bc", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694894, "uuid": "1f79536f-2256-4515-8d7b-ce428de54b06", "comment": "Malware payload (Gafgyt)", "value": "8d983fbb5190a2c0252978cd55ec0c7bf38d34c566839b5106227fa067d72b6666ba8bbb86e4c14f043cf218925b6b81", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694894, "uuid": "6bfaad90-a314-44c0-8cd1-bfc4dee6773c", "value": "T1E3A31A73A285A5BEC08352B416DB9D715C27B4BF8732390A33E86D6C2B1D8C4BF99741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694894, "uuid": "aac658e6-bfcc-4ea0-9a25-6a174197ad3a", "value": "3072:HXBWIqNMdT6zzPgLT6xCWzsH7gGmhKuCXq8+ZYVQ:GMBQPgXpFmhKuCXq8+ZYVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694894, "uuid": "31567507-9b2a-4de3-8a82-12841e5be0b7", "value": 107059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694894, "uuid": "590f0be3-3668-4a80-ac1e-51eaa45ca631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694894, "uuid": "aa32531a-7aba-4101-965c-663d6fe93aed", "value": "f7af3de8074e94cbbdfa2decf4e3dbe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8e2181-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692686, "uuid": "a200700b-4d75-4696-a2e7-7b747fafa50b", "comment": "Malware payload (Adware.QQpass)", "value": "aa59d674e5a305e4e285a838f4d7a16d", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692686, "uuid": "a35a31a0-a85d-4e52-9860-7a2bb8088b4a", "comment": "Malware payload (Adware.QQpass)", "value": "110eaf076c2c81eed81ac8f7f8bdb57efaeb8b18728ba5409c5ec4512202ef00", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692686, "uuid": "a06fe542-c75c-4806-a397-faa657400793", "comment": "Malware payload (Adware.QQpass)", "value": "688923c532dcd151599f6639b894cc69967ac17d", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692686, "uuid": "4cb60f21-7d65-4fcd-9e09-d5a77fcb9724", "comment": "Malware payload (Adware.QQpass)", "value": "323d639b79f9f1282e6e670e1ab0bb62b338c786bb366c33636691894a391e5c91a2758c80f460ba3537f0253d543a5e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692686, "uuid": "25f7d30a-84ad-4c08-9250-6acff63d9f4b", "value": "T1AC84960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692686, "uuid": "daa96229-bb32-4c2f-b283-c5d326fce534", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692686, "uuid": "1b0e286c-3565-42f8-bc21-35a60c4e4ec6", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22s:7vqWQub2lrE0B55FpekPdb/22s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692686, "uuid": "03e83dee-bedc-48dc-8445-c69d72e860be", "value": 406128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692686, "uuid": "8f203574-ba84-453c-84ec-17221e4d3131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692686, "uuid": "5efbdcb4-c02a-43b8-81b6-8d01d189ecc6", "value": "110eaf076c2c81eed81ac8f7f8bdb57efaeb8b18728ba5409c5ec4512202ef00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66483fc2-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651848, "uuid": "c3355a48-9d00-4adb-b58b-0f75c96be864", "comment": "Malware payload (Mirai)", "value": "2a7a44b6b215e39e7dc9276f52544a37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651848, "uuid": "4b3cca89-43f9-4fe0-a54c-6e40d102ffd4", "comment": "Malware payload (Mirai)", "value": "11eb39c3da75a8c6b077592337560a8f375cb013f6336de3777ea7497d98a170", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651848, "uuid": "607ec6d4-7447-4303-adc3-45b36566947f", "comment": "Malware payload (Mirai)", "value": "031edd08dfe9a32428eb3d110eba2bf40c65202a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651848, "uuid": "b549382d-71d0-4f5d-ad6a-710b73bc9c12", "comment": "Malware payload (Mirai)", "value": "ad26af6c82a6fd7daf892ac34702d9b561128a148fe45daa43d31fdf10bf21add4f137b94189c004ba3ebae25a0c7a15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651848, "uuid": "83500bb2-a30f-4f31-840b-7a4f73cbb2a8", "value": "T18CE33C56E6408B13C4D61776B6EF42453333A7A4A3DB73069928AFF43F8279E0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651848, "uuid": "14db5e19-60fd-4a79-8f11-96cb63f77769", "value": "3072:w+7QmwXaoqrpnjVmkbYZg6rBcbzr5tkM/9rD:wsQdXaoqrpnjskfAGbzrvkM/9rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651848, "uuid": "f9c94698-05e5-4a2a-b6ba-6b8b946cc366", "value": 146014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651848, "uuid": "73fbf5b1-02bb-4ec1-aa9e-8564a61a60a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651848, "uuid": "d16025fc-860f-4e72-8a87-654062c7f211", "value": "2a7a44b6b215e39e7dc9276f52544a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445253d6-f6c8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712705049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705049, "uuid": "c6b42863-ec50-452d-b1fa-86768fe4189b", "comment": "Malware payload", "value": "8005f91694311cde90cb032dff3f4585", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705049, "uuid": "9c2cb770-a091-43e4-840f-3d70e95962a4", "comment": "Malware payload", "value": "11ec3986c2a01d3004a3663a8ff9904e0500aa9819780e54b6f115a1efbf88de", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705049, "uuid": "4468ddde-f7a2-4897-b950-3de4a22e7d2a", "comment": "Malware payload", "value": "a96311f2199fd2fc4918a0ba969cab7bd0ab58e9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705049, "uuid": "e6c53338-8057-4833-9421-10217bfdb790", "comment": "Malware payload", "value": "1256b67f332368ea08ca6832838305bcda6253c0897e7b7bdc877f7647efb1fef01251f4ce3cb9bcb8d5884515abb48a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705049, "uuid": "21f3c08d-5951-4983-8f26-039712d5fa5d", "value": "T1211733673D85DE28C9009CB646B8FBB403193CA45F109E47D3853764D9FBAE288E2DD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705049, "uuid": "092d3cbe-df3c-4e43-b9f1-372c1ab71389", "value": "393216:fvR80XFfhtAnjOVCclJoSeayhDEYWMV8ogf6m5ZFPg8eM:G0VZDCclJoSea+S6Q9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712705049, "uuid": "717520a1-28d5-4f83-a8f6-8c407d905318", "value": 19496960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712705049, "uuid": "1a4b5129-e193-49b4-ba69-e41a8fbeefbe", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705049, "uuid": "db257c0d-b6ba-458a-acd2-a2b009b2c755", "value": "SecuriteInfo.com.FileRepMalware.19588.30922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00ae3b0-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694546, "uuid": "04741606-2d9a-408a-bf26-ff12a6ea9c3b", "comment": "Malware payload (Gafgyt)", "value": "8ce7cbe36d0a80c6264e8da29413bc5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694546, "uuid": "d619c491-c7d8-413e-a997-78ecea459521", "comment": "Malware payload (Gafgyt)", "value": "11efc90303ece2af244938bf50afde60c0ccb9aca1aa3a35364a6d03929767d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694546, "uuid": "0a27352c-5cc1-485a-8891-fcebc5906aef", "comment": "Malware payload (Gafgyt)", "value": "e3ffb0f411f03bc9e5c20c100a59399f3e09d95e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694546, "uuid": "b305810a-59e8-448e-acbb-d70239b20fc5", "comment": "Malware payload (Gafgyt)", "value": "2448ca240178b1dc1d163cddeca18733dbb7302308eaf6ad324ad80f852a4459932fc9f48823e5d7fd444e9ccd136d04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694546, "uuid": "87ce14db-fd37-4f84-80af-46ab69e31e27", "value": "T136D31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694546, "uuid": "dd01a750-b55c-4e08-a144-108cdccf5a9a", "value": "3072:Sdf+fvEqa9FazYA7IboRhre391CErktmCQA9FX9aH:ifWEqa9FaNhre3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694546, "uuid": "eefa375c-cc87-4f26-a020-cc6cdd45318a", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694546, "uuid": "2dbc156a-2ef7-4cc1-b08d-be529a9767c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694546, "uuid": "d4c5544e-0632-4632-99f8-6c38e64e0cc8", "value": "8ce7cbe36d0a80c6264e8da29413bc5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea5a64d-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692691, "uuid": "3e735bba-9ba8-48a9-aa39-3e18b24b9680", "comment": "Malware payload (Blackmoon)", "value": "35f88b4ddcfa1ad111af4c95807a64b5", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692691, "uuid": "2b7b0215-3069-4345-9c03-ae221819930b", "comment": "Malware payload (Blackmoon)", "value": "11fbf0e65b4a3c5970c16fe79f2e442fdb484613703c5453215e1ca835837988", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692691, "uuid": "48900ec9-6f24-4b76-89f3-dad487ddea5b", "comment": "Malware payload (Blackmoon)", "value": "b524a0b67990fadc2f952592d2fe969e46f4f800", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692691, "uuid": "626671df-2165-4fc9-ae11-b6921379a060", "comment": "Malware payload (Blackmoon)", "value": "4f1a4a1012d6ed9f8e3359d044040edcc66f98edf4efdc798c92aa538879906f3e44c2c6778f5f5d88e9a7c536d6bfe7", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692691, "uuid": "ccae2825-cceb-4f4f-a412-8c5a7bf98134", "value": "T17F269C8BA6E18A52C11952B4168F5F38797496811D36CDD7EBD8ECF03C306A36B5F328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692691, "uuid": "4ac8a02c-b6e0-4808-98b2-ecb9b6f74a3a", "value": "0699e3870e208d7c8b967949b3d04eeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692691, "uuid": "83e0f060-09c4-4999-b2be-22376653ae6a", "value": "49152:BLLM4pYVSRTzW3x71kjLtbRz53wJWqD2NRmXNT08+C3looYM2sdIYOxrPFS:Rg4pfTzWhJglZEWNkloq91O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692691, "uuid": "e49e72d5-676c-428a-892d-3efc09d56397", "value": 4753078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692691, "uuid": "98150d86-a104-48e4-bbb4-0069e6c16f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692691, "uuid": "ae8df29a-9022-4d79-8630-c3faa6b559c0", "value": "11fbf0e65b4a3c5970c16fe79f2e442fdb484613703c5453215e1ca835837988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b82f55-f683-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkGate)", "timestamp": 1712675520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675520, "uuid": "921546ea-9ed6-4051-8ede-5d90bf2f1102", "comment": "Malware payload (DarkGate)", "value": "1fd4831334e0460c20a3ec0b102dbae9", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675520, "uuid": "f54f24df-568d-4ee7-a67f-4c3eae2245b2", "comment": "Malware payload (DarkGate)", "value": "12018c2af0600fc1f1a75842a1d4f7777001fadb65f93125e479ec9b949e1773", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675520, "uuid": "cd85edcd-55eb-4da5-906a-0189da7c0755", "comment": "Malware payload (DarkGate)", "value": "eff6fd40f64b6ce5b66d4a9f37d52b277487aa1a", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675520, "uuid": "db795f9c-4073-4e86-bab7-873e57d768ba", "comment": "Malware payload (DarkGate)", "value": "9d601d9a7ed6ceb0703a6894b359b3e8cfe983c700b8a7b16450119c53d248bd3324fe781ea2ee59b5764bcb86377ab0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675520, "uuid": "98c072f7-7cf3-4ff4-a0dd-334cce8a5b14", "value": "T1EA43E108EB4ECCA1C650A575044F57B93639A2D4CBC0FF4A8E79FCB54BC23A51EAA5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675520, "uuid": "b99895ff-84d2-4b9e-a763-2455eff14418", "value": "768:ZFnM1dDlT2qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD15ogXnlq5uXG:/mZ2u4OPKIxoEuDKJnllXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712675520, "uuid": "f3c00a5d-eff8-4910-8415-65e247904cab", "value": 58228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712675520, "uuid": "a4f63b24-2c13-4e32-9f6a-e7b77d5a6b7a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675520, "uuid": "fc87345c-80e1-42d0-85cc-7a90e1c7d5c3", "value": "statapril2024-1382.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ace7c3a-f608-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712622489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622489, "uuid": "e16b4c97-f0c2-45c3-9076-ae91c8c32b2a", "comment": "Malware payload", "value": "66b0f16089b16ae969fadb58d7e7c686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622489, "uuid": "57e9b099-8d6e-43ae-a290-d543c2df6876", "comment": "Malware payload", "value": "13e8fa3ce8e3a676c32351b7bd92d5eefcf74beca32e12701f2c54b185deb494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622489, "uuid": "2179d2e0-8dea-4b3b-b888-d1fab53af762", "comment": "Malware payload", "value": "a1821d44b90a4920c92bb96214e3a9b855509fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622489, "uuid": "f2c91e80-f241-4f47-81c7-fbaec0dcf426", "comment": "Malware payload", "value": "47ddc2f8d8895d111ab87ca932cc5cf4e578c71f153ae850d405be1aeff402eb04639f7b13737d827a2e231bcb1312c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622489, "uuid": "0105a2b3-ea8b-4cd4-8a89-d6290f167b3d", "value": "T170E5020BF7419A4DE5367C7C86B6A326BB31BC255B2243DBE2ED0578998F1E04E31781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622489, "uuid": "e378959a-8705-4d98-92d7-c918c080d9f6", "value": "f015ec9ac42766f2798e906713b1625e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622489, "uuid": "a3052ee1-f2ad-49e4-a83a-2ab364b909d2", "value": "49152:OlKGynqzco6QdasS+vPCg2V6FZUFMOVr5SOlzddrI2Ye6XxOHGK5TxqYJ8wABy:CZ1CaFZtOZ5SWdd1R6Ym8q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712622489, "uuid": "b4b21bfa-a8f7-4c8d-aea6-4fc1ce92460f", "value": 3193856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712622489, "uuid": "d8c758c5-2591-4a90-8d58-2630b6926a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622489, "uuid": "133d058f-811c-4078-ab41-56e86d62927e", "value": "SecuriteInfo.com.Win64.TrojanX-gen.7904.11956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ca7543-f675-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712669529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669529, "uuid": "9138e44b-b9fb-4364-a2b4-50a7d3a76cdb", "comment": "Malware payload", "value": "4ab12a5ca5927a42d4dd263ff82d69dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669529, "uuid": "5030d6dc-5f32-42d9-9b57-02534a300448", "comment": "Malware payload", "value": "14b1ed8c4bbb13d4dd41e2d2af20b0453eea3df9a46b69afe8bd9831cfffcfae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669529, "uuid": "cbeb8bc8-4d81-4ac2-b4d4-ac7b0da807a3", "comment": "Malware payload", "value": "b1e027de99e26992e4107a5fb48734a6d68eea5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669529, "uuid": "02b28f64-d394-45b7-a17b-8b97c9d27977", "comment": "Malware payload", "value": "12a9fd2502e49628e9e3b2f488d9abb33187070256ffe3a0eca9f8dec0ddad59e0041ffaae8cc27df0f2831897871e7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669529, "uuid": "644b5dff-6e20-4711-a23a-68575ae62b5b", "value": "T10B669F91F748D239DA4A073188B3CB647361BD02C5E0866B770AFB2F56B16D95A0FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669529, "uuid": "0e1ab592-7028-43e9-acfe-3fdda196e5e8", "value": "98304:AQRzgu1+9e7eRYr6N9PcCJUmJtqqWjUZTyVWu1EUPX0Tm4S5pEHs:xRzWY7eRYr6N9PcyUNEZWVj1XX0Tmbqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669529, "uuid": "d403c4ee-d009-4958-8aa2-637af8a2fa20", "value": 6593860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669529, "uuid": "284aced3-b64e-4689-a93f-9939534a0a14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669529, "uuid": "5d381bae-81cd-418d-b944-ff2a499c20fe", "value": "4ab12a5ca5927a42d4dd263ff82d69dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc37092-f677-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712670574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670574, "uuid": "0f579ef0-8007-40a7-8ae2-0ea03b916d5f", "comment": "Malware payload (RemcosRAT)", "value": "f8b201556d3c349d0fce9702c424c556", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670574, "uuid": "cc06c34c-0622-4d22-9a81-620bd3e89dec", "comment": "Malware payload (RemcosRAT)", "value": "16550f58e8ab8fbcf7dee33901008c44dd9fba3144e1edf94a0033afce770ea1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670574, "uuid": "1954b21b-1250-40b0-8659-0a7cf4db10e4", "comment": "Malware payload (RemcosRAT)", "value": "fbeb803116c8e7cb2a7d8a2ce73093ff5353a70c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670574, "uuid": "4b122f63-ae3e-42aa-a5b2-82080447863e", "comment": "Malware payload (RemcosRAT)", "value": "87b19d4648ecfc87a87d334dca6d04580f85a7e3ba86dbd83646c21cf48194e7aed38fa76eae72c89d296a1ca2ebc2be", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670574, "uuid": "55d8a5c8-f997-4219-bb14-a5902f8f2492", "value": "T1A173BD6EE74F0915DF5597BB435A4B4A05FCB33DB28100B139AC973437AD82E4A628BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670574, "uuid": "095fa566-77eb-4807-9414-c643207776be", "value": "1536:Lz7jWDvjKzZpNCYkLFjImCK3jNB3vhWQI/M+vPKkRRa+FIvMGO:LvjWDrKzmL9IM3jNRhW1M+nKkRRa+FIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712670574, "uuid": "9de8d567-f7a7-4991-834b-2e27ec50ac6e", "value": 75087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712670574, "uuid": "95e0ff88-cd7e-4e3c-a2dd-ac42b8c3036f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670574, "uuid": "459ab530-6e71-4fd5-ab59-63d497e3d7b6", "value": "weareverybeautifulgirlsxygirlwantokissmeharderthanbeforetogetmeback___sheisverybeeautifulgirlforme (1).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb42861-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692693, "uuid": "441344e7-3455-4f3b-ae72-f98488569972", "comment": "Malware payload", "value": "d545053a9c721cc5b9d513264beb92b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692693, "uuid": "4bf370d7-09b9-4263-a495-469cb3a4d04c", "comment": "Malware payload", "value": "16cc88e682c36823d09dd1d626fc315b960fca78aa798d7f75e799de7c21886a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692693, "uuid": "2ee0604e-589e-4e3e-a60f-6a3382cd4c5c", "comment": "Malware payload", "value": "31bcda7c3aebeae23edbe73782d68416805dd9e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692693, "uuid": "d5412a33-7ac7-4967-819c-d26acb72a3d3", "comment": "Malware payload", "value": "093352ee2baae38e4a855812810058a34c56d2fb435ee49b4b0000c1f9d9b424ef713c93c292b30d91744d66f24414a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692693, "uuid": "37b4fd06-05ad-425d-b1be-6bf01f93be9d", "value": "T123A4D913B622A495E11457F66BFA073869B8832438B1CD13EFF0CDB2BD71671875A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692693, "uuid": "4a307261-86d3-4f00-9843-a3b175d63a7e", "value": "dca55ab828881de2079e4e62880ac2fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692693, "uuid": "a13c5515-a478-4621-8815-a5663c0ddc45", "value": "6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAW:xgXQKSLpOCtV0R8xMSaAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692693, "uuid": "0c4b1207-a98e-4710-bad8-db499eee14aa", "value": 451198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692693, "uuid": "99f1d95f-4cd8-472b-b485-5d131069be4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692693, "uuid": "10a1a46c-649c-414b-9853-96bef36ed013", "value": "16cc88e682c36823d09dd1d626fc315b960fca78aa798d7f75e799de7c21886a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7931e215-f6c0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712701702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701702, "uuid": "7bba9166-2c8e-48f0-986c-60c14431b33c", "comment": "Malware payload", "value": "359eb3c6c7d61c712af722c2c87dc7cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701702, "uuid": "7b04e9fb-c8bf-4102-ac4b-d1c950c55b24", "comment": "Malware payload", "value": "1867b66766228e19eb40a13fc9ebc8d539830cbec570851bc0dbe15afe9edc9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701702, "uuid": "f91dc38f-ee24-4214-a2bb-c020dc321a5e", "comment": "Malware payload", "value": "8905132cd5b5ee9fe0413769c1d68a86957db45e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701702, "uuid": "4f48ba50-30b2-4162-8f8a-3f0f75f25e02", "comment": "Malware payload", "value": "9f80857a6bc64fffc70bceca095850a756cc84feefdb8a42cf6de75ea762ce58f86cb885e08e2bf0646eb0a32a7bdf1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712701702, "uuid": "518e05ae-34ef-424c-8558-7e0b46ba3c9c", "value": "T1D3768D53ECA545E9C1E9A23089739252BA71BC484B3123D72F90F7382F76BD4AE79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712701702, "uuid": "0d4bcd7c-65dc-45c8-b93f-b9480e5d9117", "value": "98304:w4+411DbzG4FRgEoGT8wY4j18Q4Z6J7i2jGq:Ht1DbzGYv1UAjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712701702, "uuid": "3c3c0840-a0a5-4c5d-a930-8209b0eba657", "value": 7418379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712701702, "uuid": "ada11340-f4d7-4971-95ab-1f6b5ccdc576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712701702, "uuid": "d92cdb77-d230-4edb-9672-658f0d07e425", "value": "SecuriteInfo.com.ELF.DDOSAgent-CK.24819.9715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2d515b-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669547, "uuid": "be06bc5d-64f5-4eab-ad44-6b535357162a", "comment": "Malware payload (Gafgyt)", "value": "1fc25820cceb9174b7e16a897e6ee349", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669547, "uuid": "6bef072a-9de2-4683-a7da-5389171a029b", "comment": "Malware payload (Gafgyt)", "value": "188c4777254ba71800a8641f34f9bf6b17d4d3674ebda7ca7ae583328e2a0148", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669547, "uuid": "9f255147-1347-4b93-b235-6e97e63f16c5", "comment": "Malware payload (Gafgyt)", "value": "52a2183d18033e4ece2bd14e77c0af6d2941c505", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669547, "uuid": "c1d8fda1-e4dc-499c-9fdd-bf926cbfceca", "comment": "Malware payload (Gafgyt)", "value": "8826710507c958e920384387a564983d0b18e4aa09c3e4614feab15a9f77766c47a00e4b35906ce434762915e421c07c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669547, "uuid": "f7635d91-7aaa-4e9a-bb13-5356821964eb", "value": "T19E141A93F905DAF6F40AA73204D30711A671BBA60E935533B32B79769E3A2C43467F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669547, "uuid": "a201dad2-302e-43de-a395-802730685426", "value": "6144:4pBeipTa9x5KQ5eLvkfGy8WUwmhgL+Q/A41/fse9PXo:4pBA5qkfbUwmhgL+Q/A41/fse9PXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669547, "uuid": "8dacd6f7-049f-4046-a4e7-17f08eb8019e", "value": 203331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669547, "uuid": "a30d1c85-ecea-40f4-89b7-89bcaf8f8c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669547, "uuid": "6080a4a2-af9f-4e8f-829d-7875209d204a", "value": "1fc25820cceb9174b7e16a897e6ee349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b0128d-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692695, "uuid": "b3b463e2-68ef-43a6-83be-ca5c9ad8b9b1", "comment": "Malware payload (Blackmoon)", "value": "b2f6b9e3c10c59c3f0979f4c9b67c8ec", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692695, "uuid": "de08e2c8-e873-4776-9131-631e80271241", "comment": "Malware payload (Blackmoon)", "value": "1890c78a3c93a98b369c10f6f3cd2de069d9ab456172b732a890c52a5546f3c8", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692695, "uuid": "1ecda01d-4cc3-4ea2-b6c4-6487c8609503", "comment": "Malware payload (Blackmoon)", "value": "ae228cc40ec62a7a83fd4a5426462069e1bc40cf", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692695, "uuid": "cf413d93-555f-4b5b-b9ae-331aa011f809", "comment": "Malware payload (Blackmoon)", "value": "43a825064fe1fd975e323fd313067a8ad8bc30c2203b16944484d79538ee517c75e9c4e3af13107feeab9952c5b6a3e0", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692695, "uuid": "bed7c7cd-6775-4e41-847e-ca66d489f63e", "value": "T1DB94D813B6229491E1145BF66BBA073869B8836038B1CE13EFF0DDB2BD71531975E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692695, "uuid": "2a5b2011-2092-43c6-bc0f-65053426c75f", "value": "887d6de026e86320108f5c946296e1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692695, "uuid": "1446a0bc-3f74-43b4-8403-65c69872be3d", "value": "3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8kl:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692695, "uuid": "c2223992-d0dd-44d2-bbc7-f56a0283ff00", "value": 447360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692695, "uuid": "1db154fc-f627-40e2-92dd-45a8f32923da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692695, "uuid": "ef2b8fff-e33e-4c00-926f-9867f9201861", "value": "1890c78a3c93a98b369c10f6f3cd2de069d9ab456172b732a890c52a5546f3c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f515c4-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712678532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678532, "uuid": "e2fedde3-e06d-4cd8-92d5-2574ed08cbfb", "comment": "Malware payload (Gafgyt)", "value": "fa4cce91b2ed304b8852379d3e15107b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678532, "uuid": "3832fbb3-baa3-4159-a246-adae4d3e64c2", "comment": "Malware payload (Gafgyt)", "value": "1a36965674a0ddcdaba44b6951f52fdb6469b85dd2dbffdad872254e420dc05c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678532, "uuid": "5e1321ba-0c25-4ecb-be2a-c7fc1db91c42", "comment": "Malware payload (Gafgyt)", "value": "0281bb58c9da680e99e21609576cfc884720d54a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678532, "uuid": "a5056b8e-1771-4639-b739-fa0821f06171", "comment": "Malware payload (Gafgyt)", "value": "27fa3354ffd153c0e139655e23cab932eeb2c900447e1c2eb8768c4264100c1fe081b9098da29ea41282991f0d0babd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678532, "uuid": "be352a12-0cd8-4a51-9d9b-d620041344f4", "value": "T10ED3E876F401DFA6F00B96B104D78F256D30ABE30B9321266366356B9EB31D63C63E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678532, "uuid": "0e5f6326-fc60-4b06-bfaf-1c8b37a0cb02", "value": "3072:9nmwABC9snnXR2KbukNXrUE9Q/4yWz+J3BDqrmzj0qDJNYyoPe:9onjbukNXrFyWiJ3BDqrmzj0qDJNYyoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678532, "uuid": "35085069-c678-48c1-94a8-007221642c57", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678532, "uuid": "b54b8e17-6483-4a60-a95a-a57ea11b6b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678532, "uuid": "86fa7d41-878a-407c-b92e-2305d805bc78", "value": "fa4cce91b2ed304b8852379d3e15107b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7bd189-f68b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678894, "uuid": "ceb5582d-c25b-4179-9ed7-0300ec423ed3", "comment": "Malware payload (Mirai)", "value": "e884eb6e755f552267f32b89491655bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678894, "uuid": "91e02f58-a3f7-4239-88b9-a01bd2889134", "comment": "Malware payload (Mirai)", "value": "1abb1df3e38efe7573cf03f567e78c1e883b86d1561861dffdc4db34b6d1fb32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678894, "uuid": "918caa1e-a49a-4108-8d06-32b6b74fe7b8", "comment": "Malware payload (Mirai)", "value": "4d7e89db3ec0157059522f07e87fd5a5a8f1fa83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678894, "uuid": "2201a8d4-a931-40d2-ab38-dad0aac7995c", "comment": "Malware payload (Mirai)", "value": "6f7fad1cb6a07a16e0af4a8ef425ff0239bb6cb805acabaf848dfeffad85a35b10cb18d238e46d5221d18209754621c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678894, "uuid": "7522dae0-d115-4da2-937b-8ef5a1f48737", "value": "T13E634CC5B593DCF4DC160B3420B6FF369A76F03A6129DA9BD3A49D63E907602D90326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678894, "uuid": "431e40cf-5c36-4763-9a1b-9b5ae41118a0", "value": "1536:jxUnb1LwXB9jLkelA8QZ+sT0WMvJ/zn8zUi83Gu51tgdQzMK:tUb1LWB9j4elA8Q0WmJ/bOa3BOazMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678894, "uuid": "0c5d8bc3-bd8d-4b0a-b1a6-baba3e8b4b5d", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678894, "uuid": "32533106-23d5-4972-aa92-542293d63db7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678894, "uuid": "3b2093b3-068e-4cc8-b665-f848ad4fa236", "value": "e884eb6e755f552267f32b89491655bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fa100e-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692697, "uuid": "3e1581f7-5cc6-442c-aa69-b42a2b937425", "comment": "Malware payload (Blackmoon)", "value": "2701db0e63f3b1c481c8f194eab8875f", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692697, "uuid": "2353d6e5-38c0-47b5-9c44-dfcee0acdc6a", "comment": "Malware payload (Blackmoon)", "value": "1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692697, "uuid": "dc43b8d0-814f-4d0a-8521-c38b1041e7bd", "comment": "Malware payload (Blackmoon)", "value": "c5d9e9329859076453036dacffc8575a03a2582e", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692697, "uuid": "37ee7e37-3d57-4b7d-8dce-06d922a001ec", "comment": "Malware payload (Blackmoon)", "value": "c7862436c93c6eb0278634b113e1f6daef7e37259c0d2b3fa84ee7a9391db9affbd1110ea8370b213c351a13021a3582", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692697, "uuid": "3a223399-2e89-4b7d-90c6-bee9f25c3630", "value": "T1A7A4A61372319491E1595BFBA7BA433879F8836438B0CD23EBE4DD62BCB5122971A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692697, "uuid": "eec15662-7d0d-47e2-a98b-8b0b6175639c", "value": "d070a98a3bb72e151251c216b80dfd90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692697, "uuid": "cbe5891e-8166-4758-989c-13160283c041", "value": "6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZv:/vpv/R6H3U25fehHpAW+yOBOKCZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692697, "uuid": "bb2a1f71-5011-4968-8e4e-897ddc52a9f3", "value": 462888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692697, "uuid": "1e206e6e-d54b-4e3d-8bc2-696b0d4ad254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692697, "uuid": "39721ff6-f0e0-48c6-84b8-f4bd1495de45", "value": "1b8c6bc00cc39b9a2e33b30dde7d47e4eb403f23b376647124a60e14eb9b5dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e0e3d8-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692699, "uuid": "261bb81d-66e5-4f97-ae53-ae6ee3ce5d42", "comment": "Malware payload (Blackmoon)", "value": "a4d78e958ef9926ed4033b4337287dc2", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692699, "uuid": "a0e905ac-0f30-4c04-8f9a-b037947babcf", "comment": "Malware payload (Blackmoon)", "value": "1bb253e19b29ffe73642aba3d3b59269f3949a68fec9cfe89183584acf57c3d0", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692699, "uuid": "4834c3b0-3c7e-4b86-9ce5-981021c171d4", "comment": "Malware payload (Blackmoon)", "value": "7b9b116f4dd08f4a799cb8af2808b53e012aeccc", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692699, "uuid": "fb5775eb-41cd-4829-b823-378505fb41a8", "comment": "Malware payload (Blackmoon)", "value": "dfbbaa21eed2160faccaadb9b52c969c3fc341839db693269e24cbff8753ffa6360974797e8df35701f7e4bc080f5cf2", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692699, "uuid": "20d83908-8993-45c2-b562-47b95d63398c", "value": "T166B3F823DA0289BAE06826B521FB0738FA7193B91C750963EFD5CEB17C52631DB4364D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692699, "uuid": "b6dafd86-375b-4956-bff0-ae6b23a01e95", "value": "38777b3eb947cc68a2158922f2c92579", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692699, "uuid": "045e0e84-e642-48c1-937f-f4abaec521ce", "value": "1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27q4rf:bav9OdPx8wJ4rm7q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692699, "uuid": "cf18b0d4-0474-463c-8ef4-40e032d0ae03", "value": 116226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692699, "uuid": "976f5f2b-3170-4f29-a411-36a22f304df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692699, "uuid": "89db7678-11c8-41d0-8831-fdc39baf5863", "value": "1bb253e19b29ffe73642aba3d3b59269f3949a68fec9cfe89183584acf57c3d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c8e6da-f660-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660357, "uuid": "7b46b793-fa74-47fd-b3cd-469eaf9cc5ff", "comment": "Malware payload (Mirai)", "value": "580c09211360ee7846e0635bf223da49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660357, "uuid": "5380f300-932f-476b-aade-0ac9f5863128", "comment": "Malware payload (Mirai)", "value": "1c8e34ff7362cecea7a0f2eb1380ec4f6150c32f23f3e900695f6aae07015166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660357, "uuid": "85d14250-4f9f-41e8-8dc3-ddd31e51cbb9", "comment": "Malware payload (Mirai)", "value": "be55580e502defb7de00e9cb262918ae751de567", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660357, "uuid": "0ea48ed4-aeb3-444f-8815-a502d815cf23", "comment": "Malware payload (Mirai)", "value": "c379b75f51cce5f233e359440d7675cc549a8b55890835b877ac5bfd79139997450628e3abe8e9f53f8472ccf8b56bb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660357, "uuid": "5d372c81-1768-4c8b-9d89-d6cc86bc4217", "value": "T1A1735C22BA761E17C4C1697A61F34764F2F5578A25ACCA0E7DB20E8EFF3464032436B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660357, "uuid": "9f2253de-67c2-4a02-b4af-5a2e82ed4702", "value": "768:QUVd71SRraRNf6wjTmNHaG74R3YcOjr1s6+O+lM5VZkB19k1tytIp:QU31SRraLf6wGNj723/OjhsVlM5VtSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660357, "uuid": "b1c42f7c-cfb5-4256-8f32-a7de24d23a84", "value": 75280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660357, "uuid": "7dc34572-c493-4e20-b9db-9c28a79886ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660357, "uuid": "967323cc-321b-4d81-bdc5-2d14404b8086", "value": "580c09211360ee7846e0635bf223da49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d0b5ec-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692700, "uuid": "ccd3fe56-c8f9-46ca-9472-5f20a0f18958", "comment": "Malware payload", "value": "db852ee87b3995619a2420a5d2a0d1f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692700, "uuid": "707593bf-02f8-4c0d-a658-6c526eac4386", "comment": "Malware payload", "value": "1cea9c48d47a5e5649fa2e54ca39c6723a72920662aa59fde0c11f4b44cdf616", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692700, "uuid": "69b70b9b-2304-4b1b-a518-14bc30ca8777", "comment": "Malware payload", "value": "56455dc2d810730f8014c7840be6e58e36a7720b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692700, "uuid": "7075491f-1f46-4220-9dee-660af8942150", "comment": "Malware payload", "value": "cd937907f2fe7ed0d1b3223c4869fa0289ddadd1808deab9ae590d938ed37d20fd16e4bdddaed1b4315e52c0d2586f2b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692700, "uuid": "1f6c689d-89d6-4ae3-b042-8b5f9e7e05f3", "value": "T17094B5037221D891E15857FA63FA433879B8975438F0CD23EBE4DD62ADB1522971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692700, "uuid": "715d9e79-39da-4114-bc49-779aa3046e1d", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692700, "uuid": "ce1f5bda-ef37-4c60-937f-9bd55ad9a5a8", "value": "6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3Zmt:J1R7gpAwsuvDNP/xyqk09TyCct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692700, "uuid": "53d72cc3-8613-4cd1-8f48-edb3946e5eb2", "value": 448401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692700, "uuid": "5452c796-9cef-4c36-821e-d64246b4e770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692700, "uuid": "f1f63dc9-8f1c-4128-a7a3-af728e6c6c22", "value": "1cea9c48d47a5e5649fa2e54ca39c6723a72920662aa59fde0c11f4b44cdf616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b4ed07-f652-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712654446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654446, "uuid": "677a9fcf-2558-4f65-8eb9-d4d8aa4b303f", "comment": "Malware payload (Adware.Generic)", "value": "c32109970e9a14dcbbba53300a80b201", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654446, "uuid": "0b4acb7c-d322-471c-9f9d-b57664d84f46", "comment": "Malware payload (Adware.Generic)", "value": "1d8ae61e4912f418fcc2df1f10139e6522f57b1e433fa44d3558e9ad301f9f59", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654446, "uuid": "9c08635c-6b62-4855-aa5a-c2fc8fee3745", "comment": "Malware payload (Adware.Generic)", "value": "db145ea95de932a3c76fc8023ecd3e99008726a8", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654446, "uuid": "fb3a1204-fdd8-4bae-bb13-977ce27eb30f", "comment": "Malware payload (Adware.Generic)", "value": "562410ce9673af87dd8db4f4495e8eff0f90bee3b49c80a9bef29c2fa023d594d4387fb1faa59eb4e15d482ec1d1cc5b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654446, "uuid": "f18408c8-29f8-4582-94e3-1e5df9bb54d4", "value": "T1F7072337B228B93EC82906314531E12049BB7F0964574C5EABF42D0DFBBF1513AAEE59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654446, "uuid": "6711c2ce-b458-4bba-b5b1-ea58786372df", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654446, "uuid": "2d8d326b-b7bf-4de9-8d94-6b100eb5f10e", "value": "393216:lZXXbiqFi66n1hv3GS37PauIbo9eGx/9CF2rruHIgGYnqsn:nph6nDvl7ibBa/q2fuISn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654446, "uuid": "c4898a09-6929-4cf3-bc0e-d7973e851f50", "value": 17091792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654446, "uuid": "8f3a653b-7b03-40da-a2d1-9482afd7d2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654446, "uuid": "f5f23074-cb8e-4db1-8291-ea275b21d5e8", "value": "SecuriteInfo.com.Program.Unwanted.5387.8513.16182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2d7e39-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694514, "uuid": "9343381f-8613-4576-9655-6420d6cf6013", "comment": "Malware payload (Gafgyt)", "value": "52a956d2dac1aeffd065342153e476c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694514, "uuid": "c10b1249-06ce-4f55-814a-105a0715e002", "comment": "Malware payload (Gafgyt)", "value": "1d8d5b3328e98439a8ff2e3ea779f2fcd73eb94b9dc32d5630d81f33f85d4ed5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694514, "uuid": "2344547d-1350-4e50-92e4-b0ddf45a2e88", "comment": "Malware payload (Gafgyt)", "value": "23e13c9d6ae3ebd74bd334c20a42f397ab0e3db8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694514, "uuid": "206d3d4b-92e3-4ec9-a952-c4905e589589", "comment": "Malware payload (Gafgyt)", "value": "117ca247ee99a4c511394f2c5f4fc4fd4381b6fd99b0c252f5130a8f012a8c109d4cbf90224232101f21199436323bd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694514, "uuid": "8407fcca-6b83-4376-a2c7-6efb68055b6c", "value": "T1C1E3847E7A11BBBEE268823107F35F708B9921D772A19781E26CD61C0E7528C6D8F750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694514, "uuid": "423a064e-dd05-4193-91bb-d0275c1dfc55", "value": "3072:wvCH/Px9iEEH/Px9iEEYdD+ZUVlvhMLsUnnXF4VAfe8ZsUmk8IFv18KvEnQ:1TVjfKUmk8IFv18KvEnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694514, "uuid": "10ade36c-7a72-4ad0-ab99-fd998847f09c", "value": 143239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694514, "uuid": "7c50d13f-1cb9-46ee-b945-1952cf02d76a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694514, "uuid": "88262893-16e7-4aa7-b776-7b443390fdf3", "value": "52a956d2dac1aeffd065342153e476c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c2a831-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692702, "uuid": "bcb77cec-032b-4a13-86b0-33c1cfa97ac9", "comment": "Malware payload", "value": "f8ac04441b20fbb71ae655a90c0dfb59", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692702, "uuid": "6fabc218-8a36-4e72-aa1e-17a15d889054", "comment": "Malware payload", "value": "1de0733ce63079300fb17768be1d5d26f0c210fe4c206a75c3d1996490451292", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692702, "uuid": "9e38e13b-0512-4b73-812c-a16cee3593e9", "comment": "Malware payload", "value": "078019c0fc9487e8601df88ebcc0f2f4c5af8b1b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692702, "uuid": "ec6490d2-586b-424b-bb4d-fd113834b03f", "comment": "Malware payload", "value": "5645f94782a20e9b21ffaa45d946eed7d5cab92142c653b5303696f08e549e335b28248c81a0f28029d394cd6d338a8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692702, "uuid": "fe619f4f-44e3-4c0c-91a6-707e71f150ac", "value": "T11C94E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692702, "uuid": "3f751bb1-a396-4c7b-b651-e3ed448676f4", "value": "8c1a89a9ecb1531e781195470aa68b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692702, "uuid": "e5c594c9-ffb9-49cd-af5d-e2f7ce646f69", "value": "3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKU6:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692702, "uuid": "0c173fa7-d7c1-4c27-a24a-52343ac28a43", "value": 442070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692702, "uuid": "3270a8b8-34e3-47e6-836e-ab9b39d0c8cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692702, "uuid": "e230ad7d-ed9f-4f25-9b26-3ffd2105ca7d", "value": "1de0733ce63079300fb17768be1d5d26f0c210fe4c206a75c3d1996490451292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d708fbf7-f683-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712675660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675660, "uuid": "d7262a44-2650-4e59-bcc8-29036aa16c6e", "comment": "Malware payload", "value": "15713c41146090f40f3aaad41b8caad6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675660, "uuid": "89b0e4f7-c45e-4156-9a60-a6332a8d3e3a", "comment": "Malware payload", "value": "1de8b971a9da9dcf3c8103699b10632674272d3a23e477b1b20f795fe1bf5bae", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675660, "uuid": "0a6e2838-3edd-46e6-a42b-759dea6da93b", "comment": "Malware payload", "value": "5a8ade9b8cd96d1507f556b21358fc9db77000f8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675660, "uuid": "fe6c20d2-9c1d-4d6c-8d37-75fb7e1522a1", "comment": "Malware payload", "value": "9d057b0d9373a4564312350e66c7043622599a484638e10846d91c3f14c92b7d406c76bb1476e3113e4c619c5a563c61", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675660, "uuid": "26ccaeff-c2a2-487c-877e-ccff65158935", "value": "T16843E108E78ECCF1C650A575044F57783639A2D4CBC0FF4A8A79BCB54BC23A51EAA5C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675660, "uuid": "afd4c3a7-051b-45a3-a84d-9ba47ad3ed4a", "value": "768:ZFnM1dDlT2qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD15ogXnlq5bQ:/mZ2u4OPKIxoEuDKJnlcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712675660, "uuid": "a3a62ca8-0033-41f5-9602-98ae9dc61a9b", "value": 58231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712675660, "uuid": "8ea1f372-6644-4f69-bc45-77ea5fdc381e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675660, "uuid": "eccd0636-d434-4a9e-83fd-f93e15a308f4", "value": "statapril2024-2785.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adead9f-f671-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712667721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667721, "uuid": "4bcb5711-2ca4-4d9e-858a-7b5ed106b2fb", "comment": "Malware payload (AgentTesla)", "value": "e98a7a3c74647ebd74dc1310f5c39b7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667721, "uuid": "226da4fc-987d-4a70-88e6-652706d0333e", "comment": "Malware payload (AgentTesla)", "value": "1df0c341d46eedd47ce75ec705adfa348e67ed09695c36bf575a8e664c015369", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667721, "uuid": "4c010689-51a3-480d-adae-9ebb5c07ca36", "comment": "Malware payload (AgentTesla)", "value": "57cc3d0f249039c6c61ad66c9c6744b6fd0cafd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667721, "uuid": "424cf261-3e66-4209-929a-293b8e2ee8b9", "comment": "Malware payload (AgentTesla)", "value": "d52a2e175c8c32bcd048d5064e557fc2a286bd774cff458f85024d46954fe9d64a0e9afd3aee4bb021c584f05ba95449", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667721, "uuid": "896871ee-0f32-4687-a3f9-9ab618f66610", "value": "T117D4231A46FE03B1DE719233485F089692B952A35C7DFBF4288374998E70F5DA701B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667721, "uuid": "6d7a292e-3297-4fc7-98a0-4d085e19cf9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667721, "uuid": "d77accc0-4d21-4a94-9c62-e8e87a30dd25", "value": "12288:tOJRYWqJtY9JOUoYeYadgdksMRcvog4AeKllLp6AhOSXJDgWMSPWgS16K:tOJb0C/OBYeY0RsMKvog4AeKYAhhtgWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712667721, "uuid": "1331b97e-e73e-4844-88de-41aa038dc549", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712667721, "uuid": "8b74bf01-26a8-49e2-859c-d2fe13b4a9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667721, "uuid": "a78e3e77-6824-45db-86e1-fb09e8714e0f", "value": "1df0c341d46eedd47ce75ec705adfa348e67ed09695c36bf575a8e664c015369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45abfc1d-f65e-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1712659525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659525, "uuid": "107a2dd1-0d2c-43f0-a167-e2c9ba75c032", "comment": "Malware payload (STRRAT)", "value": "693f550992179d007e13d68d24f54c2e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659525, "uuid": "0d8b548e-deed-49fc-b90c-a13059e212cd", "comment": "Malware payload (STRRAT)", "value": "1dfd81ebae1060bb1437f7083e287a74cdc72c5f667b851b6956580d928d8691", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659525, "uuid": "d1a24abc-2fe5-4de3-8543-7f47773cc5b6", "comment": "Malware payload (STRRAT)", "value": "794c4bd6c87f9edcd5f73e9d0f97c2879c2a53ec", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659525, "uuid": "524b593b-4975-49af-be2d-eba277044e8a", "comment": "Malware payload (STRRAT)", "value": "bd20e1206b5a8be1000c4f729ca38d7c439be00a6d3bccf2e0990bd73303a9b6a55edf410d9813b0bb32ec51ea369704", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659525, "uuid": "7162cbb9-4dec-42a2-80e4-add7a3286401", "value": "T14163E1586DE3C03FD573D2B4067A8502FEB4C10CF1CDB68709F564E98A665536A838EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659525, "uuid": "8ed87dd9-1425-4ef7-a77f-a35dc401b150", "value": "1536:OQAvsUq9hJrNB5mtCnZ+N+UAzDCb6ixMvNOeN:OzvG3JrsUn66COimRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712659525, "uuid": "a173756c-1703-4dd9-9555-adc7422dc1d7", "value": 68595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712659525, "uuid": "fec7bdd2-d8be-43d1-bfa8-c4b841348189", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659525, "uuid": "ead66caf-50c2-4cb3-adc6-2f73d2549345", "value": "PEDIDO-DE-COTIZACION.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0ae4b6-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1712669607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "eed07d75-51f3-4532-b4b7-f68724ebc37e", "comment": "Malware payload (SnakeKeylogger)", "value": "0c84a5727488a29d79506aad7b9e8fca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "ef164f74-0ae0-44d0-a81a-e40d3980de35", "comment": "Malware payload (SnakeKeylogger)", "value": "1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "d6572103-5611-47e1-8e10-f3eecee6cec4", "comment": "Malware payload (SnakeKeylogger)", "value": "71bb901c18f2c9cf8514e9bfb9c9462398ad30c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "9e65d253-b056-4308-8d15-3a11a448cc75", "comment": "Malware payload (SnakeKeylogger)", "value": "3ed182e24a482954c435bf7271dd83f719189d37e99042dff35b20e4487c60083854a6ecb1df4ce99c1c1b230bb0f3bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669607, "uuid": "3898ae05-72b9-4e68-a961-36e88a5a8fbf", "value": "T14AC423447BF87726EDF29BB20572590407BB9552B82BE37C4CE1A4D549B2F48C292F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669607, "uuid": "8597e731-b7f2-41df-adcd-276e890bd23b", "value": "12288:1bQNl/WqCYWjgAXty1e6AhQn/rXuoW+sr6RfO12K8Q0:1bmbWjgktYnzvdKcI2K8Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669607, "uuid": "5383980b-8f88-4d3e-b2d0-e5893b6c3bae", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669607, "uuid": "6657c253-9161-426f-96cb-8573d040b82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669607, "uuid": "d76ca29f-26d7-4453-b817-6884bc85d8a2", "value": "1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dec1e98-f69c-11ee-a120-42010a9c002e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1712686060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686060, "uuid": "656249f0-c861-4e41-945c-78d7228c83a5", "comment": "Malware payload (RaccoonStealer)", "value": "616756248d85c819fd0830d660a7aaa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686060, "uuid": "466c5193-4a95-4ad9-a46f-ad1a0c9d3d40", "comment": "Malware payload (RaccoonStealer)", "value": "1e2f5b51b09d3f0060700403f138e33cf4c085dde4fbb469c420e9fd840f04d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686060, "uuid": "1c61d584-4b73-4a05-b7e5-381af0150aa0", "comment": "Malware payload (RaccoonStealer)", "value": "0ead8b67e103d9ec95486781c70c2b35aa9ee287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686060, "uuid": "12f76001-7a2b-4296-acf5-89050bbbc77b", "comment": "Malware payload (RaccoonStealer)", "value": "d11427408d4b5d7054a88430fd2e814be7cf9f17e1326ccc9b064d9af77ae52e2fee910db624aeb68b68349f9968e0be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686060, "uuid": "13d08490-e5a5-4831-94b5-c3f8cc6f0da1", "value": "T1E94623F323390045D0D5CC3AA6277EE572B203668B52BCB85E9BBDC236164E5F216E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686060, "uuid": "78f6baff-a290-4840-8ac5-364d4c3e9a1e", "value": "89c8abd38fd3ffc06ee06d01f9b3cbbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686060, "uuid": "5635dc83-3bb1-4ed0-91a4-ac57cbdfb60a", "value": "98304:g2GmrHOupd2UnxrkWKnuIGQi0iEFZTbKEH/Zh9lkdKnZ7QOjXIEgTH:a1UxrxWuYFFhDYKnOObIEgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712686060, "uuid": "f12a1bef-1d62-4466-9dd4-490dd817acce", "value": 5737472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712686060, "uuid": "58bbf55d-0a59-468a-bc50-0e0fbb158b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686060, "uuid": "3653dcc5-1c5f-45e5-aa1c-b4613a410cc5", "value": "616756248d85c819fd0830d660a7aaa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a49815-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692703, "uuid": "634a66df-51c0-4209-b9bf-49fb361a019b", "comment": "Malware payload", "value": "6baace4646b1cced36cf12dcf19b9cf2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692703, "uuid": "c7697756-d950-4e9c-93b9-b562a0c1a384", "comment": "Malware payload", "value": "1e50d56bc3ce28c1739a8e4941bc53d5bf002c82c04c49c1ca94945fb81e6b6a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692703, "uuid": "d8a668c8-76bd-471d-b7a2-396f031f977c", "comment": "Malware payload", "value": "7f389ea306927abf6ce53db7c8bce47aee613f1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692703, "uuid": "74f3866a-8948-4d1b-91c5-1d131be430b6", "comment": "Malware payload", "value": "043a1da513f1f89fccf473c9493708c8a0aa1652e7c84c249ff38dda78e31f1134fedadf27c8b5395407c7fb66ec518c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692703, "uuid": "ff334740-7764-4bfd-b7aa-9f13a9f6b2f5", "value": "T13C84B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692703, "uuid": "9e01d85f-d3cd-47bd-bd8f-6563ff93550f", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692703, "uuid": "84e60492-abb6-4142-b73a-620f2c69e6bd", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1o:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692703, "uuid": "667d8014-0c76-4fed-89f4-7f0a760d159f", "value": 375521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692703, "uuid": "da3c25e5-7335-41dd-a4da-6064dca498e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692703, "uuid": "d9c23f2d-c4c1-4133-b8ae-3f74f7897001", "value": "1e50d56bc3ce28c1739a8e4941bc53d5bf002c82c04c49c1ca94945fb81e6b6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9a712e-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678005, "uuid": "da93d81d-b352-4c66-8665-6d3f36ac86af", "comment": "Malware payload (Mirai)", "value": "51f84c1623a607d51697cfad053b4579", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678005, "uuid": "b0216436-26fc-4f8a-8379-809eea13b530", "comment": "Malware payload (Mirai)", "value": "1e64f8d5437a8c62627a1eb077e5ecc690a41917735467c28f7357919ff04b9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678005, "uuid": "fee0a4db-a753-4f80-a561-627d7688e027", "comment": "Malware payload (Mirai)", "value": "c4cc1d90370796707e02d6ee1b0b06b84d138038", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678005, "uuid": "d222a746-5666-4ea0-96dd-c52b3186b332", "comment": "Malware payload (Mirai)", "value": "e0ce935d6707663c87ce5cdef6e280a4f34bf2f6334dad8dcb56b623a850e9466617e2aaf1718deaf5ff471b3f0fe182", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678005, "uuid": "5339fc79-b4b1-48d3-bf96-365edd07bf46", "value": "T1B9832A46FD818A15C5C813BBBA2E118D33126368E2DFB217DD156F2077CA62F0EB7961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678005, "uuid": "527f0672-5f80-4f39-95d4-f00d6d916112", "value": "1536:v4nGWRGQB8JZWddFABsCPjhh7j4quEwU8bOZRzqi1+wXKblzyMIsiJ5eZd7:VWRzddksgjh9UJrhbOX2iQAf5eZd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678005, "uuid": "a3cec6ea-9ebb-401e-93d6-05f7e972eeb4", "value": 88072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678005, "uuid": "76a69100-0dc0-49b2-8dc9-30efbc97a96d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678005, "uuid": "85b95f0b-5f9e-4f36-b5e6-f3546775477c", "value": "51f84c1623a607d51697cfad053b4579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b340714c-f6a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712688485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688485, "uuid": "58fb71fa-0cff-4962-a8cd-19b37b1f239b", "comment": "Malware payload", "value": "5e982df4003b4d507f4e6438a2998814", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688485, "uuid": "c03b5a21-bd6f-452d-a542-00a05a497642", "comment": "Malware payload", "value": "1e6f2803f1bb5cd5435e7ab6a5b1e75694bdfa64003c92b9169697c0b5335476", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688485, "uuid": "20573582-ff58-457d-ac12-19efe1364598", "comment": "Malware payload", "value": "ad4dfe8c9544a2781bf73f020782e715692baa61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688485, "uuid": "9f54d5c0-3e15-47c1-96f2-cddd96ab9ce1", "comment": "Malware payload", "value": "b4928d54f1bf97367ce329a3d71af24c31529a5ef9ffff03d627f4eabdb49da54442979a23aa0f3ebf3055016b6f49c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688485, "uuid": "fd750854-23d1-49b9-b8a2-a0438a44e97d", "value": "T18775339454F26139F64378BCEB87423441EF17894DAAFC9110A22D0CC4AF2FE56FA5E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688485, "uuid": "62411a4a-7191-4186-a020-b6ce8e7a1675", "value": "24576:zBnvUQDOcAhz6FblxWpMVa5CU23N9ANE7+AI7Ckw9JymZuPH9M0vwH+v:1nE5clxWpvCPAuaNLw9JruPHLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712688485, "uuid": "31c4b5f2-7598-4477-8a68-64873a6ba714", "value": 1699040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712688485, "uuid": "d8f48d5d-2ea4-42a6-a91a-194da239469c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688485, "uuid": "f2b8ee66-2c15-47c5-96b5-2271ed9764dc", "value": "SecuriteInfo.com.ELF.Agent-CRR.30775.3601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869340b8-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692705, "uuid": "8cc83f83-1382-45a8-a71b-235c80d516e9", "comment": "Malware payload", "value": "64a4747f3d49f6f39e5cb124851f657b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692705, "uuid": "46c6e690-cbba-43c6-877b-16c7b5a40cbe", "comment": "Malware payload", "value": "1e75a9d6cbc768344ddf4816636364e3fbd6c02d59e464e99b63b0ff611e3efb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692705, "uuid": "1dcbaa85-e245-4891-9f55-a79cf458f33a", "comment": "Malware payload", "value": "07a28dc7c808497ab114a649cdfbd8f2c163dc48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692705, "uuid": "94bbc88d-24c3-4664-9e01-3625634f1ea4", "comment": "Malware payload", "value": "2ef61daac61ade1f79fc38a1614bee07dbc561042be8911a1c234f1c9ef7ecc7e5b1947028dfc8bf36c5ecbc77f79539", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692705, "uuid": "b293fbb5-386d-42fd-ba70-35081f45fe0e", "value": "T1E9A4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692705, "uuid": "b25a6a1a-c341-4f23-a92b-b21b8de7c837", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692705, "uuid": "283d025c-c2f4-4c77-831f-1e0bd8c25600", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhub/:sZ++qlRBBOxQDU2XWIg6Bi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692705, "uuid": "37b7292e-b84c-4eff-9390-693f67c74c86", "value": 458349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692705, "uuid": "34a2e0e0-3d2e-4f45-b942-d9be723f0218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692705, "uuid": "3a542d76-2003-42d6-9477-fa7dc4a97d9b", "value": "1e75a9d6cbc768344ddf4816636364e3fbd6c02d59e464e99b63b0ff611e3efb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87973bdc-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Dinwod)", "timestamp": 1712692706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692706, "uuid": "03174cee-cf93-4d44-99bf-26bc54bfb15f", "comment": "Malware payload (Dinwod)", "value": "0eec075b66c8ccc27dd977813a42b330", "object_relation": "md5", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692706, "uuid": "069d5bbf-c0b0-4881-ac0b-4ab339a752d7", "comment": "Malware payload (Dinwod)", "value": "1ed4fc5a162ef0baea1837e9a8633513ae13b7e4832c8c9c4b9690ba485247a0", "object_relation": "sha256", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692706, "uuid": "1605eddb-ee33-4676-9fb8-3887815eddad", "comment": "Malware payload (Dinwod)", "value": "65409b7370c1ed8bece3181cd7d0f961997f4df9", "object_relation": "sha1", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692706, "uuid": "28a35ccc-9aa2-4d19-ba36-a4835562b5ba", "comment": "Malware payload (Dinwod)", "value": "cbf4153dc91b45454fd21f2a5d4bd0b7143997d21307caa13fa5244677ebea9db7360964274bf31897f700ef0c47fc7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692706, "uuid": "c650a18c-d85a-4e25-a669-b4660d5bbac3", "value": "T1F1E3F822E51388F6E02E05F557F2073C9979876368B24A6FCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692706, "uuid": "86c26b05-41f7-420f-83c4-14d498d7be06", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692706, "uuid": "89e0993a-9036-4b0c-831c-f9bd1bdc69d1", "value": "1536:rj+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy8x:PqSe5OmiEoAcCbZ6FNoutx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692706, "uuid": "94d96372-d918-4739-b4d2-2057aab02e72", "value": 156893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692706, "uuid": "b1fe0345-f71a-4989-9066-c8c512a14035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692706, "uuid": "231fd57d-2cde-4384-ac64-d98f47c59ea5", "value": "1ed4fc5a162ef0baea1837e9a8633513ae13b7e4832c8c9c4b9690ba485247a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2226fc-f611-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712626523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626523, "uuid": "ec1a80e6-bb01-494b-bbc4-d5e8f53f8844", "comment": "Malware payload (Socks5Systemz)", "value": "f9827a2a48b356c781478142c39eb801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626523, "uuid": "858f950a-95b8-4468-bf88-ae29994cfbb0", "comment": "Malware payload (Socks5Systemz)", "value": "208f0af12ef5b3bc47e552804e7cf255b56044b025c88ffc2f6bba4cd3576362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626523, "uuid": "9b092d7e-8415-4851-8f8f-0d79e30ba1e2", "comment": "Malware payload (Socks5Systemz)", "value": "e1dc04c6bdf462bb447fe3e6baa24da0ed17e4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626523, "uuid": "b4eaf28d-686c-420a-b996-8a3f1bee16e2", "comment": "Malware payload (Socks5Systemz)", "value": "4aba67a3d2df6ec45d9562e69e7deaad45e876c60df0c12b4619afac3e97d0536905517d24835d5795f4c83b3d1798c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626523, "uuid": "97c63a83-6dba-4a5b-811f-8a507af6dcf1", "value": "T10C16336362CDDDF7D81282B27B5F0A4A55B677F0583D3D46AEA6180FED713D082AE210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626523, "uuid": "5f9f0b2c-bf62-45de-bba3-8d0b23caa856", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626523, "uuid": "6e56259d-08c4-4d34-b419-6ec3b2cc32d3", "value": "98304:CJTUys6Td39W9YzUh+u6Q4fsYznYblaEF2fHQQxE:ggowGzUh+XQ4DSEPfwQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712626523, "uuid": "8a2bd441-f249-46a6-bd2b-9d853cb14b0e", "value": 4215568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712626523, "uuid": "bef01b2d-ac71-4161-9c3f-77fb7fcb5b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626523, "uuid": "452b02b7-5e69-4b29-8565-f3a3a2c23498", "value": "f9827a2a48b356c781478142c39eb801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fde5a4e-f652-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712654415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654415, "uuid": "42eff582-cc62-4ff6-a706-28d65851b042", "comment": "Malware payload", "value": "9da13f259aa7b55499b93b9249fdc6d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654415, "uuid": "4d7ab457-072c-4806-b4e5-72c752188f30", "comment": "Malware payload", "value": "20cf7da861dc106f368d4042a7d5a406ddb6040f11bc41df66442b81b16f3bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654415, "uuid": "90d2a58a-0df1-448e-a3c3-9c7fb39beae6", "comment": "Malware payload", "value": "c9f797b14e7b2b11b8412a8b59f4ec52635f9f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654415, "uuid": "0febe740-fd81-412b-8500-7a1d7a8beffe", "comment": "Malware payload", "value": "2fdfe3788df182a00ca3baa9df350aeda39b306b20a7044790b55571a8acba9c933ce518bd8f91cf05a135c243402a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654415, "uuid": "9696de0a-59f3-48f2-b343-0fc6a57c9217", "value": "T1EB2509106BE84A2BC9EE67F9D0F5DF388BF4D8416116DB8B56905CFA3C6234C6C4235A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654415, "uuid": "4d5d2b08-2810-4465-b52e-eeda71c78aa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654415, "uuid": "d7119607-3918-4dde-8870-ccb9164287c9", "value": "6144:KhZc5SuIrRf85NglIey+UC2TPK9KqOLY3+cmrUVrpfD9MV3XDrHsaqOXOrLolqqk:JbL7uKLzWIzavLoaYIo1Od4wpPdJb2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654415, "uuid": "fe4ee717-6daa-48f9-aacb-31921caa2b99", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654415, "uuid": "d420245d-fa27-4751-9433-5f2c3840b4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654415, "uuid": "a05012e2-3ddd-4307-9afa-e2ce0938bc93", "value": "SecuriteInfo.com.Malware-Cryptor.MSIL.AgentTesla.Heur.24636.29819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ebb75c-f681-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712674687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674687, "uuid": "683c2764-dbbb-43cb-8fab-ab9620f1505c", "comment": "Malware payload", "value": "b225cf84d75dddbce90eef153ebe0dc2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674687, "uuid": "d774811b-c2b7-44d7-acdc-5a1b97918cd1", "comment": "Malware payload", "value": "20fa67ad5f9f35796bd48b6aa9ac51968201919ff8c933d770813d8c5d79a098", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674687, "uuid": "878861a0-b468-4ece-bf51-ddced514479f", "comment": "Malware payload", "value": "2a8eea331567ec9845c54b7bde9acf37aaeed32d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674687, "uuid": "0cfc380a-c271-4596-b1b4-0ff9ff014ddc", "comment": "Malware payload", "value": "25f02e9c83ed92eb8112a7f20341b859b50a8d9751a579c3106c7c8238d315f11af9d6c4ba82bcaaa7a4591dcafd0b3e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674687, "uuid": "ecf24eb8-29c4-474a-b6a7-244fc0bde668", "value": "T1AC766B03F89591A9C6EAD130C671D292BA317C494B2037D33F50FBBA2A76BC46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674687, "uuid": "764504a7-9a3a-4e14-9620-f8ca890059d6", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674687, "uuid": "11254c96-1cb0-460d-972d-3a8791e3af97", "value": "98304:h3HO4RxIqXExM5+Jis5IIdQUupySRoM0xkQA:BHlrIfaxs5IOQRBoM0xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674687, "uuid": "019885f1-5c26-4e7a-a350-ae0110a211d7", "value": 7218688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674687, "uuid": "6759f118-680d-422a-a5c4-76acc97cbcfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674687, "uuid": "9b4bba57-0758-44de-b4ba-7e03732b6961", "value": "b225cf84d75dddbce90eef153ebe0dc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a604c-f68b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712679145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679145, "uuid": "146b6d89-03c8-4c34-ba64-ad4541725c73", "comment": "Malware payload (Mirai)", "value": "3b821f40bfdbd556588c00332d6b6f56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679145, "uuid": "d381b955-c820-40bc-a54f-a8a953e28326", "comment": "Malware payload (Mirai)", "value": "216d96fc1155ee83bb36e979ca6f7369740dfb323fab1f509aa70121deb9c9b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679145, "uuid": "aecf708b-f9cd-4fe7-8805-32da368c170f", "comment": "Malware payload (Mirai)", "value": "252ce011859ef2c58ddaf09ce427d54889644b23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679145, "uuid": "77ee59a2-2f5e-4d4d-9410-1b892d811b71", "comment": "Malware payload (Mirai)", "value": "f04c3a33294d90f370a9ecf752891f94cb0b255ce54348a4398e6d7034ca04e4a63d0f4b4eb108f96a4d8d8f2b763985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679145, "uuid": "ba9c9a13-6196-4c2b-8a49-1835fa42d1b3", "value": "T1314318957C829A27C6E8137AF56E028D336527A8E1DF3227CE232F11B7C591F0CA7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679145, "uuid": "9d0d44b8-aeb4-499b-84de-42005cea90f4", "value": "1536:+8fTuV2Xljs2f1y11LC0hBr6fHNJ2QfaAQ:+8ru5hqr24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712679145, "uuid": "2ec97b77-679d-4a95-bfb0-6734aab9abce", "value": 57056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712679145, "uuid": "b1df14e4-b5bc-486f-8c65-d77c02c5b0f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679145, "uuid": "c8aba229-7e9b-4a2d-82e1-cb13a6195163", "value": "3b821f40bfdbd556588c00332d6b6f56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8899dd92-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692708, "uuid": "4f0d8659-8ac8-4fec-8e7b-3d2961a9a5a4", "comment": "Malware payload", "value": "c1eab7851c1c7366255815ac53251a7c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692708, "uuid": "6480ea5f-48d2-44c0-aab6-a2a91748bade", "comment": "Malware payload", "value": "21e63c77da961213ac1eac686d5fa5f697c3a9fc48dceac7f5eab6385a5f6f1a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692708, "uuid": "831e18f5-deec-410e-8a76-bd3ff564274b", "comment": "Malware payload", "value": "6e2771ea7d6ef2af3f5e58bad41adba9a0e42130", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692708, "uuid": "784a2943-be11-4b09-8d20-8a0eb246d30d", "comment": "Malware payload", "value": "55d87d5fc6b8d1f36990ad4dbdcb2160908f30d7dbb4b5d1512ecc9a3c13c1c466c5b645ad5c7b1a6d94616162365b02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692708, "uuid": "bc303c7e-921e-4646-a274-7cb44beef171", "value": "T12AB4C813B522E495E11457F66BFA073869B8836438B1CD13EFE4CDB2BDB15318B1A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692708, "uuid": "ad475142-41ac-465e-a9d4-0fd185ab79ec", "value": "da4a387004bf1285d93edaa4d5233098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692708, "uuid": "8c84cbc9-d3cb-4546-afc2-fabe67e4078f", "value": "6144:0wGdR+Yk/N8duBmG6t+UnRsRCQ/OJBr7VCnv:0woR+Y4NSG6oUnRsdOJBr7VMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692708, "uuid": "70592edc-8878-43d1-afbf-67dac52afa2c", "value": 531067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692708, "uuid": "5c190281-198e-47d4-a65f-890376072fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692708, "uuid": "edf3d6f5-5ffd-447b-ad54-15e36b73f985", "value": "21e63c77da961213ac1eac686d5fa5f697c3a9fc48dceac7f5eab6385a5f6f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89906a9d-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692710, "uuid": "d344e6a8-8cb2-40bc-a079-a7f4f352bf92", "comment": "Malware payload", "value": "478526e2edc1a8a0982205dcfd9dc9e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692710, "uuid": "c51a0d80-359a-487c-ab0f-9c0f1be8d4d1", "comment": "Malware payload", "value": "23c5b5212da4ccd4d316807947f10725fe8f445e8e9aff17d6d6445d898250e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692710, "uuid": "281713ea-0274-4ecd-adba-5076a9ec0924", "comment": "Malware payload", "value": "be695b28fd837c7ecf45a80b9bdbc513f316f4e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692710, "uuid": "a7d396e1-42d8-487e-88e9-fc69870c3ad7", "comment": "Malware payload", "value": "2939e47cc810cd1f0451eac42cc6915e0dc5336c27a62a781a69f0c4efb16b873ec8824aa466be13e87a08bd3cb307b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692710, "uuid": "d2cd7752-8613-494c-a26c-3d1baf2e0b0d", "value": "T156A4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692710, "uuid": "3a17e05b-23db-48f3-a05a-9271947309cb", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692710, "uuid": "b698dc6f-1d8b-4895-ae6b-4604adf7ecce", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubV:sZ++qlRBBOxQDU2XWIg6BiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692710, "uuid": "08cef1cd-ada4-4e20-ae52-b217dc000963", "value": 458358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692710, "uuid": "62b5ee73-e0b7-4df8-9c7c-0444ec4e0215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692710, "uuid": "ef246cb1-ecd4-4a30-891f-7cd17cfb6c7b", "value": "23c5b5212da4ccd4d316807947f10725fe8f445e8e9aff17d6d6445d898250e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e0b6dd-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692754, "uuid": "af514ef2-f060-45d5-bed7-d6c009d8b586", "comment": "Malware payload", "value": "76f6d39da561119f503eddb7c66c3589", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692754, "uuid": "d35999bd-a977-4feb-bbdd-e4b8d27a9477", "comment": "Malware payload", "value": "24586ac4f57202dccc696c32690e190a50bce05df5969501a15fbaef897bcfb5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692754, "uuid": "7dc9cb42-1375-403c-979f-b16ffcd3b2dd", "comment": "Malware payload", "value": "5f889628a2a05005887a314ba7f54a86719daf97", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692754, "uuid": "ee5f2207-353f-40a1-af6d-df360366b4c0", "comment": "Malware payload", "value": "a363d87d102f7a9d16bd18808e909e8b6d6faa50a78dc035a3d5b283d5ddbe0519ce8be0ffbb4155d1512eb91764ea92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692754, "uuid": "45005b62-acf2-493d-964c-5e3c61fdb80a", "value": "T1D1C7E002B7A5C562C1A503399DE7C3793370EE448F169B8772C4BF6F3DB23919A56288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692754, "uuid": "956a05ba-8336-4c8f-b214-f33841bacd9b", "value": "bd687ccbdc02b7fe2770bae807276656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692754, "uuid": "ac6d6ec8-9191-4f24-b5ad-0b4a6bacc385", "value": "786432:vHViNP705yX+1JdLhLyH8e85KBe1NI0RgWXx7:vuP4jFOch5KBe1XRDXx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692754, "uuid": "1f5145a5-0163-4adf-881f-74f25bbb4062", "value": 53018624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692754, "uuid": "95921ac6-8e33-4ac3-b1e3-cac6261098f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692754, "uuid": "5d9d674d-c271-402b-ac25-f8f90f1a308f", "value": "24586ac4f57202dccc696c32690e190a50bce05df5969501a15fbaef897bcfb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a94a79-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Dinwod)", "timestamp": 1712692755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692755, "uuid": "a44fc80c-be34-4df9-83a0-336298bbd318", "comment": "Malware payload (Dinwod)", "value": "14ac78f59fd00e54b985c17565c9d91f", "object_relation": "md5", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692755, "uuid": "9390c4e3-2561-4f56-b3dd-04a1d8ea7c90", "comment": "Malware payload (Dinwod)", "value": "24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5", "object_relation": "sha256", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692755, "uuid": "d93d4569-168e-4b7d-b73f-4aed86059cd1", "comment": "Malware payload (Dinwod)", "value": "f8707c0d5edeb8276495ae61b619fb47320b7176", "object_relation": "sha1", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692755, "uuid": "b0d1855d-7305-47e5-bfa5-5421f68613f1", "comment": "Malware payload (Dinwod)", "value": "d5b40ce41683a1b9d7b29e3f74919820d7660d522cfce68c8efe39a8424fdf9ade0f320b972afd6ec56f488c9119b6df", "object_relation": "sha3-384", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692755, "uuid": "daf7d0b1-4f89-4a47-83e5-95730e20f3cb", "value": "T108D3E722E51288F6F02D06F557F2073C9978876368B25A6FCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692755, "uuid": "26e2c444-f53f-49a8-b8c1-5ce6151680fb", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692755, "uuid": "31a6dcec-9b83-4b43-99cb-56fb49ee3265", "value": "1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkY:OqSe5OmiEoAcCbZ6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692755, "uuid": "4f409550-a848-4960-9852-2abe2c97d693", "value": 139916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692755, "uuid": "f05fa245-329c-4203-aa1b-cc5d2733354f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692755, "uuid": "6570784f-933b-4add-a7f7-0e8fa472c860", "value": "24cec2bd1249842ed7d8e45566b2e9eae9fc7aca3ee976823564f45691148fb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7d902a-f688-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712677464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677464, "uuid": "efb0d00f-25c8-4797-94e8-1d1771f4f4fc", "comment": "Malware payload (Gafgyt)", "value": "8cc4e7f4f48f3d7281c9b85e3b251eda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677464, "uuid": "13134fbf-78ff-42f4-b609-bcef8cf4ce65", "comment": "Malware payload (Gafgyt)", "value": "258e96bd73be2ceb5d0aaf94ea1d055a64a49cd510982ec3e24639e0d4194728", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677464, "uuid": "704d43e6-31ff-455a-88ba-a000dd47a5d2", "comment": "Malware payload (Gafgyt)", "value": "5c5c2421a8e6f0084a6e6014f157002c0b399cd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677464, "uuid": "9b7260d7-8451-4d1c-98b8-b7a50b1460d5", "comment": "Malware payload (Gafgyt)", "value": "2deecc9599ad9f83af31f663c6082eee9bcc046edb4398889ba4ecc320ec00fffbbe02098f9b858f8424bba5d65d451e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677464, "uuid": "da1c9c44-3b4c-41b0-839e-9e3d5146f572", "value": "T1D0C319F9E30BC6F3C40316F2125BEAA70D21B1B7166AA985E7282D70EF734C62555F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677464, "uuid": "74c49b43-9e19-476f-9b88-d6045539006d", "value": "3072:EWpbc37+Qp2nrkGJc/s5h1Y7rCmJC0OzQaGyPZk:E9Lyc/s5h1XmJC0OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677464, "uuid": "86a2461a-2694-4cff-aebc-c63197b6960e", "value": 127460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677464, "uuid": "0d3c7cba-3939-4c4b-b638-64b89fb6a1ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677464, "uuid": "893be0c7-6a01-4409-a764-09e1fe5402e4", "value": "8cc4e7f4f48f3d7281c9b85e3b251eda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352e4635-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712674100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674100, "uuid": "fd8fb0b0-6b57-4d2d-aa5e-53b016ced11d", "comment": "Malware payload (PureLogStealer)", "value": "784a4becd91c6f3119c961d339e69d4e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674100, "uuid": "625fc0c4-bc6a-4a9d-ab40-f0a4ac28b4b6", "comment": "Malware payload (PureLogStealer)", "value": "259147e10d381eff4d6ac4f4dd50552a7e75164814747a2cd52ab4294a726cb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674100, "uuid": "7d300ad4-9f90-47cf-8a87-0e39648bc64a", "comment": "Malware payload (PureLogStealer)", "value": "51e0e84eb95ba5b62a1c0c4975734ca58cd45c4d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674100, "uuid": "ff6561b8-0c3c-4ca4-bb6c-9aa8ce7619da", "comment": "Malware payload (PureLogStealer)", "value": "aaa5753ab9c45089f2a80992e359aed8d995063c3146435510b6e0c3a3d391093ca46fefdefe4eeb81ee607f408aa51c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674100, "uuid": "659a9f78-5353-47c4-be77-af24bb21b96d", "value": "T1E7A5D5DE38FFDCA4134E275049B36CACF979CBEB25810453C32BAB715A306855E1768A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674100, "uuid": "9e461176-6dba-4ddd-8c8d-cf115987e7a0", "value": "768:Ye96aij8DLT9FzmNPlYOTFknIRKUcN1H88EIfi6iSUMS6v4:YeQaV/9FzmNPl9TKI05h82a6D2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674100, "uuid": "0c9dc550-71d6-4133-8e0b-787a2dcf8336", "value": 2114140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674100, "uuid": "2189c3d6-f634-4d06-af01-2ea79bc7ed93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674100, "uuid": "389f800b-91c7-49ad-9bcc-a92551172b9e", "value": "2023 Univ of St Augustine W-2.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7471baf-f607-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712622322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622322, "uuid": "3ef87ddf-732c-48f7-a651-3830c2f7ca1c", "comment": "Malware payload (Socks5Systemz)", "value": "4506acced1699d2a47092bbee0d5e9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622322, "uuid": "f3eabc3f-64ac-4ae7-957a-291f74fb86a6", "comment": "Malware payload (Socks5Systemz)", "value": "276b94ddf860ae055c5bc445f7c99e714229cf2cb5ceded9fe2b41849e72064e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622322, "uuid": "7b8e8f42-a6a4-4735-8a74-33c82075dacd", "comment": "Malware payload (Socks5Systemz)", "value": "fe5483a89f3ff2017b2c9ae3b74c4d96afb0c83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712622322, "uuid": "957c2666-0c88-4c1f-9034-792759489b19", "comment": "Malware payload (Socks5Systemz)", "value": "d6313ae0a00f4b80e24c06496133c8040d3036df78aebbf3c14dd5f62c801d2de40830493de81e6a9aead11174c52ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622322, "uuid": "2e721aa5-2063-46d8-a4b8-d3739362c3d3", "value": "T16C163323D3E9D5B5FD9AAD70998942C04A2B2D587C3AF11C35CE5AF9EE035E20C4E385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622322, "uuid": "88bcce45-766b-4838-a3c2-5224b35aea84", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622322, "uuid": "dd0c056c-1a54-4da1-9aac-93038896827e", "value": "98304:CTcWAVd1Mjd8ey1Qjc62JyNw29nVbLdKwiSTjAylMrYwmQxE:AcWALejHc7kNvBE9SnAhYwmQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712622322, "uuid": "45dd35e0-b50a-45d5-a0e3-bda567221ec5", "value": 4251638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712622322, "uuid": "f182c15d-868e-49e4-a9ee-e2f3074fb53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712622322, "uuid": "1bcb938b-9fb0-4124-8de3-1c9ef5eaedc8", "value": "4506acced1699d2a47092bbee0d5e9c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a662ec-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692757, "uuid": "9beb2234-9f81-4881-bc7a-04e109496a38", "comment": "Malware payload", "value": "fe754b58fbb3529fedadbed8e1d819db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692757, "uuid": "71badaf2-a271-42bb-992c-26a770e24098", "comment": "Malware payload", "value": "279da87c8bdd90e4d11232a47de1ea3661781a910847cd7180425a3f7917279b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692757, "uuid": "26affbf7-fdf2-454b-bd5a-6b43cec1e076", "comment": "Malware payload", "value": "3359e6ca5d753da61922a7a760ecdc7cfb17f77f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692757, "uuid": "576baa8b-ded5-4ca5-8104-53bdb1096543", "comment": "Malware payload", "value": "4c7dfc3ab2e40ec58897746ccd09ad19fb81784c76b9966ac85bd3482b6beb7005215dac60593cb63cadedae83947642", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692757, "uuid": "3daab53b-7cba-4672-b12b-a5f23a744ff2", "value": "T1C5B4EA13B6229495E1145BF66BBA073869B8836038B1CD13EFF0CEB2BD71531975E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692757, "uuid": "e9e2d023-8af1-4395-9863-2232eb7ade8c", "value": "3bb3093a5eeb1047bbdd41c02a894dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692757, "uuid": "e964169d-8d9d-4d6c-909e-1df13a5c9b7f", "value": "6144:n0m2FqgDAuSbAXKfz0c0sUIJHtH/yWmCq:nZ2FBqA0z0cIeHtH/yWmCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692757, "uuid": "942783da-9d37-4644-ba04-924b19cd31ad", "value": 531208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692757, "uuid": "4af410ad-05c6-478d-9e5a-52c7b8ed0a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692757, "uuid": "e2fa8dc4-dd61-4cfb-bd9a-05f7fe5fe8c9", "value": "279da87c8bdd90e4d11232a47de1ea3661781a910847cd7180425a3f7917279b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ce8964-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692759, "uuid": "d0f8005c-ae91-4955-a3d1-56577fe38a53", "comment": "Malware payload", "value": "b38e675d964c33b6e4c8a401c699f522", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692759, "uuid": "8b129000-a27c-4935-a512-a7f8805fcf3a", "comment": "Malware payload", "value": "27a472f753654a1fff9f4762cf30adca5a691bc2fa864b66be2ecbe4d52258d8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692759, "uuid": "78e31d15-4568-41ff-9fe2-532ec4685740", "comment": "Malware payload", "value": "3ca02957815a719eaf386ceefc6dec49e1413775", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692759, "uuid": "532ddd39-a07f-4283-a2fa-1ed775d8a047", "comment": "Malware payload", "value": "a3a51f27246f6a3db222feab0a9d2b37b5f29fce5cb6e0b15d878916027df015d72016023efe2321b55bcfe4fef7945a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692759, "uuid": "4d636ec8-eb6f-4113-b73e-098eb8bde9cc", "value": "T1B6B4D913B6229495E1145BF66BBA073869B8836038B1CE13EFF0CDB2BD71531975E60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692759, "uuid": "b24591dc-6efb-48bf-9b4a-04e0e1b70587", "value": "3072:Y0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYKjH/yjUuMx8XBpFmhc:Y0m2FqgDAuSbAXKfz0c0sUIJHyH/yWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692759, "uuid": "d74bde18-1d9c-42b4-b465-64cdfef51416", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692759, "uuid": "13164c31-4011-465c-8194-8de6a89efb09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692759, "uuid": "6e2e0d87-61d6-4f2d-a01d-2af63021e843", "value": "27a472f753654a1fff9f4762cf30adca5a691bc2fa864b66be2ecbe4d52258d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bc23d3-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692760, "uuid": "6766fb64-7fe0-41ba-9aba-d7fa95394e14", "comment": "Malware payload (Blackmoon)", "value": "9885c64277d9fbb907a0bc243d7dbfa5", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692760, "uuid": "be5475c7-a6fd-4b85-837c-18acada3ba3e", "comment": "Malware payload (Blackmoon)", "value": "27a8f7e5dc0ad2c55d13f9d327723c4c9bfb7bd6ccc9f9b3d9211b7b8cc3dc98", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692760, "uuid": "339462ae-ff0c-439f-893d-ec4daa2d604f", "comment": "Malware payload (Blackmoon)", "value": "35e40b71d509acceb3f6a74dd945ff86b714a15e", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692760, "uuid": "a54c3277-9191-4a64-9ca4-6536aae885f4", "comment": "Malware payload (Blackmoon)", "value": "30075472c9d9e027ecb0a9913c4d88520d53d481fc188d5eac7a9dd1a3ee30d4846c014dfed58d3b70400070d024fda0", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692760, "uuid": "d3ce779c-306e-4096-afca-90a1f5e2c5c0", "value": "T15194960373219492E15857FAA3BA433879B8875068F1CD23FFE4DDB2AC71562971BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692760, "uuid": "52c3d1b7-d178-46c0-af27-bb80eff98fb7", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692760, "uuid": "e679d84f-7aaf-41b3-ad38-e63635a755c9", "value": "6144:K5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zIydenCV:K5/Q58drihGiLhmGNiZsx0B/zIkenCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692760, "uuid": "1fdee5cd-baf3-440e-9d77-9b3711ce1d96", "value": 431988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692760, "uuid": "13279bc3-56ca-4db5-9916-63e910e45f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692760, "uuid": "da61212d-f5bc-4345-a147-9b8c2a07823b", "value": "27a8f7e5dc0ad2c55d13f9d327723c4c9bfb7bd6ccc9f9b3d9211b7b8cc3dc98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdf42bf-f674-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712669232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669232, "uuid": "c3578f4b-7e0d-4c4f-8768-1eeb164d481f", "comment": "Malware payload (CoinMiner)", "value": "e780a43a47bc158e50d5d297ce86fb4c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669232, "uuid": "e417031b-a5f1-4252-b460-2986c5273614", "comment": "Malware payload (CoinMiner)", "value": "28aee341d6eaa4b5af40bf71aac69aa7411a8f7c58f488479270f0cfc7ef4416", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669232, "uuid": "9adb3e0e-16b9-4d14-8274-d1843479c581", "comment": "Malware payload (CoinMiner)", "value": "31e7f3cd7f1c970e3f7bd91ce0c53048c220c4a7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669232, "uuid": "ebd18ef0-522c-43cb-b3ce-9fad2d5edd66", "comment": "Malware payload (CoinMiner)", "value": "df4b211d9c95379e1c886f98afe04a55ffea409035d4f800aab5c36826dfe33fdbd5b3ba779e3435e68f9437374349cb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669232, "uuid": "060e1ef4-2b9e-4e4a-aae4-fa655eed4dd6", "value": "T1D9765D41BE816F3AC1DC133446FDA29662607E494BD50B2313A8EBB93D7773DAF16488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669232, "uuid": "c5d5c2d9-5419-4569-8277-6eefa39f9c66", "value": "196608:OnZleulksll02zlBwUllqsLb8YG53ox+tFH7Zll:4X8YZQ7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669232, "uuid": "45428fe3-951d-46d1-8584-0b161b7c6ab1", "value": 7334110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669232, "uuid": "ef805f75-ea8a-41f1-9324-d818b51fe7df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669232, "uuid": "7f9da3d3-7545-4f60-9e95-c3374d81b29a", "value": "e780a43a47bc158e50d5d297ce86fb4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aae131e-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712669921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669921, "uuid": "005f15f6-a1e0-4f98-89f4-37e894730261", "comment": "Malware payload (Kaiji)", "value": "c4c4626d5d6f5cb41de046347f3d08f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669921, "uuid": "bcc35f12-ac22-485d-a6db-a5aeedefba3b", "comment": "Malware payload (Kaiji)", "value": "2948bd47835b5ffad7b9c9c13863e998c8117f0e2dd8df9a695147ef57671e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669921, "uuid": "1fdf5419-ae17-4d11-b151-1d695ed90f4c", "comment": "Malware payload (Kaiji)", "value": "e2513924fe90a6283a41b82dc61166a740f2619e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669921, "uuid": "b1bdfdb7-89cb-44a3-8c87-6da201976991", "comment": "Malware payload (Kaiji)", "value": "61ee087c9a0f45aef93483c473fd211cc078934a7dcf67eb3125a51d407fc1cc015ebb17c7dc9ecc75aaa86a38d96f9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669921, "uuid": "080b8017-6fe4-41b0-9601-ccd422b75108", "value": "T1CE562915FD822B66D1CC037446FE666666603E485BA1072323A4EBB83E7773DEF4684C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669921, "uuid": "607661ee-ced8-4b18-9d0d-5fd93e786313", "value": "49152:pZb/LNaWMXioziIZ4MvLRjco8bkVP4KXx4iFfnWYhtR3KI1:pljNa3yo2Idt/hvdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669921, "uuid": "935f7f7a-320f-4595-a015-1eecfc353b9c", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669921, "uuid": "887e7664-b761-45c6-b915-02399207e8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669921, "uuid": "6789c101-0624-41d4-af99-539793f150c2", "value": "c4c4626d5d6f5cb41de046347f3d08f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc6f81b-f699-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712684962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684962, "uuid": "91ed2ec6-09bc-41af-9c3e-69ab359c2583", "comment": "Malware payload (njrat)", "value": "14046869d5b0c158c67f79e9a8e9c69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684962, "uuid": "44183f99-6bc4-41d0-9b25-a0198696ed0b", "comment": "Malware payload (njrat)", "value": "294bf73902a3e6f4d13be2a823f04249f8f8f8754f5bab9090878e2db204f156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684962, "uuid": "a2508d88-b24b-488a-8656-67b729eb0df0", "comment": "Malware payload (njrat)", "value": "473e461156b382691e9995bf2b0062c9093b02f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684962, "uuid": "900bace5-8b96-4fb1-8968-89086eb7a261", "comment": "Malware payload (njrat)", "value": "aa17f7b6d461b58ea99eea114d8f939101ca28169df3cd2fb0bb85f7517dc0a9663eecb5ec4ac619c1a0c35794de677a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684962, "uuid": "27425d2c-a5f0-49da-b0ca-f448d719b10f", "value": "T12CE207467BA54225C6AD1AFC8CB313210B72E3438532EB6F5CDC88CA5B676D04255EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684962, "uuid": "1417ef29-345f-4d0e-bd32-b2323ad99387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684962, "uuid": "c4fe35f5-375e-499e-8832-0e5a06064cae", "value": "384:P0bUe5XB4e0X0gONo4GeTWTVtTUFQqz9WObbnb:kT9BuipDWgbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712684962, "uuid": "80f88658-01e5-4082-b14f-8d5acd13f2f4", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712684962, "uuid": "b6d0b018-4fa3-43c4-a7a1-bed0eef80c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684962, "uuid": "98f3ca6e-abe5-4efd-ba94-3b06440cb60f", "value": "x5gJuYmvL7m2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a78fd3c-f637-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712642782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642782, "uuid": "133666c7-692a-4746-a838-03a0e0eb3ada", "comment": "Malware payload", "value": "41b4c75debef0f4bd06240c35693e4d8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642782, "uuid": "a4cbf08b-9a43-4efb-aba0-acdb7b0836ee", "comment": "Malware payload", "value": "297ef3b685519d8dd40a3726a382977bf1452ba9ff4dcd9e5d954f795a256aba", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642782, "uuid": "27951f91-1e4c-480a-bc58-587b168242cb", "comment": "Malware payload", "value": "479f626a3ee3e17abcac744b11d4a5a259f3121b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642782, "uuid": "fe2fb71f-f7df-4eca-bc4e-dcc95d5f8390", "comment": "Malware payload", "value": "888a6a229e4ee4cd4d25435b4806ce96417a7af29de1fb912414f026fa6540053d003a40445be890c979ec9ff5de1051", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642782, "uuid": "f243764d-184c-4503-ab45-85ab2d4772ec", "value": "T1F9C31294C1E022F1D92EC67A367235F1D9A2F81EE0EBB6FB24595781C1462416F5433E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642782, "uuid": "8680b83d-e597-461a-9b69-36ab048eca37", "value": "3072:D4DFSgCxCHwcLd/3T/3YZtfuurhUm1KF7pH:D45wcLd/L3ktfhrro7pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712642782, "uuid": "b102fe4f-8be1-400f-a442-5d0e005fa57e", "value": 123091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712642782, "uuid": "128f2998-18c3-44b0-8190-75e43e711fe5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642782, "uuid": "1a748f5b-cd6b-4288-a81a-d2a5ee6558ca", "value": "TCR2428.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec053ac7-f672-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712668394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668394, "uuid": "04cf268a-0dc8-4174-a5dd-967b74b72685", "comment": "Malware payload (AgentTesla)", "value": "95a1cea6639df70e011fa031dea9d62e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668394, "uuid": "52f0cc88-92bc-44c8-82d6-dc0a81c5c7bb", "comment": "Malware payload (AgentTesla)", "value": "29bfc92c1490a0f299c67a1c7e2dd20fd408d4f5e138bec1c8facefe7ad40430", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668394, "uuid": "97c8a6f6-9746-47fa-9e77-03f9da1113be", "comment": "Malware payload (AgentTesla)", "value": "bcdd8ac98bcbfe7010a454961d98a2ac4f98870d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668394, "uuid": "7db91e87-38fd-47ef-b155-4f8979730938", "comment": "Malware payload (AgentTesla)", "value": "38730b1a055d6dc33a6947a752e04fac3dccb7d9ade20dc3dc97c9c17fec626d19fc8d64a49226524d16f1363caacff3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668394, "uuid": "0d97aa22-ac2f-4a5b-a3bc-bff72bcac3ff", "value": "T1A1D24B19B798837FCD9A62BDD8A662001230931554CFDB9D2CC8858E5DB7BC8233776E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668394, "uuid": "58065afa-aefa-4190-9978-f6215b82a40c", "value": "384:nXqjDRqogPpF6rZEClWI//8DhsFhOEe5/1bWa66RheIMV/s:XqjYxPzcZ538DCj6B56WeTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712668394, "uuid": "d7661f2e-e758-4278-b626-2fe1a045a634", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712668394, "uuid": "2cb8d316-d3a1-4fc9-82f4-9cfe114a908b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668394, "uuid": "0c8ba056-0c90-4370-84e5-027cf4cfcebe", "value": "29bfc92c1490a0f299c67a1c7e2dd20fd408d4f5e138bec1c8facefe7ad40430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab7463c-f671-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712667774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667774, "uuid": "d2ad9994-03b2-4bdb-b954-c518ab28ad98", "comment": "Malware payload (Rhadamanthys)", "value": "4a78707180195f7584386470809e4aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667774, "uuid": "d0c68614-88ab-4a39-9c35-813d1a8116ee", "comment": "Malware payload (Rhadamanthys)", "value": "29f8b50f737feef9ec7439780daead395bf2bf278a4540ddffe64ca70aa9f462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667774, "uuid": "614c1707-2662-4f59-b25e-e7e28844973c", "comment": "Malware payload (Rhadamanthys)", "value": "0bc190b0cbb3983ce1b0bf7f5efa4a6f14955a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667774, "uuid": "0e043014-457b-4c82-90d5-eedba352798b", "comment": "Malware payload (Rhadamanthys)", "value": "9296cd408f5c6ad4bb8ac2c28e1abec644ad34c944daeee0c2af51cd3e83e71e4794a28a59d8d93a77b27890a2067b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667774, "uuid": "15ae96d0-7fb2-4eff-b028-1e2d9397321a", "value": "T17F740290AA405865E31D0F308B06E9E885A8EF3D51D1E18FE47C3E36AD761975BB318F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667774, "uuid": "ba781eab-f80e-4b87-b106-b329c4f572c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667774, "uuid": "c73d90af-3a46-4931-b7aa-8b42748ef30d", "value": "6144:Iu4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:Iu1t/6+6pWG8aRna9RYSQTXtV8s98E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712667774, "uuid": "12224111-4e50-41e3-a80b-b46e5612a23d", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712667774, "uuid": "89be7036-70a9-467a-8630-d5ef25384af8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667774, "uuid": "4703e68d-37af-45d4-9af7-cdc4381a3d3b", "value": "app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e81a96-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669907, "uuid": "88e722e3-ae74-4904-ab11-52924728fba0", "comment": "Malware payload (Gafgyt)", "value": "675e6fa31580f2e38fa022db30e2a402", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669907, "uuid": "cab2a8db-2f6b-444e-9d7e-97f679c6f2b2", "comment": "Malware payload (Gafgyt)", "value": "29fe4af11397be63afd20138d53be9e759f70c33b2bc11869308ff7d7daaddbd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669907, "uuid": "9099d438-ce0c-47f6-9365-8c2ec42d4402", "comment": "Malware payload (Gafgyt)", "value": "d0ff1c0f456f8569a05525f66640c74364a7c469", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669907, "uuid": "09be11ff-3e00-4451-bb65-261656e49f97", "comment": "Malware payload (Gafgyt)", "value": "e5e7090f7e5f7b21d2e4db2d5f90aba61a2e66eaa768c7a8ccfab608d836d00c4ac0628b1807d9d8d121cbb570b32b3f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669907, "uuid": "dfe34366-fab1-4a71-8418-ea608683d5f9", "value": "T141143A03B5E189F7C0C29AB027DFA5519933F47D0B633217B3A8ACE51F0D9986E5DA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669907, "uuid": "e396460e-d7db-443e-8724-4ac08bd028b2", "value": "6144:EHpeJcjlE4A0SywdMmYM2mZeL32awVByRCL9uXo:goJcjlAFyt/mZeL32awVByRCL9uXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669907, "uuid": "d7c3044b-b75a-40fe-bb1c-940fe930cdda", "value": 205522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669907, "uuid": "c8e16097-ff6c-430e-881b-36fb469ae175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669907, "uuid": "2f3b7a44-a63c-4121-a3b4-baad7cce0b5e", "value": "675e6fa31580f2e38fa022db30e2a402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87ad37b-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692762, "uuid": "b228feeb-10d0-43bf-b1d9-0d0c5f854fc9", "comment": "Malware payload (Blackmoon)", "value": "7f1724a7f154d9be81887ef065dce1b1", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692762, "uuid": "59982660-6dca-4ac5-be40-d488836ce789", "comment": "Malware payload (Blackmoon)", "value": "2a94bef55dd9fa7692bb27739a510e434c8a87d4c0661c8a70854bacdcf4ea67", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692762, "uuid": "b7750f90-5975-4faf-af56-49f608a7cf0d", "comment": "Malware payload (Blackmoon)", "value": "0a060d513d209075c4d914b94ef1bbe6285b995d", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692762, "uuid": "0c86dc14-1e4c-46bc-8c43-2746f506ef17", "comment": "Malware payload (Blackmoon)", "value": "07ec4948d10499215b4bd1403a6c652af506f81f18814fbcb44b2b6f392be3ab29436920b6cbc3518f33dd812b6a33da", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692762, "uuid": "ca31a644-8e96-43b7-99c8-2cf266014656", "value": "T138B3F823DA0289BAE06826B521FB0738FA7193B91C750963EFD5CEB17C52631DB4364D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692762, "uuid": "2196abaa-c3a4-4cc2-8bf9-75a4cb128370", "value": "38777b3eb947cc68a2158922f2c92579", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692762, "uuid": "2c507565-bfb4-4227-aff5-be7f2af8f928", "value": "1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27qTrf:bav9OdPx8wJ4rm7qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692762, "uuid": "02bb2437-9c33-4e43-bd54-cbf29ed5b000", "value": 116226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692762, "uuid": "fc34a057-2f9f-4ca2-b4e4-cee72f58cd29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692762, "uuid": "b5f42eb9-af9c-44f1-aa06-6e6efffdf98b", "value": "2a94bef55dd9fa7692bb27739a510e434c8a87d4c0661c8a70854bacdcf4ea67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd132cf-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678032, "uuid": "4d3bb77a-1b66-4edf-a79d-ecadc03f58bf", "comment": "Malware payload (Mirai)", "value": "942f9abc7b8146b6846a7c0fa7c5afe8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678032, "uuid": "c5ccbdca-68e3-45c3-b71f-06315c744179", "comment": "Malware payload (Mirai)", "value": "2ae5f29dfafcbb88a110c83ba0cbe063e8a6b66673e1866bd7c957346bcc9cc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678032, "uuid": "f83fb41e-b943-4520-92a1-111c6c0deeb3", "comment": "Malware payload (Mirai)", "value": "5809ea03bbf94e7808634c7f2b41321bbd0380f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678032, "uuid": "40ebd1d9-277b-4bdb-a03d-525f00bbb9bf", "comment": "Malware payload (Mirai)", "value": "c5d84bbf869f9809c4a5abc78003d98d695b3ada4b608c9484f69cded178a059da33def5f274b7ee7e68c6667b244565", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678032, "uuid": "26e783e8-3e14-4fa8-b3ec-465661cf58a0", "value": "T1F8E35B46FA818A13C4D527BABAAF414D3322E754E3DB73068D186FB43F8675E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678032, "uuid": "206849a6-b345-4803-87fb-690f80f431c1", "value": "3072:QpSPwv7itGt2U5IHqCT72xSmWKXnF1YWS6b3n7yyaM/90bp2V:QpS4v7iwt2U5IHq2KWKXnF2F6L7yrM/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678032, "uuid": "c17f74a7-27f1-4cde-b358-54f7f4909412", "value": 152972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678032, "uuid": "a5596bc6-af1a-4be7-9328-9a31311f39a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678032, "uuid": "991b4a78-f24f-4d8b-8aed-ef641738f159", "value": "942f9abc7b8146b6846a7c0fa7c5afe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecb8e0b-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712677928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677928, "uuid": "4ad9b88e-7a20-43bc-8e2d-04653b90325d", "comment": "Malware payload (Mirai)", "value": "fdec12a654395cbf77345ea455460146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677928, "uuid": "7642c85a-a386-45c5-9870-ed55aa4e2415", "comment": "Malware payload (Mirai)", "value": "2af9436cb36cda8e3ca18f5dac415e85e8a572105e7e65ffb9048670e9880398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677928, "uuid": "9750c553-872b-4eb6-bcb4-7b93d60d9cd3", "comment": "Malware payload (Mirai)", "value": "cecefdb9daf7186fe0dcb9731b87fa532fcda42e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677928, "uuid": "c46eb32f-b7af-4b2e-a643-5b92def88477", "comment": "Malware payload (Mirai)", "value": "e4b1c056fa553c235e5a5c5bf73cf17a6d76312b7fc0c1289d0086ab8177b7c1229bb0ed024052d937e7a1f0c4778c27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677928, "uuid": "c07a2a21-3993-4f77-943e-59bba02ec619", "value": "T158A394497FA40FF7F89BCC3749E92705288D662621A97F717931D818F64B24B26E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677928, "uuid": "21fbe549-bcf0-447c-8f16-dc3996bba8c4", "value": "1536:ykq2j4B50YtsHx1oU7aHmSmNvd92SYUrVSyZ8qy1f:yri4B5Xtc7MmSE4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677928, "uuid": "779e14f5-929f-4c91-b112-731635862065", "value": 105888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677928, "uuid": "3a2f1628-2440-42f3-a9c9-7026197fb77d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677928, "uuid": "be45aae1-f11f-4371-a9b2-ae37bda37ced", "value": "fdec12a654395cbf77345ea455460146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cc7d18-f616-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712628621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628621, "uuid": "86eb1c50-278e-4765-9d42-f181e08fa4db", "comment": "Malware payload (Socks5Systemz)", "value": "a119ffe32421ba34713f5ef4a51b1feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628621, "uuid": "368b8dcf-0f3e-4dcf-9750-b1008d034a27", "comment": "Malware payload (Socks5Systemz)", "value": "2b1e80f669c3006adf86cd9314a06c46c5ce71ee8bb56d343a1a6a3b26250c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628621, "uuid": "479345bc-9578-4020-9a05-25e64dd99b60", "comment": "Malware payload (Socks5Systemz)", "value": "eb83390d7ff775a2bf86f861cebf46d57cf50edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712628621, "uuid": "bf7a48fa-2b32-4ac8-871e-ad3bc613f678", "comment": "Malware payload (Socks5Systemz)", "value": "04b280f840111f07f1760c390c9698e2adc0a84cc780ef184215701293a9a0a76f7ead02b3d657c426d73cade4171b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628621, "uuid": "8cf6200a-b593-4fbe-b247-f21b18ff3818", "value": "T18F163384E52F8E7DC73286B41E35B2CD983737B16CA36809F145670BBE3B696E811235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628621, "uuid": "f28b68f6-428e-4058-bd41-e959ca9a591d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628621, "uuid": "aaa5264a-504e-4721-81d3-f486d17df012", "value": "98304:CcZA63GznlxbyR7irFH1sYmodJFsTPrSYUfUfc8O6Jcl7RQxE:5C0GznlxjBzdJF2WpsU8O6Kl1QG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712628621, "uuid": "686d7a14-0796-40c1-98c6-42be0b6e55e5", "value": 4239730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712628621, "uuid": "e37f63d3-24f3-46b2-a5e2-7a13f092446a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712628621, "uuid": "276baddb-062b-43bc-8b0c-4a0c87f210c2", "value": "a119ffe32421ba34713f5ef4a51b1feb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96ceab1-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692763, "uuid": "48d251fe-ec55-43df-9686-461787aec2e3", "comment": "Malware payload (Blackmoon)", "value": "33b592b5f514091808f49abb5e572931", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692763, "uuid": "4b505eb9-9a00-47fe-a28b-aa3e29fa0eb7", "comment": "Malware payload (Blackmoon)", "value": "2bccdf9c65a2793437b211393d4ae2e1c5bdc4353fb33f4821644978790280ac", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692763, "uuid": "12962f26-745e-4e61-b63b-4721e544d180", "comment": "Malware payload (Blackmoon)", "value": "f993b5b35ed728ef218b8c08af4f0bf1ff56f4a3", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692763, "uuid": "c0cc242f-f804-4d1e-b8d8-66b1ef907721", "comment": "Malware payload (Blackmoon)", "value": "824e98251d2c75d48df544f8ca9a36a2dd6d953e45ea5134419d7b7f5798ace41134a5878b7a9561d063a69a0c86411e", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692763, "uuid": "dadb64cd-39de-46a6-851e-72ac03ded64a", "value": "T19BA4B8137221D491E15957FB62EB433879B8875438F0CE23EBE4DD62ACB11629B1EB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692763, "uuid": "1bc1bf2e-0af0-4af1-8133-b3796e489114", "value": "47b8255ad5482cd954f979aad5057652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692763, "uuid": "70e87b92-27b5-44f8-8759-2a348db375ce", "value": "6144:Wvk3Q5ibjnNuuXckaL7pbRBkce97awo7L7oST4q:WvMQ5ibjnwka3pbRC19Gwo7oST4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692763, "uuid": "5fbac5d6-a2ac-4f74-893a-5475cc303989", "value": 449181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692763, "uuid": "e320d762-446a-4ad6-96c7-a4b1f62b4a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692763, "uuid": "f4898fcc-595f-4056-bb18-5954f49373bb", "value": "2bccdf9c65a2793437b211393d4ae2e1c5bdc4353fb33f4821644978790280ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10859cd9-f67d-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712672750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672750, "uuid": "3e6d3c00-9789-4cf8-8594-cc80c8dd9f09", "comment": "Malware payload (Formbook)", "value": "94a77af97674cf087ef9c32fe5e0cf99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PureLog Stealer", "colour": "#D42B99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672750, "uuid": "84fe6302-6769-478f-bc75-8468de7d005a", "comment": "Malware payload (Formbook)", "value": "2c46036d1ea2696f182c12662e399f9464a588d57fca9d10441f9daad35dde7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PureLog Stealer", "colour": "#D42B99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672750, "uuid": "652413d4-9b6c-4425-93f2-d564c43b7d95", "comment": "Malware payload (Formbook)", "value": "f205397d97f2401e6d3782cff2c284157fa2963e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PureLog Stealer", "colour": "#D42B99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672750, "uuid": "2505f53d-0428-49b8-83be-bf8d394a9201", "comment": "Malware payload (Formbook)", "value": "762f476ddfe176613c7d01941411d52a629f10bfc272df10befab6fd3d029a09b368d17b03a6b5b7d0adf20c1e76fdcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "PureLog Stealer", "colour": "#D42B99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672750, "uuid": "9a1cbbc9-1005-48f7-a10b-14d3dd5485b8", "value": "T135D4190CFBBAFD25EA4D473BD006D02883A6C119A516EB3B68D06DE41E12799C5CF93D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672750, "uuid": "974a3e57-3312-4e4b-b606-a832c4106727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672750, "uuid": "e9b97755-65f1-42dc-92c9-b1f6df712b82", "value": "12288:mnOBviGhcqCxg2flyZVO10LZGuT8PEy+oUkn:VHC7ly+mkVEyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712672750, "uuid": "fbf6b9e0-9a10-49c5-8cad-b0d174475f52", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712672750, "uuid": "c3e14cd1-5b80-4eae-9511-a88fbdf9e0bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672750, "uuid": "0da94b7b-5bf7-447c-81c5-e9eba46f09e3", "value": "muthal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc95039-f69e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712687105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712687105, "uuid": "0eea275e-5793-4c00-95b7-a443370bef78", "comment": "Malware payload", "value": "a8bd4a6b2f1d00928e61870a5688c13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712687105, "uuid": "f82b781e-50d0-4e84-b63f-55e605394944", "comment": "Malware payload", "value": "2c51f67e236cf95e2d51df4178699da09869ab077924cff0b3df1c512878ef2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712687105, "uuid": "c23804f4-20ce-44fe-a3a9-d9a3e1837ebe", "comment": "Malware payload", "value": "e17646d5279534f2e3eb0e0cfc8b6c536bc0c095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712687105, "uuid": "94c37ad6-2094-4f77-9350-8818ae153f20", "comment": "Malware payload", "value": "6e123a5c8310a537f165f84e4ee7cee3ac6a8b79146d56a023d41bccff92ec7baabd607362031c0b91f45d75035884f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712687105, "uuid": "db53b3f2-0e2d-4d3a-be59-76ce67d343a7", "value": "T1D776D06AE2A3CE2BCA4F0779027B17E00B7639B1B75B430EB74A2C67DD4A7740548746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712687105, "uuid": "98dff752-a1e5-4ec1-844e-3ccb27b277e6", "value": "98304:37//YITF8r2n8TevxbFKVlXk34tZ+t4+aNG5Lhd+2G4Op0cN+hmdYkvsFLL:37//1xBVqvG5dQ2m0cN+hmdYkvsFLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712687105, "uuid": "abe86444-4c25-46d8-ae7d-965fb602608b", "value": 7358976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712687105, "uuid": "70a7df00-be04-4336-b99b-0161bd4cd21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712687105, "uuid": "28eca0f1-4278-4feb-b38c-6539e3a8d214", "value": "Wave64bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b64376-f6a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712688489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688489, "uuid": "e2d60367-f744-4965-adbc-3d1a2aa5e5fc", "comment": "Malware payload", "value": "b4a6d59f0cf7defe58a53f64a3f27aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688489, "uuid": "5d2d9eac-2649-42dc-b339-8f01b7d5f206", "comment": "Malware payload", "value": "2cd60d18cf037641460538a2187c01bffa328e3d6dfd0cedcb33457c9f606a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688489, "uuid": "aa48ce5e-38b2-4cfd-a3b4-86bf9a464869", "comment": "Malware payload", "value": "75ec37966e19b7360824909d8a5297c87a52ee8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688489, "uuid": "4f602edb-27cc-4a21-9e78-8ab96c364016", "comment": "Malware payload", "value": "0733f9672d10abab5a655e9e1a2c2b5487f2dc853abfbd73361bf4a2689fc10fdfbbd06c806d5ab582caa94476cdc25b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688489, "uuid": "7e94fc2a-5708-41ac-a0fd-8bc38e596cc7", "value": "T147F63372A1244537DBF015B3F864A2303D28AE15571089ADE3E0F52D3FB65D2DBBB286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688489, "uuid": "886cba31-fdcb-439c-ab4a-754b2f3527f6", "value": "f57d7a40ebfca87e6f8082251d937ed8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688489, "uuid": "928d37f6-bd51-49a4-8790-687f743819bf", "value": "393216:o848qNJpGtN0k4zpkNLk65OOjDf46FeRCGp7+Y/5iz98:o84Z4Ck4zMkKDpFeRCGpaY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712688489, "uuid": "41e3d321-7ea2-4e90-b27c-ec4874837a2c", "value": 15387488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712688489, "uuid": "edde1b54-16be-4f5f-8b00-ddc89237d133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688489, "uuid": "e8883734-481b-40eb-80de-ded5ab526472", "value": "SecuriteInfo.com.Adware.Linkury.12.5644.11839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4103a54c-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712671972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671972, "uuid": "e321c74f-5317-4802-ad41-b1843cb324fd", "comment": "Malware payload (Gafgyt)", "value": "76ce32dd4c5383605d14e6116db87061", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671972, "uuid": "786bb8e9-9d1d-4641-97d6-21b09ca36552", "comment": "Malware payload (Gafgyt)", "value": "2d5f7a8e1caa3e4cefbeea39380778e410b57aafc511c9b8eed1a677e87da1c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671972, "uuid": "24895bce-05f8-4f42-a829-41406d6f789f", "comment": "Malware payload (Gafgyt)", "value": "3f28c39f2e98a3472ca4b4dd736b246096bdf091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671972, "uuid": "b88d798c-0bb8-47dd-81a5-6621e565b7c3", "comment": "Malware payload (Gafgyt)", "value": "ebbb96badf462cf9e56b9796d6e5aecf2561922ce48bcf0aac98ee1ca8e7fd5da598404812f84ff70bb449be92ea6eb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671972, "uuid": "c382bc88-c75f-4f0d-9534-9b6ed5b65519", "value": "T172931B41E9018727C2D327B6F7DF439D37326A5497973305A6297EB42BC6BC91E3A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671972, "uuid": "b35cfaa4-3963-4183-bdaa-8a1ec42678ad", "value": "1536:sIGGoQCjYB8k/pSEYsNd0BOTWvR1Pg7rKlM+Io9mC9rQhqW8LKFKe:gfjWpdSR1PLM+VmC9rQhqHLKFKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671972, "uuid": "d75347e6-6d01-43b9-95ad-dbda9d317ca1", "value": 93645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671972, "uuid": "79871329-12de-410a-9c15-0ae6da3804dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671972, "uuid": "ba51b2ae-2689-4b41-8dcf-99cee5e95507", "value": "76ce32dd4c5383605d14e6116db87061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1245a4-f6a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712688526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688526, "uuid": "f9b5c186-c289-4316-abf9-24d9c149066e", "comment": "Malware payload", "value": "a50e165e84ccf66ad5c5abf6397bb5aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688526, "uuid": "de709fd8-aff5-49ce-b482-45a74ba3c555", "comment": "Malware payload", "value": "2e202b063f85b457a19953a9e79a4929e8965af402bbfaf5df4b308d23f10e6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688526, "uuid": "67b7445f-afb7-4b2a-af1c-cff4c40371bd", "comment": "Malware payload", "value": "6ad0fd396a1b175f99f0991d9aa87770ae8ebc4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688526, "uuid": "be873386-001b-49da-bcf7-29dce1a2fd82", "comment": "Malware payload", "value": "ae277356ad4d7f962e32aa0d4459dabf067202901e3034988e77f66071d8257ddbebc5ec593d5e73bb7d7db065643a0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688526, "uuid": "95244e56-20aa-4fab-ba15-5790342726bc", "value": "T1FF85331B46584D958BFF3085B7B059F28CDCBAE5E62B3D28BBB6F80345B4C16540F2A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688526, "uuid": "1bb0974c-f7d2-44c5-b906-275db61ec2d5", "value": "49152:RyXQfL7boj7y1CvQ3lQPqEvjHMFGZCUFDrFAc0:Ry8UdvQ3kTSAjAc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712688526, "uuid": "f3545217-6d40-47b1-bb82-75d02267d919", "value": 1715544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712688526, "uuid": "61e9c58a-e263-4ead-95f5-b994585ca41b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688526, "uuid": "6767ffa4-de39-43f3-b59a-5af26e5e8bf6", "value": "SecuriteInfo.com.ELF.Agent-CRQ.12334.9491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a9fd84-f684-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkGate)", "timestamp": 1712675928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675928, "uuid": "ee9e3dc1-0ff0-4d27-9c47-8de91e7be9f1", "comment": "Malware payload (DarkGate)", "value": "e0217823f2f748254b43ede64e422199", "object_relation": "md5", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675928, "uuid": "40283ad7-0f32-48f3-b78f-b4414c905da1", "comment": "Malware payload (DarkGate)", "value": "2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f", "object_relation": "sha256", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675928, "uuid": "962b7dc3-ba83-4bf1-a7cb-95f646fc67e0", "comment": "Malware payload (DarkGate)", "value": "3bede6ac6d6e7362b64a7de6663c9b6caac29832", "object_relation": "sha1", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675928, "uuid": "97eb3fdf-4242-4b3f-acf7-6ec161c8f2eb", "comment": "Malware payload (DarkGate)", "value": "48a936d4fe86e98714a4f0de5197b123ee791e4fb940b77bad43d92c3e0e4187e7b4cfa531be6f0e0c04f2d5531c6fe8", "object_relation": "sha3-384", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675928, "uuid": "85ad29a4-91b7-4d32-915e-61bafecb8880", "value": "T10115F155EE272FAC6E38058D0C7A2D4CCAC82C332D21C8F6FA8F5147473569B66B251E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675928, "uuid": "93f930d1-da22-4f1c-8463-803ad5d6e6b5", "value": "24576:j2rHDMzlpSUY+g3Gy1U6dxvJwdd+2fk6T/dhTYzmQGeKsKBGrlrH:kAW59gs/s0dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712675928, "uuid": "bca96bba-b89e-4252-a186-e765dd957825", "value": 901848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712675928, "uuid": "e0312e0f-5b04-429c-aae3-06e8d8b60f58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675928, "uuid": "db04ed5c-2c8a-4e00-9e53-6b8ffdec476c", "value": "MS_EXCEL_AZURE_CLOUD_OPEN_DOCUMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52237dc5-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669853, "uuid": "5e22fe1a-82cb-4632-a907-65e6ef7b9ceb", "comment": "Malware payload (Mirai)", "value": "6465f349e9644a5bd4709cb9971c8833", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669853, "uuid": "4a99d6f3-676b-462a-95ec-e8adcd04c63c", "comment": "Malware payload (Mirai)", "value": "2e5bd850b14c62cd71e209ef14991581832812c6760042d9b04a42fa096c99f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669853, "uuid": "fa2679b5-978a-4a25-b55c-3bdf586a716c", "comment": "Malware payload (Mirai)", "value": "835a38dd2b2df15c1698eca1aef420a7b89b9687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669853, "uuid": "2df94a02-e074-486f-8510-0bca1f9b7467", "comment": "Malware payload (Mirai)", "value": "d68e999be682cc9716dae34e0605679b57628461619546d34456bfa578a8c3ff515ab41df045211865f9388bc9ea3b74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669853, "uuid": "5493d772-487f-434a-8d3e-f7bf4b21dcd2", "value": "T15BC2D030F4AC6DF6FA6DAD345EE9D7C17BEF074A76E5CC8670497E01022240A1F58954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669853, "uuid": "67f0a358-c92d-4a81-b2e2-ab09e9b5e351", "value": "768:uKnqLiChP7gI5EwE0MrkaPG4uVcqgw09Z:uKqL1h1tgkL4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669853, "uuid": "181442ad-7ba4-4839-93b0-0882d00c6344", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669853, "uuid": "5b86bb26-aed2-4769-bd13-0ef939ac9f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669853, "uuid": "2f8b3415-08bb-4a67-a302-1780f04c676f", "value": "6465f349e9644a5bd4709cb9971c8833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5489136e-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651819, "uuid": "951a8396-36f6-46dc-9d38-a1e8c4291418", "comment": "Malware payload (Mirai)", "value": "651c0a252c3b593986944ab6a07c86d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651819, "uuid": "7f28c95c-f574-4dfc-99e3-008e6d522a3c", "comment": "Malware payload (Mirai)", "value": "2f562718a3e8011e7713ea76b660936f4f130d7e59b67ea4382297ecc37d1745", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651819, "uuid": "f24084f1-dfcf-4c8b-bf5e-b62b2a91cebb", "comment": "Malware payload (Mirai)", "value": "e0584603ca24dda026cfb98a7acbc416297696e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651819, "uuid": "6df7f26a-3810-4419-a275-f22b4227ed2e", "comment": "Malware payload (Mirai)", "value": "c21c78f11a348dd10b97f4ad4a6a44f27d9c6d9318c45691647a201f9f30fc129ae63c1cbb3b8cc420f30e22003e183c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651819, "uuid": "60a0eb10-f731-4cf2-b5c1-d5bbb92a5bdd", "value": "T1F4731956B8815B22C5C5027AF91E128E332317FCE3DEB2179E206F20778656B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651819, "uuid": "f1170120-098c-4cb7-9b84-19a317a7496b", "value": "1536:HrnHBgdsiYgWKcGowjawtrQ3MciDG1dCHu2o5eYzBN:igG/jaWG1dCHu2oUGBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651819, "uuid": "7eedf623-c425-4885-8d85-0484f0dd79d2", "value": 75372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651819, "uuid": "9fb8114a-dc8a-42c9-a302-c3e16283dfc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651819, "uuid": "3c6d78ee-1bf6-42e4-8319-adee6d7c046a", "value": "651c0a252c3b593986944ab6a07c86d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5da57f-f620-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712633016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633016, "uuid": "c02e9130-16ef-489f-9f85-0a873355e829", "comment": "Malware payload", "value": "8d22e049e77dfba8090e6e44fd3c543b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633016, "uuid": "c3af22e5-b79d-4d2c-b684-852b85bd5a2a", "comment": "Malware payload", "value": "2f69d006b4731a1c8d77de67cb99d2395cc8ebf2ba50e53b5f705b835db6bf2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633016, "uuid": "9f28bb73-22b6-4cd1-a422-552bac7c09de", "comment": "Malware payload", "value": "006a1ef77861a02c192f84b48f2d9b79dd978211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633016, "uuid": "c73f8085-7f69-46ac-901a-fcfa1e44855f", "comment": "Malware payload", "value": "7b6b6cff01de3958459497cfab56a4260ca2e8e2136b8f278ed6c48f4f09bac19ab57a620e2816b37018c0b1f46fcfad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633016, "uuid": "36a096a7-8e3d-4359-b7bd-f7c8c0b09f05", "value": "T16447F0016ACAD919EF66D6F4C59091F07B25AC2CCA30FA0FAB18BD9D7835C500E6367D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633016, "uuid": "da4e18dc-f6de-4db2-a2dc-e16daacacfdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633016, "uuid": "608f1d64-0df9-49db-9686-fa867f7fd410", "value": "786432:vdHDl3T16kDEOBpyRrs1nxC7WLdVzjLL:NRBzDEoyRrix/bzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712633016, "uuid": "02559d22-78ef-4e44-864f-7040e2f85210", "value": 25363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712633016, "uuid": "9400ba98-1135-4c7e-bdec-a6a0e4d3642c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633016, "uuid": "7830d3c6-e175-4692-a367-49b6a5531518", "value": "SecuriteInfo.com.Program.OdownloaderNET.3.14294.23222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a122e7-f65f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712659842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659842, "uuid": "27e9c08c-31b3-4724-90af-7652e5b64698", "comment": "Malware payload (AgentTesla)", "value": "616be245bc59a512db935aacb3ea37d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659842, "uuid": "ec3506b7-f20b-4bd5-b818-f52bc350a753", "comment": "Malware payload (AgentTesla)", "value": "2f765d29605f09ea8a3a21d06d403d9cf1764a6f38686131a289b99df05ad41c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659842, "uuid": "fdf6978f-8871-4e4f-b826-9a297085cf9b", "comment": "Malware payload (AgentTesla)", "value": "7c71020b8f155ed88131f5bc12e15c680ce23f1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659842, "uuid": "faf36600-b28f-476e-8a29-f2755515bda6", "comment": "Malware payload (AgentTesla)", "value": "c363cc7ed0c937190cc9521b4ebc010538c09ac464e64bafd49400c77167360876708cbc2227a3f8e8a0bc795c831f4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659842, "uuid": "864cffcb-62c3-42fd-afd1-c34deb86816b", "value": "T176F4234267D9D112CBFC47B7B49036201FF081A9A711F30E5D9874FA6A27341EB6EB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659842, "uuid": "fef79a0b-9c02-4f07-92b1-df3ea7ef1cb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659842, "uuid": "f0c48329-8a2f-4727-8595-7482cb736bf7", "value": "12288:OYWyjyUZMBaalq9mXZ0l6Iq2gTMwvI/cPYbm7s5CzlTcd4RaRijk:lM0alU6jNTMjkPYEjzdzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712659842, "uuid": "73b6d135-6169-408e-af2d-a6da4ecfb650", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712659842, "uuid": "d788875a-6576-4c7e-a9b5-005c30644d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659842, "uuid": "72000145-0975-4734-a5ea-c3aec6ab166e", "value": "SCAN_INCORRECT_DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77952ff5-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712669916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669916, "uuid": "ac28efb8-57c9-4f86-8e84-193f7e0ae266", "comment": "Malware payload (Kaiji)", "value": "ccdeca474b329ab252a7f6b1328520c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669916, "uuid": "b2101b02-d581-4783-beb5-f9c6ea061c28", "comment": "Malware payload (Kaiji)", "value": "32165da2b6d40e8d15fbc5b2288e8a5b791cc036590083dc078a48a30787e45b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669916, "uuid": "3324724b-336d-45d3-839c-195a4477612d", "comment": "Malware payload (Kaiji)", "value": "d56608bd2fd75b696f92054f61c97807faec81a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669916, "uuid": "2be2cf50-098b-4fb2-bad7-8367fe62c8c6", "comment": "Malware payload (Kaiji)", "value": "46d68b50cec091f08f6188746b3d3e695d608748e5ce253d44921272eadde5f98bf913ce2426b82905bfb5d586232eeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669916, "uuid": "d25797be-2a45-4a6e-9949-a37b723d1e2d", "value": "T13D365A99BC1DB862EACC7AB42F3541947335FD499F8183237518BBAD69F13188F22760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669916, "uuid": "3d8076c5-8387-4619-a291-a79b89ab9a96", "value": "49152:SNHAjYXHu7vLqfIgzOpuS9xFkNexWlfR5EyAGYND5YgONLoI1:0HAjYXIvLqfIgzObkNexInE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669916, "uuid": "c8e7d077-62d6-4cf3-a85f-dac411e08648", "value": 5046272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669916, "uuid": "40c7ab50-2bcd-437f-8a51-4d1cc9dbbbbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669916, "uuid": "109980be-c90a-40c3-83c6-858ae3640457", "value": "ccdeca474b329ab252a7f6b1328520c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543d6482-f67d-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1712672863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672863, "uuid": "068ad0f5-97ec-45a7-bb42-f061124612df", "comment": "Malware payload (zgRAT)", "value": "a035f9a5bdf29a9c7fed3b9b97ac09ac", "object_relation": "md5", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672863, "uuid": "05713eff-84f6-48d2-81bc-bcee10ab5b59", "comment": "Malware payload (zgRAT)", "value": "321c856c0dcfa2e1317156d802154b0240e770415d1881e4bd4f1fb91cdcba49", "object_relation": "sha256", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672863, "uuid": "53ec1c63-fadf-4d98-b6e1-159452c3f9de", "comment": "Malware payload (zgRAT)", "value": "7012f4b8ff649e01d7daa30ef2f5fec9485b4ff9", "object_relation": "sha1", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672863, "uuid": "ba3acddb-0cbc-499c-a04c-1833d1c167d0", "comment": "Malware payload (zgRAT)", "value": "d923426ca15020eda08e3e5a9c205e0d96b18bb30dcf9746771b13892800b569d9cbfdb13325b095acb7a3de93c56916", "object_relation": "sha3-384", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672863, "uuid": "74718366-cc05-4693-8e41-dbeec950b803", "value": "T1AEC3174C7A42B29FC99BC731C9F51C58A6A0227B931BE707988795EC9E0D9C7CF045B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672863, "uuid": "96786703-fef7-4b9b-a0d1-472b548c9c4a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672863, "uuid": "dec1af54-7b95-45c9-8c4f-b75523f629cc", "value": "3072:xuSkFVuZv8qGMaYbtToOgWDG1AXMhzo1W:xupUb7lMWCGXMhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712672863, "uuid": "05d801b4-b003-487a-84a3-1f3d0cc9de14", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712672863, "uuid": "b35fab70-d660-41f6-9bbe-aa027368be38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672863, "uuid": "e4d91a7a-6940-4fa1-a711-83e3f75c770f", "value": "pinchs2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5c35f0-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692765, "uuid": "18efa3aa-7f3b-40da-a23e-06e9f51955dc", "comment": "Malware payload", "value": "dfd66b395c4f6b6e3b317c87af46ab14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692765, "uuid": "f2dc392f-b6fd-4136-8387-81b0198bab08", "comment": "Malware payload", "value": "323875be6f0aefa4f97ecf1c68cb227af0a85d5ad3e457e53621c4b1c64c8c7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692765, "uuid": "8b20ceed-7a81-4009-9e29-262673f25182", "comment": "Malware payload", "value": "e01be7f31115b7056525834584c11698d659f60d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692765, "uuid": "29949b88-22b1-4dc3-ac70-d79f506c5974", "comment": "Malware payload", "value": "e65707726ec299e9fcfc24aa8ff933b751e1665e3210061ff7a77fa395e5fdd27d66133ad092afd57b09d47b67f9be52", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692765, "uuid": "e583968d-8e1f-4010-85ff-70e54db69790", "value": "T1CE7497137221D491E15957FB62EA43387DB8875438F0CE23EBE4DD62ACB11629B1EB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692765, "uuid": "5d0bcde5-44df-4d53-a0d6-d00d4132ca42", "value": "454376cf99be699aaed9f7664b15a9df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692765, "uuid": "74f1a8da-7d6c-4964-a7a6-2e7183b224c9", "value": "6144:/qvk3Q5ibjnNuuXckaL7pbRBkce97aw/N4L7oQ:/qvMQ5ibjnwka3pbRC19Gw/NsoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692765, "uuid": "217ed886-d618-4ae2-acd0-e5bb21f831e2", "value": 364488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692765, "uuid": "a5574324-cdbb-4225-b838-cb1cec0b8040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692765, "uuid": "2ed26bb9-d0a3-4b94-ab44-861bde9924f6", "value": "323875be6f0aefa4f97ecf1c68cb227af0a85d5ad3e457e53621c4b1c64c8c7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c59b443-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678407, "uuid": "77c37139-e243-4a9b-9de8-fa006f2689d3", "comment": "Malware payload (Mirai)", "value": "e421c03023f4e0aa818a701a9eb5037b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678407, "uuid": "28e75f79-ae22-4e7e-8f35-8931d2709469", "comment": "Malware payload (Mirai)", "value": "325102ce52388e9f959d389072c8a18405ac5ba242fc43d0adc6411d0ddfe4ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678407, "uuid": "8d08c27d-806a-4947-8f4d-0fb85142e3c3", "comment": "Malware payload (Mirai)", "value": "2b2dec09709cea2c8d42a141441bf6a69c6862f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678407, "uuid": "320c80d1-4de5-4236-8e3c-8ba93e287077", "comment": "Malware payload (Mirai)", "value": "31b0eed06d9229005abe0114f5263fe9bd49d644bb7a08e395c52c4a5803ebfbd21dec1a565914b8eb1d1a3f7de7dd22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678407, "uuid": "6d95c25b-529f-4918-b0ac-0b61f5adc928", "value": "T1FE434C2166393F1AC4E0E8BE21B70325B1F52A5E65A4C94EBD730E4FFF11A54A6036F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678407, "uuid": "a6f57504-f33f-4567-8f08-0d4e6e3fc61b", "value": "768:7boeqn8PLtADbbi1x0q9+8A/E26N+urOjfEU4WHO+t99lD:7bfqn0ZADbbi1x0S+8A/E26N+R4U4GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678407, "uuid": "288772fc-1f70-47dc-9967-c38f03032ad7", "value": 58408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678407, "uuid": "56821c0a-fbdd-430e-b163-58f13cb16c43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678407, "uuid": "e7a93e9e-1384-42a5-814c-dc86529aa4e7", "value": "e421c03023f4e0aa818a701a9eb5037b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44275d98-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712671977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671977, "uuid": "b6597778-218d-41c1-8783-b39ea3922f8e", "comment": "Malware payload (Gafgyt)", "value": "35d2282659f090c133e4108baec2c8b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671977, "uuid": "d5fb67ab-d7fe-43a8-94e7-c15480d4b7b7", "comment": "Malware payload (Gafgyt)", "value": "3275e83df2a87a0af11d119c12d6d5b8a83c5c9f5772cf2093790e129bf0db10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671977, "uuid": "1b322596-8da3-472f-ba41-56fae56cfde4", "comment": "Malware payload (Gafgyt)", "value": "99516f578b0c9d83f3880e121a14bcd7576cf7b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671977, "uuid": "8a0d8863-9b12-439d-8470-b32aeb1f827d", "comment": "Malware payload (Gafgyt)", "value": "c3eb6b4115ea4547000adcabde0957da201d3a82ad397eddf3308d4dbbfbb16458ab55e19786661205932eb6aa9457e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671977, "uuid": "a22e2c37-0fa6-4c5e-ab75-22e7b83bd4cc", "value": "T1179329377B230E23C0CA547116F30332A7B5D65938BA5347BA906EAC6F1AAC435177E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671977, "uuid": "51dcf49c-93f5-4338-a7ce-5ee143e925c7", "value": "1536:QdXkIdNM5hgtpctAR+DTrJFcmQ7FhYjDtaeQ4e:nIdN8ecg+rrcmQ7FhY3tab4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671977, "uuid": "112b3b0b-e9fd-4160-9342-bb987861be7f", "value": 91824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671977, "uuid": "a40d08d9-7553-4a15-97d8-37c5171c3c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671977, "uuid": "53cf430d-a956-4264-9cd7-efe44c16a18b", "value": "35d2282659f090c133e4108baec2c8b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab40c797-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692766, "uuid": "28e6d82d-8119-4277-87e8-3b09694cb1ef", "comment": "Malware payload (Adware.QQpass)", "value": "29925e49ebee7466d78ba6896de1b280", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692766, "uuid": "295d2ead-b0a5-4601-8577-8508e2330af2", "comment": "Malware payload (Adware.QQpass)", "value": "32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692766, "uuid": "79cde6f9-fe5e-4e83-9ad3-03792bb35876", "comment": "Malware payload (Adware.QQpass)", "value": "3b8da560f2436a3a065fadfdb542c753f40bdcd9", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692766, "uuid": "48ca45c4-cb3d-4b8b-a5da-58696740ab06", "comment": "Malware payload (Adware.QQpass)", "value": "ab92bfe9a1d8cd5b456ab088d039724ce42dcac4b97d5b9b88a512d605bec7e83514fcba7b48d31b9586c9f72d80e637", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692766, "uuid": "68b8ffe9-deb0-47a6-800a-30f6217e05dc", "value": "T1B57496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692766, "uuid": "8ac6aaac-bbf0-4f3a-84fe-9cc34ffb1fed", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692766, "uuid": "345f47b6-c20d-444f-8c37-7ec0179693b2", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsx1:IXdaAqvRwWoe2XjSVvUYuyHWPBsx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692766, "uuid": "1b19fc5f-7299-4a59-bf42-0d042c0eee11", "value": 348056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692766, "uuid": "3f965f52-f10a-4d40-94bd-7fe60ec1b328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692766, "uuid": "6b2360ec-c07c-4c48-9a47-978668fb80f7", "value": "32fac7c582f5a5b5c74ad95997a1e914aa5410926fdfa179eeb5ab8540bd10de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0578b8-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692768, "uuid": "bc315627-542f-426a-8d27-94b367ea3444", "comment": "Malware payload (Blackmoon)", "value": "2b01a782c4afbf920cf596186df1a3ac", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692768, "uuid": "d72fc96f-cbd2-4730-91e3-4c703ad54622", "comment": "Malware payload (Blackmoon)", "value": "337e26c809ec75ff08f8b89a5bcb56b038b7fe5f33ffd4a1648b7cbdbf132dd7", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692768, "uuid": "bc102a8d-3874-45d2-bada-8eadfb3a284e", "comment": "Malware payload (Blackmoon)", "value": "0f9ed98f1e414c1e99cefbc51695597cde9c8c1d", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692768, "uuid": "880c4f92-9f52-46d3-a5b3-96c32a69c166", "comment": "Malware payload (Blackmoon)", "value": "b1e839c61ba53d132e962280fff942c42601e334a990b8f976a6df556ffef724d938e2b528141cbfc9b67d0868c3790d", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692768, "uuid": "24f87c07-9c12-4490-8870-ef7a656ff2bd", "value": "T1B923AE03ADD249F1D825027639BA073DFF38C1856D31865BCBB1DEB02973226B52658E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692768, "uuid": "fc9fc25f-f91c-410f-a4bf-4ba82a0217f1", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692768, "uuid": "6ecbebdd-4704-4a91-b892-6b6554c8c95c", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+4Ja5:w0hAW1iqdWNzI5Pd4CSyDt+t5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692768, "uuid": "310ace05-8156-4c3f-9a1f-d8501a90ac1b", "value": 49861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692768, "uuid": "2d4624f0-561f-439e-9801-f83e0bb6e3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692768, "uuid": "88e2107a-5553-4873-89f7-0a8ba60fa7c3", "value": "337e26c809ec75ff08f8b89a5bcb56b038b7fe5f33ffd4a1648b7cbdbf132dd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39416722-f677-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712670241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670241, "uuid": "d6d4f9a7-6810-4017-b961-948c785d2104", "comment": "Malware payload", "value": "55b0352b168af8d6c2421b51862826a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670241, "uuid": "ff051560-4527-41f0-9bd3-11955c8ad762", "comment": "Malware payload", "value": "33f3769d8bc3ff8e316a91ba5b3e3856685018ad1acfcc2dd7336302bc660d88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670241, "uuid": "9ce98477-e96b-4da5-853c-ce904c4dcee7", "comment": "Malware payload", "value": "9657a184abb272bf5158ad8052255b20e9da482f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670241, "uuid": "c84d6365-9aa0-442a-bf9d-6baae9d99824", "comment": "Malware payload", "value": "5bf8bd4276d78f06ccf45d4d0cf57bbcb5285bfb06e3bd74a15cc430d0bf4fd6941790e4e4684f393c0597c7b3fc72d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670241, "uuid": "cb69b6bf-2a5f-4dd8-ad25-dd2d81ec0db3", "value": "T1FD668D42B6486B99CA604A3385B38ED12772BD542F2157839B54FABFBCB23464F11FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670241, "uuid": "7f19cfad-e890-4a59-8277-822e1f60003e", "value": "98304:sP5J/QbyFxerusHvxHq2lPaWjWNB7CrvPR1Fx7/:sP5J/Qby/erusHpHMWjWnCrXR1FxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712670241, "uuid": "cecb46bb-f6df-4ee1-8531-e62cf4e2f748", "value": 6592297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712670241, "uuid": "4dcb6f51-9ca3-44e3-a200-ed48d9dbec1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670241, "uuid": "1c5e1e46-b5d1-4033-8a4f-9dd02e85cc0c", "value": "55b0352b168af8d6c2421b51862826a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f9429c-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712669620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669620, "uuid": "7a93059e-b92b-416b-bb9e-900fd490156b", "comment": "Malware payload (Socks5Systemz)", "value": "00c352e9ca0fe7e8def96a60c3c5aed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669620, "uuid": "72758594-d5f3-40f9-988f-30d317d18438", "comment": "Malware payload (Socks5Systemz)", "value": "3451be7dc55538d44ff27d0fd349df6fa954bcb1b235da5e4df60f80d825491f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669620, "uuid": "97f21a8b-eb7f-4635-bfc8-74709ef299ac", "comment": "Malware payload (Socks5Systemz)", "value": "b597400e5c3afc13f4048bf1e83823576becbbd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669620, "uuid": "583d05b5-9653-4623-8d2f-49e407ad58fb", "comment": "Malware payload (Socks5Systemz)", "value": "b4c337e79946618d0156b02561c756ace1323be059b7b7c53c2307570f2909c71a23e3519dfb74f4c9bb607441990e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669620, "uuid": "04f1a56d-ffab-4280-bf6c-f5d8ac7fb04f", "value": "T1AC1633959F9402F4F6E19A71EE2AE4509B623CFA50311151B8BC9FFCAF93C8295432C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669620, "uuid": "54de4d64-abea-41d4-9d7f-c4d973982dd3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669620, "uuid": "494a96fa-e34e-4a7e-a5f7-9a551632b2e3", "value": "98304:CHy0DySAN83GnI6wM+QFHvap7AiWa7nvcb0YhkbBh0fgIekMW:8yGySAB+QFHva76QyeBhnzNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669620, "uuid": "05478bcd-018b-4cfb-948b-3a95d587bd3b", "value": 4282250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669620, "uuid": "cad72abd-6ff3-469d-9ebe-a8a4b9d7f89a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669620, "uuid": "efc1ef75-f303-4681-a659-9ea6f4a2c4b6", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.9045.18959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfdefb3-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692769, "uuid": "776ce2a2-c6f9-4300-8d9b-b5684619cd08", "comment": "Malware payload", "value": "a2dd562645b92833b3c9191467d386c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692769, "uuid": "1fcea70d-a4e6-4e1a-b782-0da2dd92c6c9", "comment": "Malware payload", "value": "3499f5093210ccfde7ebeaaa9e26e1fbcedfaf1f738c5812377648bdee588af8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692769, "uuid": "d27a1f63-e20a-4729-8dc0-a4d1dc35909e", "comment": "Malware payload", "value": "deea1f3af4bcc0edc64272a02f02e347fb8a7beb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692769, "uuid": "73b6b849-4813-4da7-8c50-bcbdaf795575", "comment": "Malware payload", "value": "671b7421441f7f85b9d34658e211b192a8a9c6735d61090aee444dd0295bed9310fa794aa64d73a4f62f40da403c1aeb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692769, "uuid": "af27f0ae-0b6f-4b57-a8ac-0b8d1f00aad1", "value": "T105B4E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692769, "uuid": "22191753-f734-4635-999d-a982fa1326a5", "value": "3072:6VmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPEJKUuTx87JKD:6cHpJfHElepVuWwP5YcQfg8J+ojIJ+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692769, "uuid": "2368d9ab-48ac-4c35-872b-abc3e4423be6", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692769, "uuid": "06aed878-6e8f-41b8-b7b7-19f28c0aa480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692769, "uuid": "6247e53a-0686-4a81-b5cd-fc1ba0a074ec", "value": "3499f5093210ccfde7ebeaaa9e26e1fbcedfaf1f738c5812377648bdee588af8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946c9479-f659-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712657509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657509, "uuid": "072afdcc-e109-49bd-b3f8-6ea633a28578", "comment": "Malware payload (Formbook)", "value": "446d007ac3cad85c949140e3c6b155c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657509, "uuid": "1301fc6e-d0d2-4e13-9903-598f7b98d7a4", "comment": "Malware payload (Formbook)", "value": "350d74b5253acdc5472d50c85a9f2d380df768ac78b5cb14fff5324ead9c3e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657509, "uuid": "ff509d76-09bc-445b-9224-71c4a1af4c4e", "comment": "Malware payload (Formbook)", "value": "33faa95c455ee1963571b8f14c6235a65a93c373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657509, "uuid": "45bb0c57-1515-4735-bb9f-d2e37b6824fe", "comment": "Malware payload (Formbook)", "value": "211a8ab177974c9d798b9f72a70d76bcdf48e90b905594263c0b0473359600cde2def6fa8724175de38e387a1116b55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712657509, "uuid": "4d91b673-669c-420d-aee7-20f638e12943", "value": "T1CFF423016B9D9984D7FD47B250E524224B72F1423B61E1698DA970CF09F7780CB2A9FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712657509, "uuid": "520276f4-7374-4da9-8485-4bc6d601b529", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712657509, "uuid": "4cfeae8a-17c5-45dc-be3c-02d27263a501", "value": "12288:PNKhyjyUZkFif6LsqyowO+0Xm/sucUJuLcH1/LIMJ6Bd9uixU2bWaE6VtN9hkR:PNtkgUG1O+0XDucOH1zJ6B6iUMVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712657509, "uuid": "a3e0efb8-a1c5-4542-acab-8bf16dc7f952", "value": 744456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712657509, "uuid": "f16fc648-5374-4a67-813b-b111d5735c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712657509, "uuid": "66f7b2d8-362d-42fa-9e98-203d5d6e1e0e", "value": "QUOTE 2024.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a946019-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712671935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671935, "uuid": "b877060a-9d9f-4c4b-a129-09c79fe5eb77", "comment": "Malware payload (Gafgyt)", "value": "302c101b34cf6f684d1fbd814ac17b90", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671935, "uuid": "97a8bf9c-f498-4087-b95f-4af4fd4ced19", "comment": "Malware payload (Gafgyt)", "value": "358e0bf963d4dc315ac99dc460e77102ce0d42fa33cd1bd87e53db43019c9d6e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671935, "uuid": "7c8d9751-9996-4e80-8ccb-cf89fb904ccd", "comment": "Malware payload (Gafgyt)", "value": "a09fc16510336203afdfb4affc709a230876088b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671935, "uuid": "e5b57d48-a56e-4426-aaff-3ec46e0b3e14", "comment": "Malware payload (Gafgyt)", "value": "76471abd26d464fbc2abc5e9cce351237f20a13da933e450570fbec83d78c0185448c02b71e711816d14dec14efd017a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671935, "uuid": "c0b1908a-3bf3-4a64-ad41-9a78aff8e8de", "value": "T18D836B23A552C67BC1D747F91BEB95204423B8791F33620A73D8BDED2F1A8C82E5A305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671935, "uuid": "ebc5c7bc-6f5f-43a0-89ac-9a04c459fe6d", "value": "1536:A74X+IUTRuGwiwp4eRPgCpR3apWU4aa3S3C/VeJxYmoImu9GjDD2Yre:WaUTIvtRP3fCfa3OC/VeJxYmrmu9G3Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671935, "uuid": "a2b7a20b-9a4f-4700-b749-fd1f56b810bc", "value": 82332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671935, "uuid": "d50f1df5-b4d2-4213-8220-6f72a49ebdeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671935, "uuid": "6daea199-7692-499d-9ba7-7371b82d44bf", "value": "302c101b34cf6f684d1fbd814ac17b90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d960c2-f686-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712676816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676816, "uuid": "f11e5fc8-bb45-443a-aba0-0adf89ce9ee3", "comment": "Malware payload (Formbook)", "value": "bb9c49e2dd4f2e4d78ead6adeebf5b69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676816, "uuid": "93e8d10b-05bb-42a7-a487-a7f822cad701", "comment": "Malware payload (Formbook)", "value": "35b3427883c0b04f7b8be643ae1d4403e1908bae3fb09c1965a560e2bf63b3fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676816, "uuid": "145ef078-3aba-40cb-8855-e11853cf9817", "comment": "Malware payload (Formbook)", "value": "36b7d08b0a7d06573cc8eebce3adfe515d0cb94a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676816, "uuid": "849486cb-9c8d-4059-9891-386a67254774", "comment": "Malware payload (Formbook)", "value": "2ea9a1513bb722a85918515dfedbc3250ffadace409539b9af17d0447487e6a2384e53398a199a396ef7ae86755c7b48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712676816, "uuid": "3f3981ec-b95b-4e3e-99df-86a27579b9aa", "value": "T199B5236043A9C26FC3BD40BBF095060716F2C0679577BFCB6765AAF928177C87A8314A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712676816, "uuid": "49235021-cef7-4dc9-938d-a7392325852a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712676816, "uuid": "7b880aa8-5ef0-49a7-9458-964f7c7a28ca", "value": "49152:M+oGGCO1ex2t+Qyxc/jB03C3JAo+0gjlj+rpa8PTAZUV1AgI9jEr:MZGO1e2dImJAo+Vljoa8PkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712676816, "uuid": "f8b2d7ab-3f7d-4faa-8aab-68843e6dbd09", "value": 2429952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712676816, "uuid": "847d5b8b-029a-45d4-a6d8-372d8674b150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712676816, "uuid": "be5b623d-fedb-464f-8a5c-74e1084d5feb", "value": "inlawQzshlu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f1cd7a-f677-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712670231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670231, "uuid": "b62f369b-e615-40d1-a4c0-046f9b0c8040", "comment": "Malware payload (Mirai)", "value": "3108526aa6d1fb490d0360c0828def59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670231, "uuid": "41387a37-c3d3-4d7f-ae7a-3d7e9f8ddce0", "comment": "Malware payload (Mirai)", "value": "364203cf3017757170508d95bcffac29f1dca44175d2ed2fdfcaff6a71e57248", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670231, "uuid": "b3365c95-7773-4a92-9875-22036209d471", "comment": "Malware payload (Mirai)", "value": "5eaec1be49048fb3986bf402d6687127a7d0a9ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670231, "uuid": "703945c7-0ee1-429f-a5f4-439df71cd171", "comment": "Malware payload (Mirai)", "value": "82b4cdaddac5d9eb53a27b3f5741d16a9763db0f2dfbdb2dbc628c2f1b5ce901aba286b8d362bc4aaaf1e35bff9bacf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670231, "uuid": "aa638f2f-99d7-4204-8efd-b48e002f89c8", "value": "T1E1732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670231, "uuid": "ae8dbfb3-85a7-439e-9c2e-ec2fc51fe5f8", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXnSKV6v3G78nN9Wo:927jqCj8v3GI/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712670231, "uuid": "91070340-2215-47d8-a094-46d9dcee401d", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712670231, "uuid": "e7c699fb-b489-440d-a7ee-2362826762c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670231, "uuid": "7a79754c-7b06-4dd5-8f4d-7a1381f98357", "value": "3108526aa6d1fb490d0360c0828def59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466e7c4f-f696-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712683578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683578, "uuid": "e0d20467-98fd-4fce-933c-c55e8475fba1", "comment": "Malware payload (Rhadamanthys)", "value": "1b298f950d9b3289188e0ae035ac4095", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683578, "uuid": "62609ff4-1391-491a-8829-27cd55e1635c", "comment": "Malware payload (Rhadamanthys)", "value": "375ac09d5f44849e9c888e86adc50069cdb019e3de3216264f61868bef12ca4d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683578, "uuid": "7cff5d69-29af-4e9d-be54-a6e79f0c3917", "comment": "Malware payload (Rhadamanthys)", "value": "7b71dfa4da23b81f681241cc642050d1c9085848", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683578, "uuid": "2bf53f0b-29db-4051-b877-2ee365343664", "comment": "Malware payload (Rhadamanthys)", "value": "51afee09eadedcc62f977f166e41fb4da884b3d0f41eb34788bcac4ecc8ef94f01b15804b62007e981faa4fdd0877a4a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683578, "uuid": "762aa678-95c0-41a2-9ff6-5f1439e508c1", "value": "T186D312373444AE6BD4B35BF49F28BEE0CCC2B83E7CA5313C64A584232B2FA166455539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683578, "uuid": "98ce4eec-6485-4f21-aed3-6f327d8b1ebc", "value": "3072:UhX0NlDzCHH36SEn/iAgUrQCIS9D1YnKvbDT+jeo1lhU3uBr:fNlfCmjrQCID4bDOeWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712683578, "uuid": "4f3dc489-5b17-426f-9ebd-eccec391e72c", "value": 130105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712683578, "uuid": "0973bbc4-9afe-4860-ab1b-c7f482f9b4d1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683578, "uuid": "84376108-2de1-4293-a78b-8e1f8b190178", "value": "DRBS7505.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dae1f9e-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712671940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671940, "uuid": "37a41aaf-2823-46da-9813-fa11e20cbe63", "comment": "Malware payload (Mirai)", "value": "0e96da7c0fcd9b78dae8ac3b689219bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671940, "uuid": "3ae0be5e-da19-4cae-8133-567c94447470", "comment": "Malware payload (Mirai)", "value": "378a9bca190e61392441d163e779c3fe50649b0e837bce212283508b87a1bce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671940, "uuid": "85323c03-a3fe-4490-8aca-8397ccdc64df", "comment": "Malware payload (Mirai)", "value": "825cc2ed2b70093d11780ebcc9fe90bb61ab0395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671940, "uuid": "efc6ef5c-448f-40a9-80f9-3db8df375217", "comment": "Malware payload (Mirai)", "value": "f5e55abe65447e1f8ecd01add26069062a74a3a78d8f2f2500a27808cac0201e54a24f45615fd411793692fa969fa898", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671940, "uuid": "d13406f3-e0ca-4ce8-b725-7978248afd6c", "value": "T1E3D2E0B91FFAC4E7E65804BD4A9ECF797280D020966E974573E9D102013F024DBADE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671940, "uuid": "f981c3e0-60a8-462e-9c58-f24587678c7c", "value": "768:KBaseGFy+6c9BjqjDXAlv+SEPzbCHQlImsXd:KJeGw+6sBOvwlmzzbCHQlImyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671940, "uuid": "776ec45a-d6f6-4fe5-b14d-266e680bf80b", "value": 28992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671940, "uuid": "f3d27a02-41f9-4318-ad91-87cb24272593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671940, "uuid": "76641daa-47eb-4f9a-a97c-31f792ecc16f", "value": "0e96da7c0fcd9b78dae8ac3b689219bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adeecc92-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692771, "uuid": "ad5c638e-3e56-4d85-bb41-d49fc1691dba", "comment": "Malware payload", "value": "e3af3586f83391174876c1bbf5ca91f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692771, "uuid": "09621c14-94ca-4397-b93b-b0ed7ffa3e99", "comment": "Malware payload", "value": "37cbf198ba7ae5bf3bc06f7e0042d3ded1e3e95b6f31611e56f49b578d7ca5c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692771, "uuid": "48028445-b83a-4385-a526-b74f9025e54c", "comment": "Malware payload", "value": "4862ef57f1210dadd833494e179104bae5aeb92b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692771, "uuid": "76a87e17-4e20-466f-b5ac-53c17e8684ed", "comment": "Malware payload", "value": "59a5e08c18b68a9246c0e25f78ca72d959f5e4a2198f141798982e2bc7ede4ce6e3fab026dcfce425fe2575ab57b44cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692771, "uuid": "85f12334-efac-44f6-ae74-15d764a4ec03", "value": "T18F84B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692771, "uuid": "fcc52d16-4dcf-46bc-b023-16deed74dde0", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692771, "uuid": "04e3f1c0-d7cc-4ec7-b485-e200a0715723", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1M:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692771, "uuid": "b73f035f-ae49-4c8d-82cc-9575e533eab2", "value": 375510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692771, "uuid": "0e04527e-2e86-43c5-a2f9-0b4bd363142a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692771, "uuid": "d0075547-b2d2-4797-a727-6eeeabd83a22", "value": "37cbf198ba7ae5bf3bc06f7e0042d3ded1e3e95b6f31611e56f49b578d7ca5c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ae3f7c-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694525, "uuid": "6a18bcb0-1a4d-45e2-90e6-1f81a175d998", "comment": "Malware payload (Gafgyt)", "value": "f6be7081ea900d0a33c95c819ecebe9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694525, "uuid": "a6739837-cb24-4c33-986c-7a55d0af7b1c", "comment": "Malware payload (Gafgyt)", "value": "37e1b9447c3c89fcab9d439be457e4a3cb604d599b71e3e74ffa8fa37636c73b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694525, "uuid": "9a4360ba-2001-4a82-9066-d31e90545de2", "comment": "Malware payload (Gafgyt)", "value": "caca806cbd786f6a86c7b637b438977c470aea89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694525, "uuid": "b645a663-85bf-41d7-b71e-43635c41a2ed", "comment": "Malware payload (Gafgyt)", "value": "694effdfd19cfdfa455504145feb7d7c67d0356e0e8942278f89d56f8db0137c0f3f5faae7d7e5350bf9a619f06134f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694525, "uuid": "c06f1e96-b997-4e7c-8fbf-79fe4ceeed79", "value": "T111E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694525, "uuid": "d1042233-a9ee-4c43-8c5c-8792877e0202", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hi:vY01ZkXAQT4NH9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694525, "uuid": "a663b5e8-7163-4ed4-94b7-74faafa3f44a", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694525, "uuid": "3131fffb-6aca-4585-9d2a-b09e019e51cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694525, "uuid": "b1f1a4df-d900-4bf6-a0f1-a88587281502", "value": "f6be7081ea900d0a33c95c819ecebe9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894c6ec2-f63f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712646324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712646324, "uuid": "26e25186-540f-4828-8e7c-8bb94f21ffa4", "comment": "Malware payload (Socks5Systemz)", "value": "9b5091e9e5dc17d563a7ad858a2f813b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712646324, "uuid": "8e5eed73-21df-48a8-8965-b85e1c4e725c", "comment": "Malware payload (Socks5Systemz)", "value": "388db14e9fdbe65fadf429c08b9cb8d32e806105736a16f97a79b912f13857a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712646324, "uuid": "c7e0e7d1-a1a5-4be5-8e56-a7af33df82e8", "comment": "Malware payload (Socks5Systemz)", "value": "3faf704f4b72f323c412ec9b5ec4f98e64b6f36e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712646324, "uuid": "0f9041ac-945a-4640-af18-2e86ff408a3b", "comment": "Malware payload (Socks5Systemz)", "value": "e38d37ddbcca16a07709a1c7be45eb10cac5d2c53c237eacadc1444adec2f74fe8526befef37b1c4a0ac2e6df53ff92e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712646324, "uuid": "acc021a1-a542-4cc4-b60d-ef15d1121186", "value": "T1ED0633923AA52C32D06170B23E3540FE547DE679CF20484DB5EC9EEA5B176DDB620B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712646324, "uuid": "e952f5d6-b58a-44aa-b94b-06767c6e797e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712646324, "uuid": "ad6d0a89-0e93-48c6-8b56-b5533d6cbae3", "value": "98304:CDebfkhlUBCTtEporOteReSDJTaEveBzaJv1zx3:lkUB3eMiaE2B+3zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712646324, "uuid": "4a1005d2-e5ed-42aa-8aa7-33b41480a7e3", "value": 3868772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712646324, "uuid": "6a34584b-d22b-4ca6-ace7-327af93e1e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712646324, "uuid": "ea6c0c60-c69d-4f1c-a09c-24878a3dc3ec", "value": "9b5091e9e5dc17d563a7ad858a2f813b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2beaa4f9-f688-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712677520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677520, "uuid": "64d65a4d-b63e-4463-944e-2e9cc6eaf8f1", "comment": "Malware payload (Gafgyt)", "value": "7be369f8c38ed893f06d13074e3b4e0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677520, "uuid": "33aee065-52ea-47dd-8924-7f8e0082cf90", "comment": "Malware payload (Gafgyt)", "value": "3892d5981b7c8526e713d4c50413383f68a2a3c11275613e2a027531f90a5b8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677520, "uuid": "cc782788-e670-452f-80c0-8c5cf7058c51", "comment": "Malware payload (Gafgyt)", "value": "ba9aabaa3e87a7df4a22e912aef7aa4910b23d5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677520, "uuid": "dfb2febe-dd60-459c-940a-12fd027fc19a", "comment": "Malware payload (Gafgyt)", "value": "7bdc9141aa8626febf7b4419f41e92f1b5e62db20554ea761d2e414b3daea92e944f512d668f26e570b171277fa29a09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677520, "uuid": "1dcec21c-8467-478a-8742-fdb54c3b7c1f", "value": "T121D30A77B61C0793C4C706F11D6B3BF28F68A2F312E761C5661ADA908B739B61412F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677520, "uuid": "5e6c9103-2d1c-45b8-9ef7-853e18df00bb", "value": "3072:eVrQyEDCvqBvpnTy3j5hgrJ3JCI0Dmzj0qDJAGyoze:eVrQyEOvqbnT8j5hg6I0Dmzj0qDJAGyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677520, "uuid": "6867c129-d35e-4756-a103-4c2ff495dd19", "value": 141485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677520, "uuid": "7d798e99-bfbd-46e0-8540-6a4b52cd1636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677520, "uuid": "b1d76e1a-0d94-4e7d-b35f-46a063154982", "value": "7be369f8c38ed893f06d13074e3b4e0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17164d4d-f688-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712677485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677485, "uuid": "3d66daff-9c66-4356-9071-75cdb5867276", "comment": "Malware payload (Mirai)", "value": "ffa617730924173539d97c4c12f055f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677485, "uuid": "6f2e32d0-ce38-4ac4-970f-39841185472b", "comment": "Malware payload (Mirai)", "value": "38a47c550fc9f39b5db66e8d1870e58b894fb3145c70d8779b421d7f60e03740", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677485, "uuid": "27457eb1-ade8-4327-9990-171ca3f942ac", "comment": "Malware payload (Mirai)", "value": "d5ce37796ce0d753d65dce9173daa525c1215c19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677485, "uuid": "9e4efa6f-db6b-4c60-835b-87322bc075ff", "comment": "Malware payload (Mirai)", "value": "01790203c3be2937c44cd4d65073e53f7a022ae264a0b9bb6660d80596d13eefcb571a9746292a2b8f9f9b49d0f3b9ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677485, "uuid": "347d76c7-28b1-4acb-865c-41e6c864a88e", "value": "T1FF63B415BB650FF3EC9FCC3B0AA92705198C650A61A57B367D34C85CBA4BA2F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677485, "uuid": "34aca2c2-ff57-4f8a-b036-9d69599b8e7b", "value": "768:jiKGqC4ppekuS4/xnFYniIInh3UV+veP3eLeAkeu8rhZu6Z9XiKhfb1pM:jFppek4/xu3I642Odk76hZu6thf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677485, "uuid": "20afb9e0-8d6e-4947-93c2-906279fba33f", "value": 71596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677485, "uuid": "15fa16c9-4304-435e-97e9-8b86288c6ec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677485, "uuid": "f13de6a9-79b9-4225-a7ac-5863a14e487d", "value": "ffa617730924173539d97c4c12f055f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d526caf-f674-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712668960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668960, "uuid": "80795883-53ab-4733-912d-379d09532932", "comment": "Malware payload (CoinMiner)", "value": "501a3525bc57ad4b6c8dead684ee18b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668960, "uuid": "f417f91a-4e60-4222-bdbd-0b6515001217", "comment": "Malware payload (CoinMiner)", "value": "3a1dbb305a5cc05e160e9b134593d1adffe8f833a3fe17e46013b0a23313b522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668960, "uuid": "e4e54510-afd7-4b17-8d65-aba15652e9fb", "comment": "Malware payload (CoinMiner)", "value": "d74ffaea637544927706b722116d4aaeb6dad32f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668960, "uuid": "74f01131-cbb2-499b-b727-5fe8f924ffb3", "comment": "Malware payload (CoinMiner)", "value": "c282cd854b86d33a99379d072d6d989a68cd6477460f8985b4ae1fc8fb6d4e6b286da34eb617e5c4c335b0e6dbbefd3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668960, "uuid": "744eaf44-56ee-4583-8277-7021388d77c3", "value": "T1E7767A076E28D71EC625223448B2CB9067267C4A85D7A517B389F31EE8F21BC1E5EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668960, "uuid": "5e10c0ce-a7a5-4303-a046-867305d44526", "value": "49152:k8abI9yVtXm3ENIRCJtLGr0Ro1CGrXr3P4BODuooRXXI1fKv4nYwDqqKXBgqFwVM:T9yI02Gtwm9ddIulPsd/MEd/fp4Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712668960, "uuid": "8186f46c-d14f-4311-bf8d-a0bc90f4b73f", "value": 7200180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712668960, "uuid": "7f3a51da-90dd-4d3c-a26b-b02bd114cfd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668960, "uuid": "3c20e8e8-74ee-47f5-a17b-0f794bc2bd29", "value": "501a3525bc57ad4b6c8dead684ee18b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedd1ea9-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692772, "uuid": "3539d929-fb53-41fc-9119-698a3c9cd3b2", "comment": "Malware payload (Adware.QQpass)", "value": "9dd5731762febf26965ea7e5356ac932", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692772, "uuid": "67b4521f-2ad8-4ffe-8b30-a779e29cffa9", "comment": "Malware payload (Adware.QQpass)", "value": "3afc48d5b92da1948f3f112c4e896e476fe8858090c7001b955c2b459c742486", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692772, "uuid": "ba0e1bbd-0b15-4a98-9eb7-99edae311267", "comment": "Malware payload (Adware.QQpass)", "value": "24328448a6ae4d25f4056a383d3c47e1429a9818", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692772, "uuid": "eb10132b-a9ee-4a6a-b056-6f81a89fbc4e", "comment": "Malware payload (Adware.QQpass)", "value": "1b4090c631112fe123af2b83ae5138db2d45b96090f4f0fa78ae44a21bd0e1c11ca6b4b32a44dd54991a7e22bc91a1c5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692772, "uuid": "424681dc-57ee-4f8d-9ba8-ea4a2dead87c", "value": "T1C5A4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692772, "uuid": "6e8173dc-e792-45a0-b8f3-fb81f8b0340d", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692772, "uuid": "996cd137-a886-424a-8072-184bfb518199", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubc:sZ++qlRBBOxQDU2XWIg6Bic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692772, "uuid": "16b11937-25e1-401a-a6c3-244ddae0a1a8", "value": 458359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692772, "uuid": "de2d2ae5-394d-42a5-b7dc-3eda1fab4d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692772, "uuid": "889ea257-4376-4411-bf3e-131a1c9d14ef", "value": "3afc48d5b92da1948f3f112c4e896e476fe8858090c7001b955c2b459c742486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afda0c7d-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692774, "uuid": "04b1efa0-da75-4311-a0fb-74ee445d428e", "comment": "Malware payload (Adware.QQpass)", "value": "1707cfec198c538b9dbe83ca9d7e0604", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692774, "uuid": "1e24a2ff-b565-4d5e-a393-0e46537eaf5d", "comment": "Malware payload (Adware.QQpass)", "value": "3b3d515ed1ef90b0631205d6f94facf5bd3b65e0db214c28dfd96cef8d07e7e9", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692774, "uuid": "ae76eacc-578a-4e53-b6e1-c48885a91b35", "comment": "Malware payload (Adware.QQpass)", "value": "204e630e591578ee301704dca26f1d0e4ed6a558", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692774, "uuid": "b12ee4e8-1682-4a0b-bab0-94d4ef4dae1b", "comment": "Malware payload (Adware.QQpass)", "value": "a496097235b954b5b7eeec6d709a5cc245fcfbcb84267decca57f501f327cc36a758a60267fa92c9bd28fb6c5dca783b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692774, "uuid": "1253d8c5-ba93-458b-befa-e9df0d111045", "value": "T1067496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692774, "uuid": "a38d29b3-a123-4505-933a-3bf1186fd567", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692774, "uuid": "177abf42-72e5-4e45-9a9a-c1cd0142a986", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxK:IXdaAqvRwWoe2XjSVvUYuyHWPBsxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692774, "uuid": "8a82890d-0330-4b8f-bcec-73c4f70839b3", "value": 348092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692774, "uuid": "3750223b-b572-4505-80f5-6006bb102075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692774, "uuid": "e5ce8ac8-3fde-4578-8e6c-a452e23a8084", "value": "3b3d515ed1ef90b0631205d6f94facf5bd3b65e0db214c28dfd96cef8d07e7e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0aa5f3a-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Dinwod)", "timestamp": 1712692775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692775, "uuid": "2c4ae22e-be5a-46d6-acd4-5c2c0802062b", "comment": "Malware payload (Dinwod)", "value": "787d2d2b2b9c4891589d279acc2cee8e", "object_relation": "md5", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692775, "uuid": "3fb108c7-5e90-462b-a6d2-4ffb8eafa7d2", "comment": "Malware payload (Dinwod)", "value": "3bcc8fe45a0e2351ef3065787afdc57c434e7954aa6783d1be5004c5d9c9aca6", "object_relation": "sha256", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692775, "uuid": "a0ddc200-a736-4fb0-a071-e6ad3e7245f1", "comment": "Malware payload (Dinwod)", "value": "f2e3bfdfb79ce8f7d074e36d7ca13906ba06db4c", "object_relation": "sha1", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692775, "uuid": "f392ffd5-c0cf-4bcf-b4b3-89f08c7b20a9", "comment": "Malware payload (Dinwod)", "value": "e25600e6c118dea28ccc915f4f01b655437159994d65b4ef0f74a3623dd95a59f950728701b634fc89ebaabd7f7fa9a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692775, "uuid": "766e9b59-992c-4e8b-b123-d740b1e6c76b", "value": "T14FF30822E51388F6E02D05F557F2073C9979876368B24AAFCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692775, "uuid": "1204f5f5-b9ba-46e5-a7d1-ebc3de258c3b", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692775, "uuid": "b412450c-c3c0-42fe-9a8c-79cd22e8df1d", "value": "1536:ej+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy8J:eqSe5OmiEoAcCbZ6FNoutbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692775, "uuid": "01b78423-1de3-43d7-a83e-f259e962d41d", "value": 159810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692775, "uuid": "c43446ae-9852-4c65-bee0-d17e397a7bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692775, "uuid": "61a7696c-90b5-40b9-8c59-51688d5c69b3", "value": "3bcc8fe45a0e2351ef3065787afdc57c434e7954aa6783d1be5004c5d9c9aca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3178ecc-f6a1-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712688565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688565, "uuid": "b27b0a4f-c7f3-4085-adff-46b0eb51d697", "comment": "Malware payload (AsyncRAT)", "value": "2337b9a12ecf50b94fc95e6ac34b3ecc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688565, "uuid": "2dd47d1d-507a-4e71-a5cf-4ff957836e4f", "comment": "Malware payload (AsyncRAT)", "value": "3c703ecb3e8c54e352ff39fadbe789bb2313f848bd69551b07bf2ed0a58744b9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688565, "uuid": "b8ba531b-415f-4689-9955-2cccc68becd4", "comment": "Malware payload (AsyncRAT)", "value": "584251c3ddf6d9767a15881b2fc689923c794ceb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688565, "uuid": "866ee8f3-0cd5-40d7-a3a2-2d002d35fc9f", "comment": "Malware payload (AsyncRAT)", "value": "95fcf115aaba1d95157c998c2f752af42ca19e2425d9d4e5e5ac020b5804fc1e73204a6c7d709134f9ef4b7d6f6b6303", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688565, "uuid": "e0251c29-92b6-4927-b095-82bccc0d5a7f", "value": "T16153E7013BE9812AF3BE8F7469F6618146F9F4AF2D12C55D1C8911CE0632B829941BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688565, "uuid": "2b324ea3-075e-4849-8011-736122595f74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688565, "uuid": "4a674bc2-b3d1-4beb-b68d-1e4e1a82f6fa", "value": "1536:N2wukvF1ak9gcKu5UYFIwu9AAhnZ8tubJzAP+jlrrQTGRx:N2dkvF1ak9Ku5UYFIwu9AAhn6tubF1jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712688565, "uuid": "632b2d93-a630-4a2c-8629-1930594febea", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712688565, "uuid": "786b79b8-73cf-4465-8ed2-55c818ab4380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688565, "uuid": "54e6e5c6-356b-48bf-980a-6c04c9a903f1", "value": "xde47dUIgZDh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a165e7-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692777, "uuid": "f037326d-d400-4d53-aad9-82f2ca4e6c25", "comment": "Malware payload (Blackmoon)", "value": "5396ddb76e600de73fc1164f39435211", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692777, "uuid": "6be3d190-5a63-4651-bf7b-c0a38b880052", "comment": "Malware payload (Blackmoon)", "value": "3ca76a2c913ddf2a37c2c774b9616786d74cd7068946542edb2b2fa563abcab5", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692777, "uuid": "8e69e6a8-1424-4a43-a2e6-518d1a89424d", "comment": "Malware payload (Blackmoon)", "value": "60f74d1ba3f4c27fe878925b0818286e8e862af9", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692777, "uuid": "dc32cf20-b6b7-47a5-958b-aa5caf0bd596", "comment": "Malware payload (Blackmoon)", "value": "407c0221e2ceaead6b56694272e34bd99d08566f421a3b1a0d2b1c2a32c7d10a0385ab90bc7a24920c22c5dc741cc00f", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692777, "uuid": "05c95ce8-7f53-4444-a0da-90ece5d1dcf4", "value": "T17EA4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692777, "uuid": "d995a6ee-ae24-40c2-9424-ae3f10c5c5c5", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692777, "uuid": "efdd740f-c209-4419-9178-1ac5edfb945e", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubH:sZ++qlRBBOxQDU2XWIg6BiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692777, "uuid": "c978a980-982d-45e3-9cea-756709ffd852", "value": 458372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692777, "uuid": "21469838-cd58-4810-b0ba-1cc76f601957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692777, "uuid": "f686c7ad-6dbd-4051-9a61-d494e04e2225", "value": "3ca76a2c913ddf2a37c2c774b9616786d74cd7068946542edb2b2fa563abcab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5d9e8f-f696-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712683588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683588, "uuid": "659fcaa9-4be6-492b-9b8a-a6930a798d49", "comment": "Malware payload (Formbook)", "value": "a3cedbbfad4507bd6b37853b72a33724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683588, "uuid": "d16c0d98-d2d7-403c-b6eb-54de31c6c5fb", "comment": "Malware payload (Formbook)", "value": "3d7ed6d1ed6ee914bb491dc7ba72c0e665727786d51e2b9aad8e2afb3e16b316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683588, "uuid": "0be90e66-d32d-4cf6-b73b-c3cfb185a86e", "comment": "Malware payload (Formbook)", "value": "0371e3308e3a1e39eca2474e9c00ddffeedfcfd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683588, "uuid": "423b1cad-d8ed-456a-8f2e-a3664cda1a5f", "comment": "Malware payload (Formbook)", "value": "f97298d7f8b9ce3f09970a74e177a6fe34ea659690a94359680289e10e5560958b9e6657cfb6dc7a5391524826d8e88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683588, "uuid": "d0160d4b-89f6-47a7-8202-a976c7a62e04", "value": "T11445BF027381C062FF9B92334B5AF6515BBC79260123E62F13981DBABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683588, "uuid": "e86d16f4-fafd-4bb2-9d16-4c3356941fda", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683588, "uuid": "8498d6f1-327d-4327-b641-e01fce756a09", "value": "24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8a2o+dIk:cTvC/MTQYxsWR7a2o+dI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712683588, "uuid": "4c3baf38-9d8e-4109-aafc-3665789dbf36", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712683588, "uuid": "4e53c10b-9556-41d0-b642-a05673abfeef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683588, "uuid": "886ee29a-9c81-45cd-bf15-977b46282441", "value": "Inquiry Second Reminder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f839dd06-f636-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712642644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642644, "uuid": "07ad4c22-21ae-4691-959e-34154c348a2c", "comment": "Malware payload (AgentTesla)", "value": "f30c2f7d93f589e7369b058273375105", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642644, "uuid": "58ba0df3-cba3-44e6-9688-f36fa30ec967", "comment": "Malware payload (AgentTesla)", "value": "3da762881f6b7896235df7a2b0744fe8abcc83450cd2fe533b6cb81e4caf0df4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642644, "uuid": "e96e6dc8-70cc-4ca5-a6a0-d6d20e2200f9", "comment": "Malware payload (AgentTesla)", "value": "6f761b3b221228e978fba1c1158503d40321ba8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642644, "uuid": "18cd95bf-c61b-4719-82db-17281e66fb68", "comment": "Malware payload (AgentTesla)", "value": "e69175eb3117b6f28c184b1ca36847e418aa9482b42d1cacb7dfe31dddf529930b4deb5f42976113e56c93253bc17469", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642644, "uuid": "b1f3b429-98f3-4b14-a742-e38ebf357497", "value": "T117F4120322EC7EE6C03897B1373B97C0C7AEED299160D54D6EC92696447D6037923BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642644, "uuid": "7f04b7a3-328a-4659-a760-73eb3e58126b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642644, "uuid": "cd3d6476-be61-4404-ba41-313bb5f42bba", "value": "12288:aB1oVeonJRbUdg+HqqdNgQ/Uts3jAz1sPkRvPIiC/RUGRgp0mZ28A0cBz:oo5oK+HqENg6UG3k1ss9Igp7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712642644, "uuid": "27f3d6f7-2910-469f-8025-4cee9d521a3c", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712642644, "uuid": "38424668-adc2-4d77-908d-cb9aa7aafa57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642644, "uuid": "42d6c3ab-9a32-4b5d-ba49-755475b33329", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2743cd0-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Dinwod)", "timestamp": 1712692778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692778, "uuid": "80f97927-b3c7-4253-b435-8a7861797726", "comment": "Malware payload (Dinwod)", "value": "063e63d8179e9ba970dd2f383d1d1a82", "object_relation": "md5", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692778, "uuid": "32e268b3-e918-4014-be7f-ffef42394017", "comment": "Malware payload (Dinwod)", "value": "3ea5f486d171c1bc39df1f54656c0bbc5a06146586ad604c2e961a5d46a468d4", "object_relation": "sha256", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692778, "uuid": "e5d7f195-89c2-48cd-83af-574e06b51783", "comment": "Malware payload (Dinwod)", "value": "bd030fd0b8e30df7569a0f750c2e1c94d6d7b2bc", "object_relation": "sha1", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692778, "uuid": "21012604-acbc-44d6-b9a2-311037b05d9a", "comment": "Malware payload (Dinwod)", "value": "83401187c8eeb2624c8d737046fd38668e4e58a25057caa4893cc17bd80c0356d8eda40360f5dbff87d1294633670405", "object_relation": "sha3-384", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692778, "uuid": "c24d2e90-dcb1-43c7-b532-cb53885fa5a0", "value": "T12FE3F822E51388F6E02E05F557F2073C9979876368B24A6FCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692778, "uuid": "b8d9787d-9e99-4d31-bc0f-2b9b2d57c008", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692778, "uuid": "e249992d-fb5a-4520-9bbc-22c7c94d7f4a", "value": "1536:rj+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy87:PqSe5OmiEoAcCbZ6FNout7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692778, "uuid": "5be36eb3-723e-443e-9d02-1c8e875b201f", "value": 156931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692778, "uuid": "9e8de039-1797-4aff-8c23-f733fc73615e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692778, "uuid": "a3346927-7454-4bfc-a7ce-8b4b63d96c91", "value": "3ea5f486d171c1bc39df1f54656c0bbc5a06146586ad604c2e961a5d46a468d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7204c611-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678497, "uuid": "08bb9726-b578-4e9a-9f8c-9b60b341edee", "comment": "Malware payload (Mirai)", "value": "e4e3867946def5df77e1745e62a51ea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678497, "uuid": "2107a9ee-0ed6-4bfa-90e5-8d38f31a8569", "comment": "Malware payload (Mirai)", "value": "3f4f1ee0928b013e28a29838907de1962161236d8d7024d63970283e23cbd2f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678497, "uuid": "cee655ef-cb1f-4f32-9136-f4340029a740", "comment": "Malware payload (Mirai)", "value": "f6fee53f1a4b24334153ac92c4def61539fd9254", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678497, "uuid": "d5e3ba78-2d97-4028-8a6f-5500f1b09840", "comment": "Malware payload (Mirai)", "value": "1c64901e1f11c866fe5b9ba5e2a8cd354aed04f5ba82aad27827b16d865b825f7b0165672753993e12712fd48a842540", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678497, "uuid": "8a504d74-5cbc-4b50-9f33-5869fe267160", "value": "T15824C60AAF560FFBD86FCE3702EA0B4525CC650722A43B367674D528F54A54F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678497, "uuid": "717317f4-b433-48fe-bd41-b6a080256868", "value": "3072:INkVOVrzUwPeT0ODLOzvhkmP8/m8xijK9NdayUlRR1k0+v+oQh6fb:INkVQrzUwPeT0FhX8+8/9NdaxIvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678497, "uuid": "cfe5a9b0-4eec-4d58-9192-4b58f7297476", "value": 216468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678497, "uuid": "2d96a464-af33-4cac-b8ef-5ab98c3f4d3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678497, "uuid": "08f34d1c-cd66-4aca-9ff3-b99c68b7fb8f", "value": "e4e3867946def5df77e1745e62a51ea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807494fa-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712669931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669931, "uuid": "386b36bf-5d72-4272-99a5-e5fbd7887458", "comment": "Malware payload (Kaiji)", "value": "d88ae73242ab578d0368ce0ad9079290", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669931, "uuid": "1d172dc3-6d6b-4880-b827-0b2c3798f704", "comment": "Malware payload (Kaiji)", "value": "3f6a5237e0b5988889180215c7430f43b880b7e4236e7eecb85258f4b3974c19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669931, "uuid": "e0131755-432d-4148-9618-854fc9da6564", "comment": "Malware payload (Kaiji)", "value": "aacbad33580a5f45d270efa2ba562c0eab333736", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669931, "uuid": "1e645d46-b972-45c1-8be6-0b2acf1e6908", "comment": "Malware payload (Kaiji)", "value": "abbba16de86b2489aa464e616295f68db3370f17dc4197fe2e80384d71bad2f6919fc8a191b3156ef4002ddf38f7926f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669931, "uuid": "46487ad1-0030-43c1-9d26-5fbed4adb55d", "value": "T193562913BE18D71EC62522345EB2CEA4672A1C8A86D6A517B345F309B8F10BC5D6FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669931, "uuid": "cbb4c5fc-6dc6-4d54-b040-76865e4042a8", "value": "49152:vj2ikDKMeT6zKjTmB+dGpawj/mNGZWtaan757Hhu/BQ37A78dWLilulp73RbGog5:LuLiW0Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669931, "uuid": "046cb9c8-7745-4f2a-ae1c-5aa4f38df27e", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669931, "uuid": "d0d8386f-ecdc-41c8-a15d-b1892083fecd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669931, "uuid": "690bc532-1052-4c5c-8740-def2d436b5a8", "value": "d88ae73242ab578d0368ce0ad9079290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cf1191-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666211, "uuid": "18f9be1d-eb74-4158-81f0-160a51bfa1d9", "comment": "Malware payload (Mirai)", "value": "9ec729fd5874577bcd8c5110fe82a1ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666211, "uuid": "60317d31-71bc-4746-8882-ce5034bdf272", "comment": "Malware payload (Mirai)", "value": "403188c2dd16bc6f9d2bb88641c50b6c9a4e4a2248aaa1abd4ac86a0d1372418", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666211, "uuid": "16364629-bf05-413f-b35c-1342b00f770f", "comment": "Malware payload (Mirai)", "value": "963de16772f2b79aa08ca70d183d79514047b34f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666211, "uuid": "25ba7f6e-8286-4d53-8839-c9d8972972b1", "comment": "Malware payload (Mirai)", "value": "af8c71933b6103a5d4d4c1318ecf6763987960a902ac4530cc0cd9adcc86c80e0963a78bb2834c5c7430abb540a0dfd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666211, "uuid": "34d4c07d-a38c-4f3e-8554-1607c3c425ca", "value": "T196B32A46EB808B03C4D52776BA9F42553323DB54D3DB73069928AFB43F867AE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666211, "uuid": "564bb46e-ca1b-4026-b9d4-278dedccabaa", "value": "3072:OAV66FdwsXtLHTH3O8SGUy7++eHarcM/9RSTN9:OAVXDx9DT3O8SG/7aHaoM/9RSTN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666211, "uuid": "5a36ece6-9cbc-4f60-bcc2-6407d3e18766", "value": 114449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666211, "uuid": "b6848eab-be1a-45a5-a6dc-cbe2dde63abf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666211, "uuid": "5fdb5d93-6e31-4a7d-a3a4-85ab5b5462b9", "value": "9ec729fd5874577bcd8c5110fe82a1ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a9403a-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666215, "uuid": "57c39a89-a164-4cf6-a71c-438b299b0dc3", "comment": "Malware payload (Mirai)", "value": "939d4c14bba2ed6d8f5766fa190fff03", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666215, "uuid": "d6237716-3b6b-4a09-abca-8d63505ec4e7", "comment": "Malware payload (Mirai)", "value": "41369408a0dd928ba8be21d11b80bdad2c184e7c65012ccee1af0b10df78f43b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666215, "uuid": "a00bb8e3-2925-4a5b-98bb-e79e1ab1be95", "comment": "Malware payload (Mirai)", "value": "4f60c817ead8347bc1e8bb636587ae633ec943ff", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666215, "uuid": "03645441-7894-456b-95a1-b0b4906f01f0", "comment": "Malware payload (Mirai)", "value": "4329e98c37667896f6d8f4c53f1acd790dd598013c41d4f56545af50c90ed1a9f01d4b42234d2d55fc8eed6df6964c19", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666215, "uuid": "0fa61da2-2c74-4fa3-88e0-186e9e29485a", "value": "T14E13F707B98384FDC06CC274562BBA36C867757D0235B6BA77D0FA23E89AD301E1E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666215, "uuid": "b50467ef-229f-45fc-93e4-6851b52f3db2", "value": "768:b4U9FiNjEB5NXpx19OlqxHgSWpS23Un+j8oY/Bo8G9rKDCx:lojEB5Bpx19OsxH2SRr/ql2DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666215, "uuid": "21a1e20c-000c-470e-a4e4-4480bd6b5a63", "value": 42784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666215, "uuid": "2c1ffd22-ab46-4d0a-8f51-abe62ed06f7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666215, "uuid": "8ce67a97-5f9f-4766-b547-97d62d749a0b", "value": "939d4c14bba2ed6d8f5766fa190fff03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c862cc5-f6b7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712697734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697734, "uuid": "12a29898-77b4-469d-90c1-33b8162a1dcd", "comment": "Malware payload", "value": "5a18762f37bcc48d7a1bf2d0c3f93f5e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697734, "uuid": "864f0c83-d3b2-4043-bbe3-a6e3c40114f6", "comment": "Malware payload", "value": "421e136baee96d526f5f2175cb135de5189bec2254ab79299086855205e99a4f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697734, "uuid": "891d5733-8d88-4f71-b3f2-5b3dc0ed8a59", "comment": "Malware payload", "value": "2a12dbee41bb1b7e9ed446df32ab5eb018a90d6c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697734, "uuid": "0cc4b499-251a-46df-a940-b776488c4428", "comment": "Malware payload", "value": "c0768f711d0f676b0afe74b9a1a75178f3cd13e8ac63fca66a4c17cfc430f89eb9a5cc208d2bcdaf4f8506789b219e7a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697734, "uuid": "ea2f193d-6f6e-4f99-a3ec-73e3016aa7de", "value": "T190073317BE00A23ED9440F31143BC7A60BB27D215A512136AAD4B92FEDFA6D1C6761F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697734, "uuid": "a6bb349d-02df-4f22-86b5-269fa1e7ef9c", "value": "393216:P/UR5b58HYFiP0FnHwT7FD5qN45bvrk55PsjD2ttUZfxQI:P87tA0FnHSrvrknsvWtUZfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712697734, "uuid": "26dd7b7a-cb5b-4406-a16a-dc8ec451effb", "value": 17059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712697734, "uuid": "8e2fcb30-c682-4e0b-83d0-a2a13e776356", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697734, "uuid": "742ced66-f6bd-4e6b-91da-9231884455ff", "value": "SecuriteInfo.com.HackTool.Win32.AutoKMS.1658.17061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33a1b6a-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692780, "uuid": "3240c3ee-8fc9-484b-8a73-b0296fc44e04", "comment": "Malware payload", "value": "27fc645d0204c567c049d0bbd8cae8e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692780, "uuid": "41bac9ba-a0d5-401a-a3b0-12bdc94c263c", "comment": "Malware payload", "value": "42b1d6f247c41e52d052634d99315e2d943433461371cafdff4935e4cc58dbef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692780, "uuid": "d67b56df-c7ab-4ad9-9ba5-6c9b6548e2f3", "comment": "Malware payload", "value": "6322b04d43078307c3128aecfe5f305e17f3091a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692780, "uuid": "7c6e1967-691e-4a77-a6a5-0d2111925ff7", "comment": "Malware payload", "value": "41dd348dd32a696b4b99e89f6481ccbd05ea3cf9ad84b33b12306766472447b9aa946e74999d5c87b111fe0f80c74465", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692780, "uuid": "4a9d0985-2ea4-433a-995b-550bc711b576", "value": "T131B3F823DA0289BAE06826B521FB0738FA7193B91C750963EFD5CEB17C52631DB4364D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692780, "uuid": "f3dad326-9493-4b70-8d27-799ae5b7e161", "value": "38777b3eb947cc68a2158922f2c92579", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692780, "uuid": "2e4f12a1-f9a4-411e-92dc-60349b372309", "value": "1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27qWrf:bav9OdPx8wJ4rm7qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692780, "uuid": "041da0e7-b7ce-4d5f-8bfd-e1d10f84f321", "value": 116226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692780, "uuid": "1b01775d-c01c-4048-8365-85b6959da529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692780, "uuid": "ee9097a6-a42b-4223-820e-998a4693c7d2", "value": "42b1d6f247c41e52d052634d99315e2d943433461371cafdff4935e4cc58dbef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40de442-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Dinwod)", "timestamp": 1712692781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692781, "uuid": "e0e4c405-a077-43e5-829c-ee0116639d4c", "comment": "Malware payload (Dinwod)", "value": "812b1b347e017a6ec4c70711a3021f8e", "object_relation": "md5", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692781, "uuid": "8c58d8c7-0b2d-48d8-8dc6-4e1eae6d844a", "comment": "Malware payload (Dinwod)", "value": "42c2d8d62b43279fb1d5ac47289f110c83c15194fa98eb9bd338b2af88fb6095", "object_relation": "sha256", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692781, "uuid": "f45a3553-04b0-4d91-9890-ca35f1c48767", "comment": "Malware payload (Dinwod)", "value": "5aa153e9ce0f8c53ea8e167caa627ce3830bf1a4", "object_relation": "sha1", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692781, "uuid": "ff82685d-9333-49bf-8b25-5239216aa040", "comment": "Malware payload (Dinwod)", "value": "c83ecd6f3ee112baf1c8db1ac33e5fe0253656361be5aafa536727077044d7b44999cca783b7b7a299ac22ecb001893e", "object_relation": "sha3-384", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692781, "uuid": "b4fb2240-26e5-44cb-bfe0-984e41d373a6", "value": "T131D3E722E51288F6F02D06F557F2073C9978876368B25A6FCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692781, "uuid": "1a9410ea-dbd0-4227-b2f9-2f6b1471b7bc", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692781, "uuid": "185eda88-f715-4fb7-9d05-bc448f804759", "value": "1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkgEX:OqSe5OmiEoAcCbZ6Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692781, "uuid": "abc1414a-487d-4d8c-a92b-ffabb1792cf7", "value": 139925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692781, "uuid": "de22505c-0d40-444c-864b-7fcdcd187368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692781, "uuid": "f0ede4c5-9e57-46b6-9d1d-0f51cc66955a", "value": "42c2d8d62b43279fb1d5ac47289f110c83c15194fa98eb9bd338b2af88fb6095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c5cd1f-f698-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712684699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684699, "uuid": "fd689ba9-05e9-4bb8-86ba-72b5d9ca21b2", "comment": "Malware payload", "value": "c6b39ee166d5b0a2c8a9021ccd1593ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684699, "uuid": "0920ea8f-8edc-43b1-9eb8-7ee80992d750", "comment": "Malware payload", "value": "443b665c5f545a2bdd7855f86bf70a5ee7f35eda1b6b08615161f5809cbda02b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684699, "uuid": "8a065fe6-b154-43b5-9265-908fdfad7809", "comment": "Malware payload", "value": "e480e7c282f64e8b0179c82afe154dd59d14217d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712684699, "uuid": "c125123b-1f17-41f1-9d70-7a3103786220", "comment": "Malware payload", "value": "38a688f32ea174402ca00bcc742f78e4193644e0d3982f8a74e7698521daa9f059eb7ab769c7bed23f971f15deb54928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684699, "uuid": "541f7410-162e-4abe-b50b-c0e3874732b5", "value": "T1A7F5339F6EBB3C2EFD8960F62D73A5BFB74307546FA21538A9649D0F3844E017A12910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684699, "uuid": "2d159fdc-c342-4368-965d-7c4bf1ab65c8", "value": "9ae539390e666701a9c361fdd5dc074e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684699, "uuid": "ab7cc36d-a31e-4e6b-b949-66657d735a9b", "value": "49152:Kl0nJ28J4VZohYWVGGjW8NhSU7zwo8oXJ2R3KPHsI7coj2J+eNgRpqNc1a:KmnJrJ4DohYWVTJNkIZZ2R6vsmA+FDqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712684699, "uuid": "1704fb46-7230-4c9e-bee8-dd235e0a4fb1", "value": 3575312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712684699, "uuid": "81772952-73c0-4009-9ce1-207a035ddbf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712684699, "uuid": "1b9144d8-dd25-45b1-bf5a-29293c1df5bc", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0e50e8-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669551, "uuid": "6ea4f355-5f99-4133-9c23-7a524fa10bbb", "comment": "Malware payload (Gafgyt)", "value": "13eff15052156f8371af7fe947783e9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669551, "uuid": "a1355d93-e780-40b0-a406-5679c8434a1f", "comment": "Malware payload (Gafgyt)", "value": "447d353ce891f4953bab5e5473cf35064ff9bcdd6ca2fdc65ab84bd325616f58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669551, "uuid": "f8e928a1-c1e6-414c-8d39-d98115ce537d", "comment": "Malware payload (Gafgyt)", "value": "5d4ab606d7073ccd4fea9dcadf412306bbb69903", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669551, "uuid": "b1c52654-722c-4790-a154-5cda8e876aae", "comment": "Malware payload (Gafgyt)", "value": "b232a80822ec7f6a4cbb4a77a328d5ce494955e0ed06d54fcb58ebd9676448fafe12d4402933e9457f0cd33779de7eab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669551, "uuid": "fdde56e5-eaa1-4944-af66-24eb21de33a3", "value": "T1D4D33A02F4504757C1D2177AB79F520D37236BB987DB3312AA346EB42FC179A1E3A9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669551, "uuid": "6fef2d82-0a65-4dec-b26d-42d313ba5725", "value": "3072:jd+SqaD0nztKJpzAHR+ushO/+8sptjmWQ9AKXNY8:R+SqaOztBshO/0jmWQ9A8NY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669551, "uuid": "64725ef4-94aa-459d-8d5a-4181ea47de9e", "value": 133107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669551, "uuid": "21dd691e-cbf2-4367-862f-adfb08c724b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669551, "uuid": "fbcf0b40-9b95-48fa-a6c7-88cdc7444177", "value": "13eff15052156f8371af7fe947783e9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af444ad-f620-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712633012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633012, "uuid": "14f19b37-31b9-4fe6-9406-b060e696dad8", "comment": "Malware payload", "value": "085f83bdb85deb6dc049c0d07c5d252d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633012, "uuid": "23691134-faa1-4057-92ae-78f8b0d378c7", "comment": "Malware payload", "value": "44803cad3357a53f9085fb7080ec9babd09b91a3e993b9c70cc7519aa8610e74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633012, "uuid": "e64647e0-75b7-440b-b940-95a84c62f79c", "comment": "Malware payload", "value": "e651291ab8f337a489289f05e7d8b66689ca8ded", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633012, "uuid": "86ee1155-2a59-4bdf-bfce-db689b9e9615", "comment": "Malware payload", "value": "ad2919a99247e9873126ec44a6d8369693bf44c9aa5e1805e1b7b16a2b02a9c05d4c1dcccaa81f5361e2bed6e9af97bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633012, "uuid": "7433f280-e5d6-469b-9d74-78a88dd44b1a", "value": "T13FC14186821B46F3C49713F9D8FE0370EB78E13116297233836C3A1ABFD6D58169472A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633012, "uuid": "9cbfe6ba-1185-4278-969b-5bf28555a16b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633012, "uuid": "ec6793cc-aad6-4c3a-afbf-8422b3b2cd69", "value": "96:36nBzEUPCx7DToaWnEQk+gfPQ9/uQ3KO0jWL:3M6UPS71WnLk+CPQ9RKO0jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712633012, "uuid": "02859e5e-bf67-4342-b87a-cac73a691e5c", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712633012, "uuid": "733f78a6-58a6-4d3a-9ed5-5fd3e9c84798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633012, "uuid": "ee968dcb-39ad-4698-8652-355025b2f0fa", "value": "SecuriteInfo.com.OScope.Trojan.MSIL.Basic.8.24813.1708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ee0ec7-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666204, "uuid": "1f005dff-2de6-4d3a-9b09-e840e1e7f26d", "comment": "Malware payload (Mirai)", "value": "8bb1dfb74d7e61efb9efa9e401012444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666204, "uuid": "744d862b-a27d-47ae-a674-abf549056808", "comment": "Malware payload (Mirai)", "value": "46c23cbc3b66fcf0f870710ccbc475c7aa7a8054ffdcde5a8250913ad775b343", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666204, "uuid": "010dea95-9d67-4aad-9c63-fd34f710bfc6", "comment": "Malware payload (Mirai)", "value": "bae82633bda19774bf05efc3c03f7654627a6c7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666204, "uuid": "394dbb83-f09f-4fc5-a8e3-4ad4e601b069", "comment": "Malware payload (Mirai)", "value": "e938825bc95e29b73ae00bbfb9b19f2e47b6fafa39aa2c1494dc9207f16d7676a559a38fa6d5125bb48b69c2ff307f62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666204, "uuid": "39c79306-2ccf-4ccc-8fe6-d8d8fa1d7b2f", "value": "T118131994B891CA07C6D012B7FA2E518C372663A8E2DF3303DD252F11778B82F1EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666204, "uuid": "0cb5dc72-6b30-4183-aa4c-2045fc242ac9", "value": "768:N8pWwBZD5qrNVKZZjPGCo9IwxTcSPut5L9ft/NPc5bt7eLm:SWuSVKL+7hxTcaut5RtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666204, "uuid": "e858fd29-2774-427a-89a9-24a064adde7a", "value": 42440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666204, "uuid": "c2d455ea-83d3-4c1d-98a0-f6f5ad0fdf96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666204, "uuid": "0ad21ef8-99fd-4ef4-8080-ddacf40569b9", "value": "8bb1dfb74d7e61efb9efa9e401012444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39513dd7-f660-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712660363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660363, "uuid": "b95c07d3-ba62-4bf4-a017-17892c3b43ba", "comment": "Malware payload", "value": "571d1d65b477bac0542e4464ec5670aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660363, "uuid": "216b44ac-3321-4219-8eec-92b7b6de0f64", "comment": "Malware payload", "value": "46e3c980e8b7e329819c50e4735a1fd472f9b73c9405e38924dc2b4bb3c0cad3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660363, "uuid": "25c90be8-66ed-48af-bbaa-c3a4bcc6973e", "comment": "Malware payload", "value": "8aa1e63b59e3bfbd0c1514af3d215c2eb01d3d67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660363, "uuid": "e9b49197-d977-4dbb-af9c-1c43f3a12b0d", "comment": "Malware payload", "value": "16fd8d2544aa348a6ecb588ea8ae206d1633427e9309a6b15ae6a7b7903f9d4c619e0617fc5874e6f9c3339a4fd8f4a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660363, "uuid": "0f4da330-6bab-4bfd-902a-4fe4e0622ea5", "value": "T104359EC8B8A0D6AEE69D9536024D8504D4677B95078281EB3CB7C6CEE3A4EFC4F7245C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660363, "uuid": "05a99be0-bc77-4d66-8b6e-d884bbae09e5", "value": "24576:dfrD7KnzsE0WEDJ0xkualJ6oswsC8pz4kGFkVf:dfrD7Knzd0WEt62J6oswsCYz4kGFkVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660363, "uuid": "5630d909-7b31-4db0-b8de-cccf94470c04", "value": 1062008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660363, "uuid": "bc315c93-4975-4b53-a984-f60119562087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660363, "uuid": "3156fd29-9984-4ccb-9061-d597956047f1", "value": "571d1d65b477bac0542e4464ec5670aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b526ab7f-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692783, "uuid": "d20fd691-fe51-43a5-9b8a-e08b1337908a", "comment": "Malware payload (Adware.QQpass)", "value": "5fa63c913b2741b085e16124ab9fc7fb", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692783, "uuid": "37dd36e5-f3b0-4663-a758-d2c16806d236", "comment": "Malware payload (Adware.QQpass)", "value": "47cbeb29d8888fb7b03a4659ca23aeaca7311d432446e9d9481aedb6cb58a24e", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692783, "uuid": "7b74e885-29bf-4acc-b38b-8f1c735270b7", "comment": "Malware payload (Adware.QQpass)", "value": "093cfbb6b3b83346441bcb7541f55a4314e0bd16", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692783, "uuid": "40a65a7d-37b7-48de-89b8-ead8b1e7ef1e", "comment": "Malware payload (Adware.QQpass)", "value": "fe49f81cb60f3b2a041160fa923a06995f61cf7bd83a7617f4d0d0e97c27ee419d9096185568598b3dc7f1854086aea2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692783, "uuid": "9cd8dda4-308d-4dee-b506-4dae9f7c1222", "value": "T14694B5037221D891E15857FA63FA433879B8975438F0CD23EBE4DD62ADB1522971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692783, "uuid": "1ba00a06-3822-4fdf-bf70-357acf7f2c18", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692783, "uuid": "d6f25b69-f8d6-4013-8197-229474568339", "value": "6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3ZmN:J1R7gpAwsuvDNP/xyqk09TyCcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692783, "uuid": "b5eda724-c10a-416d-84b6-e49dacd9a685", "value": 448412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692783, "uuid": "9dffd7f0-8c1d-4b51-a99b-4bc4c0666f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692783, "uuid": "99b3f1b9-5ffb-4e23-9ba1-2c1883a1ed1c", "value": "47cbeb29d8888fb7b03a4659ca23aeaca7311d432446e9d9481aedb6cb58a24e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b634b433-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692785, "uuid": "0e55806c-ef85-491d-8f95-1fa64c7fa6a1", "comment": "Malware payload", "value": "6c6b6e51e9f864da5c24852642dffdc8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692785, "uuid": "774da620-4b8b-4b60-9cab-418c9dc2bcc5", "comment": "Malware payload", "value": "489b040e2c239b29ef6d2f85f9cde3dd16c5bf638ee012550ac32777d07ea178", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692785, "uuid": "8f993d33-5f63-4e4b-8ba0-dd563d535d3a", "comment": "Malware payload", "value": "2605836b2d4185f99fc5d9c492aa46b0371a09a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692785, "uuid": "bff78253-0fd0-474c-9d79-8f40967f89db", "comment": "Malware payload", "value": "d7568bc769ea6a6d9a3d6dd24147794e7e10bc34c7585184550eb6da4eb670a751d8c25ae032e574c7c8acb6bc485915", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692785, "uuid": "5b79e855-ef0e-4128-beb9-178cbf28a152", "value": "T12CB4D913B6229495E1145BF66BBA073869B8836038B1CE13DFF0CEB2BD71531975E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692785, "uuid": "ec8f2d67-52c2-4534-b235-190b87115166", "value": "3bb3093a5eeb1047bbdd41c02a894dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692785, "uuid": "122f16b5-5f8b-4965-a8bc-1d83bd3b2533", "value": "6144:n0m2FqgDAuSbAXKfz0c0sUIJH1H/yWoDq:nZ2FBqA0z0cIeH1H/yWoDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692785, "uuid": "766d6003-1cdf-4a24-87bc-eb12ceb15e00", "value": 531208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692785, "uuid": "828fe34b-6d8e-4f76-92aa-6c3606edf660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692785, "uuid": "07f17759-c5d5-4ec8-a8e9-b657e6f1d342", "value": "489b040e2c239b29ef6d2f85f9cde3dd16c5bf638ee012550ac32777d07ea178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72c6908-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692786, "uuid": "9c61211b-4126-4f24-bb46-fb2de782fc69", "comment": "Malware payload", "value": "ef19f2fb599ad25a0851e1dc3c15a78f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692786, "uuid": "50fe0993-264b-41cc-8d8b-0918853b1f38", "comment": "Malware payload", "value": "49176ab6ad37d3cf5fe43481bc0551aea17b107dada8ecc9270606c86d414090", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692786, "uuid": "9bdd580f-07c5-45dd-8377-02b665a3ecd6", "comment": "Malware payload", "value": "65af0136ec94eb05c6cea8f66ad5c4694ddd3ac7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692786, "uuid": "eca57563-36b4-4ee2-b28f-e04a6f278827", "comment": "Malware payload", "value": "c696a7a8fa87c5f19929df8ab9e29f56ab435a084e7cb9becd6b0749b608f105dea626101cad11410a1d55573489e7fe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692786, "uuid": "366e349b-9f90-4035-a17d-d545938fcb1c", "value": "T10894E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692786, "uuid": "731f05d6-b9e7-463d-a4d0-b360979b6288", "value": "8c1a89a9ecb1531e781195470aa68b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692786, "uuid": "4c87af3c-49d6-4639-9f17-bf8ebb746a77", "value": "3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKU4:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692786, "uuid": "3eb3b203-87b6-4e7b-b32b-8cc4e66fc0f8", "value": 441993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692786, "uuid": "87664507-03cd-4ac4-a1c6-a60ceec776a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692786, "uuid": "82b0db09-946a-457a-aa50-0e9866151fbf", "value": "49176ab6ad37d3cf5fe43481bc0551aea17b107dada8ecc9270606c86d414090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8249ecb-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692788, "uuid": "831d8cd7-cd30-4088-8308-d5cb3780d624", "comment": "Malware payload", "value": "268b1ec67cbc6b4dd8252c23c22d2dc3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692788, "uuid": "fa6b13ce-068b-4742-934d-cb15acc030d9", "comment": "Malware payload", "value": "4957a2d9890961e9ece856b254f940b1fdf9dff9e4927a38d4337a6e6e2a5336", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692788, "uuid": "6e40166d-8e94-410d-8f08-1d21595b0417", "comment": "Malware payload", "value": "71306af04bab93875f66dbaf4013c0ecdd63ffde", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692788, "uuid": "3fd64be2-4884-4f9e-b800-365b36510395", "comment": "Malware payload", "value": "a813edb52e6167c2209ee30d8ae0a153fe591068d4794053c2ddf1756733f971ec951de380f08f18cb866ae02411921a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692788, "uuid": "0695845f-6af4-4e87-8fd7-41c907d407bf", "value": "T18094D813B6229491E1145BF66BBA073869B8836038B1CE13EFF0DDB2BD71531875E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692788, "uuid": "b117d879-eafb-4e7f-b111-0fea2c8f52be", "value": "887d6de026e86320108f5c946296e1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692788, "uuid": "faa24881-815b-4c6e-9275-7cc2cc4dea5d", "value": "3072:q0mx45LFnq9qDAuSbAXVkQUQ9oPfz0c0uxNUIqTkHoYCDfxj4/0/yjUuMx8ks:q0m2FqgDAuSbAXKfz0c0sUIJHk40/yW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692788, "uuid": "3285008a-437c-426f-86a0-7b9c5f1e1710", "value": 447393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692788, "uuid": "69aff326-c6ac-459e-804b-f95e8b0e7a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692788, "uuid": "b33089d7-06f4-4c13-84ff-660ef0d5d7d3", "value": "4957a2d9890961e9ece856b254f940b1fdf9dff9e4927a38d4337a6e6e2a5336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5b4f0b-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692792, "uuid": "1f4c1d90-9f19-4471-8b94-a40896c44b60", "comment": "Malware payload", "value": "b4ebbe98abcc4c2888f0c46917c870c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692792, "uuid": "1c9cf942-11ad-458e-91e6-52b282f331b7", "comment": "Malware payload", "value": "4a18ba49021a964bce07d237b348cc52433839dd8e35dddd92e655b2991a871c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692792, "uuid": "ce3f2c1a-e701-4b71-8caf-4cebaafafeb5", "comment": "Malware payload", "value": "d6d92f55b16b71ab30a5c13a12c1850ba75aaac2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692792, "uuid": "82d427cb-edc3-4aa9-8a73-b43648492260", "comment": "Malware payload", "value": "d81765f858a82d59e1deb6d44c9fb1aa82fa23c158a15717fa55b09e10b3da2103d3d47ce519b0644d5b5545a27af25c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692792, "uuid": "64937e0f-23bf-4011-b7a2-94c438b0fc90", "value": "T1A2D57C137230ECB5FE0C1A7685BD4735AE78115838B1C6BBF7A1DE76AD71A018722A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692792, "uuid": "260f3950-2e8a-4947-af83-b01e23240f09", "value": "39399841b9c8e4524dc461ff9b66709d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692792, "uuid": "ee4904dc-6555-40cd-8ee3-1cbf12d48e69", "value": "49152:pF+P9VgqrzbfDULyOPtjN/lXekpomFsEB7yOrRBST1WjyU:n+PfRELyOhN/lXe4FsNyOWWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692792, "uuid": "2ee097a5-7b7e-495c-b537-b3fbf326a63d", "value": 2974384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692792, "uuid": "59b27ef6-a8e9-4c92-b9ec-daaf904c519c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692792, "uuid": "e7ff7421-3b5d-4d86-a358-2e0a575c09b1", "value": "4a18ba49021a964bce07d237b348cc52433839dd8e35dddd92e655b2991a871c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2241663e-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712671921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671921, "uuid": "3f25455d-ec19-4e53-88e3-0178c9d98380", "comment": "Malware payload (Gafgyt)", "value": "ce197ae6000e6d3d6fdffddaeb28134d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671921, "uuid": "5b45bbfa-9bf6-4968-9e0f-299310d8fd9b", "comment": "Malware payload (Gafgyt)", "value": "4a4cf7d05568da526ae29f77c8dcc0b8d1ba46d1e047a624de8994069590dcff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671921, "uuid": "4906db52-b311-4241-8e04-d8997347bea7", "comment": "Malware payload (Gafgyt)", "value": "f43cdce0177134848b7d85a5e358fc4d19931fe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671921, "uuid": "d3542e1e-586b-416e-8770-21e686697dd9", "comment": "Malware payload (Gafgyt)", "value": "fd8a8e79baa3736665e4cda73534d97b812a18f767f2b3a755ca8faad3cc7af0a24393d982e53f9a0dd56beeae36ec74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671921, "uuid": "3529d5e7-f598-4367-b09e-35a0d96bce00", "value": "T1C6B3D707AB51DEB7C85FDE330AAA860120CEE45612E56B6F72B4D96CF70B94E08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671921, "uuid": "e41813de-b356-49a0-b532-4429347f6bc1", "value": "1536:UeeTu2u8IM46rrMNf4ZcrjYYkUNTEM4+rDBlLNzgLUmkiIF8iCKrmne:UEgrGf4d0EMLPZgUmkiIF8iPrmne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671921, "uuid": "3b4b0d74-470b-417b-9342-09647b6b98a5", "value": 108974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671921, "uuid": "a01c28ec-297f-43e6-ad5e-8323806a6d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671921, "uuid": "b4de62b9-92ef-4e25-a1d0-f9abdbf46fe4", "value": "ce197ae6000e6d3d6fdffddaeb28134d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72b399b-f636-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712642508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642508, "uuid": "cfa33240-0186-46de-8363-1acc05d21c57", "comment": "Malware payload (AgentTesla)", "value": "193d8980d903b4366a3a15482bc55ce4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642508, "uuid": "3afdf161-8f3d-461a-8d86-c6b136c3da6a", "comment": "Malware payload (AgentTesla)", "value": "4bf870740bff823bf828afa76b92547b9c862a08a95d78af51aff49cc2823db7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642508, "uuid": "c783aac9-39f7-466f-bc41-2fb721999dee", "comment": "Malware payload (AgentTesla)", "value": "55e5866d9ee6bfa9cd376613af263d5f9864a5db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642508, "uuid": "ba9c0a60-7afd-4712-a112-5298eacf5d6c", "comment": "Malware payload (AgentTesla)", "value": "825292e678d623a64aa8aed25ff4ab401b522d6df979c89d628f8723a96bb4adcabee669c1e2cd3ceb4261c4ac61c003", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642508, "uuid": "e7ef83be-7e9b-477d-81e6-af31a8adb859", "value": "T127F402031AEC7ED6C1389BB4773BDBD0C36DED1A1461D51D6AE821D680BD603BA12BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642508, "uuid": "0124c9d6-48df-4423-922c-c0913336886e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642508, "uuid": "c27e75ec-ae90-40c8-914b-62668cc58840", "value": "12288:qB1oVeonJhtVINz4uPn5oovpXU3CXgCKrXZugjR24cXZEVFDYkBz77B4iNP8:Yo5ntVINz4vGpXU3lCKLwgF6qVFFBTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712642508, "uuid": "acf38aff-18f5-4ce9-a732-8b189205598c", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712642508, "uuid": "241e09d1-3092-47ea-bc90-b96e9fe34ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642508, "uuid": "76daedf9-f7f1-4885-b317-dbf65b6a29d0", "value": "4gDKJMVuL261gKx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d103ab68-f619-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712630123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712630123, "uuid": "aae40d5e-f97d-443c-837e-6b8d3e50ee94", "comment": "Malware payload (Socks5Systemz)", "value": "24ece7cd0043582e4a96824fa50dd3fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712630123, "uuid": "a5574464-fd4e-4319-862e-6e45b00b6325", "comment": "Malware payload (Socks5Systemz)", "value": "4c02dfabc290e94364fca573f0e2a9631eb5042e4f6881d2b9b0784f0e7235da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712630123, "uuid": "627d4b58-08e7-48b5-b569-ba887d04e4a6", "comment": "Malware payload (Socks5Systemz)", "value": "e2300dbb459199e1ad91b75fb17a4c184ac03851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712630123, "uuid": "907be868-6d17-4791-bf0e-2f1518f64358", "comment": "Malware payload (Socks5Systemz)", "value": "8686e9d2d3687b2c6fd22aac964fab9e2f42a7adf2386c52f74591b7b3976957435b387b9d614df313d438a27ef21bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712630123, "uuid": "2d7b28eb-84f0-424b-b509-7c6cf1b83e59", "value": "T1CD1633F0D4CA083DE8A2DCB20C43526CE32A7A279D99531F65FDE9DEB9815F48943349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712630123, "uuid": "4cf71a0f-3285-4084-9e47-173ba61aec30", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712630123, "uuid": "98000ff7-5e65-45a1-81e9-54d67cc4be75", "value": "98304:CL3AWWk9TheE7I19NeTvwH+wG2r4rWxp0tygDqwb23+ydQxE:I3AWMEc7T+wG2rJ4ygDqibuQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712630123, "uuid": "617c784c-01e1-4f1e-8d42-2706fe6d54a9", "value": 4407143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712630123, "uuid": "2bf3440c-a39e-4691-b385-6f0707ed6aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712630123, "uuid": "027b2aaf-0096-4ce5-91c9-618f79f4f05e", "value": "24ece7cd0043582e4a96824fa50dd3fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4d2d68-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692793, "uuid": "41da7535-8cd3-42b4-9e8a-01a581191ce5", "comment": "Malware payload", "value": "dd06bb4b48a5757f4f1f1e6c19df7d78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692793, "uuid": "19af1db5-9744-44f4-923a-b3f29179a672", "comment": "Malware payload", "value": "4c4fe328151c983167ab72e92993a3eca6960a3ebf298ee67bb7b0776e251280", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692793, "uuid": "756729d7-e34b-42d9-ba35-89ea0859087c", "comment": "Malware payload", "value": "b252a4ee55dfcdd04557556cef11ddde598fb8b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692793, "uuid": "7991b825-7ecc-4b22-8705-e8a58b4ff140", "comment": "Malware payload", "value": "ea816b548d1c3d166442f9db6f25c805ddc31ae82d3b17fdeed7913b5f24e7eb8d5dfeb5944f587d7b4bbc140d9da6c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692793, "uuid": "a1411446-2bef-4312-adae-78dbe6a87388", "value": "T10AA4960376219491E1595BFBA2AB433879F8976438F1CD23AFE4DD71ACB1121871EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692793, "uuid": "80432769-6c7e-41ca-809a-98804308e5ba", "value": "389bbcc40b5789b0e933ff4aa418caa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692793, "uuid": "2302f064-33b4-4b33-8801-5489b1e6ec7d", "value": "6144:3vbuWQu/cuaS2l8iE0B55FrJJJekPdJ0/21AgeXRa:3vqWQub2lrE0B55FpekPdS/2Sna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692793, "uuid": "a019b290-257f-4dd2-b70b-dca50b760ea7", "value": 483008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692793, "uuid": "818ccfa1-b7b1-418f-bee7-e33b020581c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692793, "uuid": "032ab2cd-6868-43ef-97cd-8a4cd13311a3", "value": "4c4fe328151c983167ab72e92993a3eca6960a3ebf298ee67bb7b0776e251280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4018e6-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692795, "uuid": "832349d4-888d-41e2-bd5c-a3a9901dcd71", "comment": "Malware payload (Blackmoon)", "value": "355d2ded45a14353d8f45b36d2ba98ee", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692795, "uuid": "f535c57a-3ae0-4372-ab7a-e46c4087922b", "comment": "Malware payload (Blackmoon)", "value": "4e41422bb2b4d06ee9d73a82ddb4bb23d2a57d76f4a04d8fae29293ec3a309e1", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692795, "uuid": "5661e318-ab92-424c-949f-d90290faf6d8", "comment": "Malware payload (Blackmoon)", "value": "caefd74e1104c5f5ffa0d375c043b5974195692c", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692795, "uuid": "52f6fd1f-7ebc-48e0-964e-2f2aac2d190e", "comment": "Malware payload (Blackmoon)", "value": "0201ee886e8a1e7aaff9c6368d9df9d1747fcad0b5c07f5d45559fffba2f2d50eec84a4b95fc3e6c416b103df312d26f", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692795, "uuid": "0d6bd420-e8d0-4d43-81d3-938c9521c006", "value": "T16984B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692795, "uuid": "42375805-5632-404d-89ae-ce15a84a8324", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692795, "uuid": "5512b292-5305-47a5-b70c-7dfd9572cae1", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1w:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692795, "uuid": "cd45a701-6485-47c1-b97f-fa8f94c06c40", "value": 375488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692795, "uuid": "4e4cb88d-5c63-4546-9e2b-b96c8fdb8735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692795, "uuid": "849c3b4b-0a28-4501-b390-3dd50682c28a", "value": "4e41422bb2b4d06ee9d73a82ddb4bb23d2a57d76f4a04d8fae29293ec3a309e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0983d8-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Dinwod)", "timestamp": 1712692796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692796, "uuid": "b764016e-da63-4746-a0f1-77fa5d19b74b", "comment": "Malware payload (Dinwod)", "value": "5771eef64d4275f6bb2bb57c5ef51d7a", "object_relation": "md5", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692796, "uuid": "5f3b5b83-b2a9-4dd6-a550-598617575db2", "comment": "Malware payload (Dinwod)", "value": "4e6f4737e8a6e8dec929ee88fc23152346fa56c5629feb6d83160d77d62c18c8", "object_relation": "sha256", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692796, "uuid": "1a0606c4-aa3a-4f25-b69d-d3fd5dcbdc13", "comment": "Malware payload (Dinwod)", "value": "fcd28fe49086fbc6748fb1505abbe50f99885ea5", "object_relation": "sha1", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692796, "uuid": "b1145b5d-17fc-4d2b-ba53-116faab00f72", "comment": "Malware payload (Dinwod)", "value": "d4f8d65191eeb0381154d63c1391b94629090b962ef898217173c0c0d6931b030c5ace5261687522a8e0be70cefeb7c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dinwod", "colour": "#1DB099", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692796, "uuid": "469f76fe-e0f9-42ac-ad2d-9f3d7753637b", "value": "T16DD3E722E51288F6E02D06F557F2073C997D876368B25A6FCFE0CDF01EA62324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692796, "uuid": "7748ed9b-34e2-4e8d-909a-0b26506a227b", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692796, "uuid": "8743e4ce-120a-49d2-9eef-f24fd54c6c3d", "value": "1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkCO:OqSe5OmiEoAcCbZ6DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692796, "uuid": "d577c8a1-b2c0-454d-abb9-6b0052f45d97", "value": 139824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692796, "uuid": "8d5139fa-8b1a-407b-ace5-1dcb2db086f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692796, "uuid": "a7c7365b-3c40-47c8-b7cb-8a3b3fe9479b", "value": "4e6f4737e8a6e8dec929ee88fc23152346fa56c5629feb6d83160d77d62c18c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f5c5fb-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712669912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669912, "uuid": "44b1bb54-d061-4ec2-a61d-a04f1f3ebb6c", "comment": "Malware payload (Kaiji)", "value": "b1b2898acca53f365f39ef751b8f2a58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669912, "uuid": "84aa4734-6337-4357-b4e8-dd297b6d9342", "comment": "Malware payload (Kaiji)", "value": "4f9e534553d719432d01069ad1db307430a1a177cc5dee657704b535686d866c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669912, "uuid": "642a1f2d-98bf-4f4f-b5ce-948500648f5b", "comment": "Malware payload (Kaiji)", "value": "5dad638a5366fcc45043ed1733ef7715973bd71a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669912, "uuid": "e4bbd758-a124-4008-b91e-e413f10026f0", "comment": "Malware payload (Kaiji)", "value": "4a47a202ad2d39309365062feb78bf09ac7fde9640bf3453a67c44cce31bd70ed5e2f6146c10f2a449e1c1648af29a27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669912, "uuid": "6374f33e-69e0-4ede-940c-d8d706188630", "value": "T1D2364A50FECB44B6E9031E3154ABA27F67319D054B24EF93EA14BF6AE9376910D3220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669912, "uuid": "161f3e07-c3af-486f-bb6c-96a24307dab0", "value": "49152:Xn7PeM/wNyWyHKjl6CKIWFNLTlPCM4So2eTXYy5VrFKpZy1I1:XDNgCqjgCMtnte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669912, "uuid": "4b9fff6d-17f9-4896-a687-bf18d809421d", "value": 5206016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669912, "uuid": "60edda6f-8694-420b-816a-056fba91509e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669912, "uuid": "4d30358c-ff1f-4a91-8727-689e0761daad", "value": "b1b2898acca53f365f39ef751b8f2a58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c017709c-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692801, "uuid": "e058a2cb-9236-43af-9edd-f87fba161722", "comment": "Malware payload (Blackmoon)", "value": "617d68d9abfb708c675248e2942e91ed", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692801, "uuid": "92384047-30d0-4d02-921b-a20042680120", "comment": "Malware payload (Blackmoon)", "value": "50f09996e79d66c7dc71272a855bee32d3b5f49290d8a03a190f8ff730207a1e", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692801, "uuid": "0b94e8d2-f816-4aa8-96b0-8c28ce0b3b09", "comment": "Malware payload (Blackmoon)", "value": "8e8f3548da8c3c5e6bb978e7c044af4720b9d7b0", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692801, "uuid": "30623739-19db-458f-b86c-65fd61c9919d", "comment": "Malware payload (Blackmoon)", "value": "e153773bfa08ccefc15c27a0bc623c87c78a8204cc46dec921e3a663a82cd24c912c3a682769c36649ce5b2b451b0020", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692801, "uuid": "f03d0ab8-d680-46b6-a895-5a37c5daa91c", "value": "T15A26BF23E142C0F1D11916B022B65B3D6EB49BA11D35CEA3EBE4CEF46C72562D76720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692801, "uuid": "7702648f-b9d9-4f26-8e78-38a175b24c11", "value": "f5bada5766018961e0f96519c1736334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692801, "uuid": "2ece0c29-5046-4cdb-877d-f834f4d3a889", "value": "98304:c5vXjjmrDuPkDLMinEAAvAF6RK491PM+1Udy6V:c5vOnuPlKkK49m+1GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692801, "uuid": "3be679ae-4509-4f05-a79f-0410941252a7", "value": 4456448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692801, "uuid": "b73e7be5-3a3a-48c5-b2f6-b9dbeab3ca70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692801, "uuid": "25b0e852-f4bc-4552-a924-3921dbb52884", "value": "50f09996e79d66c7dc71272a855bee32d3b5f49290d8a03a190f8ff730207a1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fba644-f69a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712685590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685590, "uuid": "c948874c-1a9c-4d71-9ff5-e2750b576319", "comment": "Malware payload", "value": "bc181331f428bb02109541c553c07b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685590, "uuid": "f4e7a3ab-67ed-478c-a439-dfeaf2afd66b", "comment": "Malware payload", "value": "51298c3f8bf5253334c02f9ac1c3f5a465e23707d6c063515a7defc1a3a50a91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685590, "uuid": "b950fb76-bb6d-4780-b4ce-bf72481e4d48", "comment": "Malware payload", "value": "d6c1a161f9a60a357cc5c7d6cc5febed12f19eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685590, "uuid": "4c413fc3-bd4e-41dc-bb1a-7eacceb615a0", "comment": "Malware payload", "value": "b81f961ba08866a0f6069d62f912100d95789012b113b1d0f2a94abb1963854ac770b90ef9bbd9cc54654c40575929cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685590, "uuid": "ac435202-1a90-4d07-8f5d-dc8bdf7ef546", "value": "T11808339C6FC0B942F4EC7FF9592B7ABBE323904D5ED00D8231A856C26C36D571D1A226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685590, "uuid": "99109ed3-832f-48dc-a0c8-fcb8bce6512c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685590, "uuid": "dcb2d25b-7d1f-4e7f-8b92-e2226529d96f", "value": "1572864:946LBYjCvct2YQi2JrydyxvgJnsI0SNcucgzxTMWIyeKx:9LuCct2R3rEySJnsqN0QMWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712685590, "uuid": "7f8172f1-4732-483a-a403-837f0e826ca4", "value": 78054153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712685590, "uuid": "745dca61-8e2f-461f-ac41-8be3f2477c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685590, "uuid": "844264a7-42cf-44f0-b86d-514806275931", "value": "SenPalia Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586def80-f682-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712675018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675018, "uuid": "581a47b7-849a-4037-8c43-64ca00c82bff", "comment": "Malware payload (CoinMiner)", "value": "5409f72e075bec090447d6142c3a57e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675018, "uuid": "ca0b0920-13a8-4617-a78b-0f9d25b18dd5", "comment": "Malware payload (CoinMiner)", "value": "51cb34c71bb5045fe7b025f369f43d1a39ef4ea7026947235640b1c948c126d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675018, "uuid": "ce667639-b009-4b98-8ced-e86c30f8ba05", "comment": "Malware payload (CoinMiner)", "value": "e2abce06535f917af91f1aae951ba50be5daefd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675018, "uuid": "b073d25f-c6ec-4c2f-863a-dc2d5d6c1014", "comment": "Malware payload (CoinMiner)", "value": "b0eceb3669e07b7f711fd8b0e916d6c7478f987fa24b1f9d8883103ef6314b6aee9663471efd1affd5f61cc56138c2f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675018, "uuid": "69979ecb-abc7-4d8b-a6a9-b2a0abd952bb", "value": "T1DF668D41FECB94B6D9431E3040BBE2AF57316D054B24EBC7EA407F2AE87B6951D36248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675018, "uuid": "d1b586d8-21f1-4fc3-83ab-de5e22b0e07f", "value": "98304:ZkJeiVoJJ7zOz95ijBW2goekQQW4aTGXjv:ZWU+ijBWkW4OKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712675018, "uuid": "e16a9fd1-c3ff-4cf9-9bce-2353d8e5c13d", "value": 6782006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712675018, "uuid": "adc8d1d5-ecfa-4bce-8fe1-a49fe28ba1df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675018, "uuid": "a8bc8310-9860-463f-bf0b-d300e2cb819c", "value": "5409f72e075bec090447d6142c3a57e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1064470-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692803, "uuid": "48708f09-7caa-4450-b98d-68dd64b19e23", "comment": "Malware payload", "value": "620f9f7d7eae1a7f622013c5cea15458", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692803, "uuid": "ba1f6c83-ea81-4da2-bc27-13f4813e15aa", "comment": "Malware payload", "value": "5340a89812d0865b47b449e9db9c834ba8fea5717cf4e271f66be5a288399d98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692803, "uuid": "ce4a34cc-9974-42a3-a74a-b73a15dfe1fb", "comment": "Malware payload", "value": "6f582e4dec7e62d950d85607fe522692f6d13702", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692803, "uuid": "1ce8b689-9e06-472e-8475-f9194ef6580a", "comment": "Malware payload", "value": "91f82a634cd516ee8787d77283dc60363566ac7261bbfa742eb01d31639342089b46a212bc30999ece1429bb6cede6c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692803, "uuid": "51adda28-7b94-48f7-b1a3-16e2bee4712a", "value": "T1A4748E22F4D0C8F2D26611310EB25B3AE2F5ED3019728B13E7D8FF6A7E78556861B146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692803, "uuid": "af130428-892d-4450-925f-931e36a8458d", "value": "80b69be2bc873884492028ff7ce272ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692803, "uuid": "87d1646a-99ee-41b8-be2e-32b62a16b9c7", "value": "3072:zodLe4TZUfOFp17Sm0vizvH1F6boUjp1vUFqtjmuGgcUQDGY8z3YuVNw9U4vE:zb4S+1MvyrbUiqtUUQDGY6Nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692803, "uuid": "d70cb276-21ff-4183-8618-a11afb9aca33", "value": 357409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692803, "uuid": "4a143d30-ebf5-47d1-b517-fd5b3db5f9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692803, "uuid": "35b718f3-ccaa-4809-8f7e-5088c69f2fae", "value": "5340a89812d0865b47b449e9db9c834ba8fea5717cf4e271f66be5a288399d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53042bf7-f65c-11ee-a120-42010a9c002e", "comment": "Malware payload (Latrodectus)", "timestamp": 1712658688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658688, "uuid": "aac7dae4-2ae9-48ea-a8d5-b86794e09c5a", "comment": "Malware payload (Latrodectus)", "value": "f00be5bdf8939065ec8db3cfaceeae8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658688, "uuid": "140efaf8-9a75-4df6-8f3a-7ad552e8fd32", "comment": "Malware payload (Latrodectus)", "value": "53b0d542af077646bae5740f0b9423be9fb3c32e04623823e19f464c7290242f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658688, "uuid": "c184e46c-4eac-425e-8c88-a9376a5c2db0", "comment": "Malware payload (Latrodectus)", "value": "e02914c3c90218fdf245afe78b33a944d3a1505c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658688, "uuid": "17c69092-8958-40bd-bf2d-22544de76f64", "comment": "Malware payload (Latrodectus)", "value": "d88da4d4efe72024e186f7271200834c449c92df83a6171e51ccee8283f688d38708974d8b895711742b59cd8a9b2e36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658688, "uuid": "7db110ef-ee97-4f51-95f1-b11085e9bae8", "value": "T164332D97DBA261E8DCBAD174C653762BF8317C4C5038BB0A9F519E125F22B34E42D744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658688, "uuid": "a817797d-f843-4a26-b331-e1b84d4328fb", "value": "db7aeb75528663639689f852fd366243", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658688, "uuid": "f5d2450f-6ca4-4241-8948-237d220bcf6c", "value": "768:6iC/DyfvDF9JN1l7zub7+IJSuCMajTiAmPbjQLVhs1f6l:1C/DivXDOJSuwjFmz0LVhs1fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712658688, "uuid": "4d73ee75-d4ef-437b-ad8e-029bf2b3bfc6", "value": 54570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712658688, "uuid": "dfd1c65b-a81d-42ed-81af-404eae13cce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658688, "uuid": "60287f3e-8b3b-49da-867e-df61a68f95d1", "value": "53b0d542af077646bae5740f0b9423be9fb3c32e04623823e19f464c7290242f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940f816e-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669535, "uuid": "ec92a85b-bd47-4c51-a9c2-b6a7e139c79e", "comment": "Malware payload (Mirai)", "value": "99f119494837b4db2a9f6c26a7c4cf83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669535, "uuid": "58872bcf-8cde-43cf-bb0f-c092a758bc47", "comment": "Malware payload (Mirai)", "value": "53f578088fe4e1b9ef9855972696ea52653e4822941dbfff9fca27c3f0b9d349", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669535, "uuid": "402d6d90-d3bd-46b2-9f94-f7266ddf7264", "comment": "Malware payload (Mirai)", "value": "aec2e4201ff3933f75fb3fe5b8ba5e20ba513ea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669535, "uuid": "d2458b63-dc92-4e70-a6c2-3f7147644e43", "comment": "Malware payload (Mirai)", "value": "b08a6c38ed7322ee6d16c1bd29469e093567372de8880f500fd780442ed0f95308739fdae0b93614c3cbda8ffbdef31c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669535, "uuid": "231c597c-133f-4976-972c-0eebec52f3ef", "value": "T195538D75D11DAEA8C0414AB4A9198E704F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669535, "uuid": "094ce3d5-58fc-4247-8554-2e09f2c4bdc7", "value": "1536:ragXV1f1Fl/wtknhPQauiufs3Ii3O/qyD6EZeCc:r57f1b/jQHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669535, "uuid": "4368f641-97d1-400c-9bf7-c3d38a5cdb7b", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669535, "uuid": "49f16d41-b6f7-4ecb-a3bb-66395a2e9c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669535, "uuid": "c6989271-7406-40d9-b10f-91027edf616b", "value": "99f119494837b4db2a9f6c26a7c4cf83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d497a0b3-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712678662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678662, "uuid": "44a4646c-03a3-4e37-9710-2863247cb380", "comment": "Malware payload (njrat)", "value": "4b451f55b91f3ae204a72318241d7039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678662, "uuid": "6d020e56-f9cd-41f1-8bf6-16e83f475dce", "comment": "Malware payload (njrat)", "value": "540d2766cb07a2966c269e3aa400ae7817452eefb9d21f1c757b9579ae82f414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678662, "uuid": "6b90c0c5-859d-40c7-99dc-c35544b446f8", "comment": "Malware payload (njrat)", "value": "23a8154984c68b94849ccd8285f40ab1c35527ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678662, "uuid": "b4a7d33f-d67b-4885-b4c4-e6c58b2cd551", "comment": "Malware payload (njrat)", "value": "55650163dc6778848215fb94c6f4e6c43f0efcb3270f40c294bbdb41ea4cf651b5a5ce748e4210eb1f56c00671657449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678662, "uuid": "e8cb5116-443d-4044-8fd5-a490f02c4dfe", "value": "T167E2F74677A54229C6BC5BFC8CB313110772E3438432EBAF5CDC98CA5B67AD04255EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678662, "uuid": "2ddccadd-110c-41e4-bacf-3d3edc5017cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678662, "uuid": "f1b0715e-a77a-4508-806d-c7ad0d317da6", "value": "384:C0bUe5XB4e0XuOPhiaXLilpknDAWTEtTUFQqz9yObbi:bT9ButkaXWlZwbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678662, "uuid": "57519e1f-1f53-4f74-9d8a-d1765e98870f", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678662, "uuid": "77938fc6-5b3e-4ed2-a086-61cc58bf5d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678662, "uuid": "0e6d32dc-7e3c-4ce2-bb5b-8879aa098413", "value": "x5c0nbtB9z0G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f11c32-f66e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666523, "uuid": "73634220-0f7f-49be-a218-1474f5efad19", "comment": "Malware payload (Mirai)", "value": "cdc6871c94aa49f9b99d3918e68c1b09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666523, "uuid": "1ae3101c-5fb2-496d-8d0d-00a7c1577a97", "comment": "Malware payload (Mirai)", "value": "546ac3297d55722a9b4895d13d4beeff66828c6c24b6946486aad0d2e6506709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666523, "uuid": "fd66d321-27c9-4d8a-a5d4-a799bf68642a", "comment": "Malware payload (Mirai)", "value": "a9b00ad9d8d5c1acc68a4d7fd24a6cf3f1083b71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666523, "uuid": "95bbfdca-4227-4256-ac62-048c19d7aa34", "comment": "Malware payload (Mirai)", "value": "f44ae36ab68d65d6d4db2008947517fef5437c60b3f61e59ced9ed17b5d23113cd31c1291f2b21d7054a2183d14cfb98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666523, "uuid": "f7adc70b-5cdd-4f24-af37-757d857ae040", "value": "T1F9035CC59853D9F5EC11017124B7FB338B36F53A10AAED8BE759D532BC43A06A20729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666523, "uuid": "bd107ca4-e818-4252-ab55-6e40638bc7c1", "value": "768:fyDwe2jd+xIPTWrC8QY1Fsu2cUiCDwV3gYqXGhV5Ig:Awe2j02PirLhYHDwaYGGhvIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666523, "uuid": "54d84cfa-3a75-48d2-9164-638246063fab", "value": 38832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666523, "uuid": "63a0c827-cece-462d-b501-4074da2d68bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666523, "uuid": "8bcb42b3-6949-497e-b5db-f901d1fd536c", "value": "cdc6871c94aa49f9b99d3918e68c1b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ef6475-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692804, "uuid": "d1561626-f973-42f2-be9f-4487b39d9f26", "comment": "Malware payload", "value": "fa3e625d46a4e52f0ce92b6ac1f4166e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692804, "uuid": "d046df3b-43c8-4f4a-a85d-b643e0e33079", "comment": "Malware payload", "value": "54a456fd7e0ee2d00e55c8bac237267d11ef4f21d9b6dde5ed6cee26516fef07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692804, "uuid": "8374a11a-50ae-47ad-8864-9701a2d2eabb", "comment": "Malware payload", "value": "b8d561dacaa1d44adc873f014ad55423feb3c880", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692804, "uuid": "5f1a7622-53fa-4339-95a7-03ce0b986712", "comment": "Malware payload", "value": "4d470d3323be9fc4db5760c82aeea81c026ca266b3fed8391326929fc3474c86fc5686cb9e0f6a46b597c46ffeb919d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692804, "uuid": "fb99422b-3ce8-4ae9-a7e3-780144101c2b", "value": "T1C37496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692804, "uuid": "607f7312-6f94-4229-8a72-be4fa05f701f", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692804, "uuid": "2024633d-17f6-4fb6-8616-ef01e96e34aa", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxG:IXdaAqvRwWoe2XjSVvUYuyHWPBsxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692804, "uuid": "6fb0e037-9bab-4cb6-8519-5916b1a5668d", "value": 348092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692804, "uuid": "344321b5-cc0d-4809-816c-eaad9b7d6bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692804, "uuid": "8d63e6a2-ab86-4476-b607-ed819a4eb05e", "value": "54a456fd7e0ee2d00e55c8bac237267d11ef4f21d9b6dde5ed6cee26516fef07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85796037-f646-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712649324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712649324, "uuid": "d09036d1-3d97-46cf-a943-ddabd9861581", "comment": "Malware payload (Socks5Systemz)", "value": "f133eeb1404ac906ff04843908f0e52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712649324, "uuid": "56ca78a4-67df-4596-9140-2970b0879a7f", "comment": "Malware payload (Socks5Systemz)", "value": "5521905702d9ef70717ea0152021e8055f49deef14f3b855468a6449007e552f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712649324, "uuid": "fd875fc8-e721-49ac-98c8-d1ea1d2a40b4", "comment": "Malware payload (Socks5Systemz)", "value": "b7ef0b638bddcc67f45507ddf2764c03f540cb39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712649324, "uuid": "6a91d01f-137b-4a43-8f3e-53bf534f70c1", "comment": "Malware payload (Socks5Systemz)", "value": "34f94cb65514a9e3f36f942dcb6b1c364ad40282d906696901b59e77265eeda69f313d0a81c237e4cee649c720c27b8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712649324, "uuid": "f2d726db-f18b-47d3-a54f-92b2699f6fc4", "value": "T19B06333B86C09578F1C0E871BD38E18B6633393A2A15C24E75DE4FAD8F725885609777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712649324, "uuid": "5f8dd355-5fbc-4b90-84d0-fa500eb01b81", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712649324, "uuid": "3272719d-a931-43ae-b0b2-0081ccf9c25c", "value": "98304:CrGQAazg8E9sKyZI8TiIdaKr1l17UFaC+Rm6K8:gaaz49+ZI+isaIzFMjam6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712649324, "uuid": "063f5f52-d485-4d31-9a3f-fc3908c0b57e", "value": 3886864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712649324, "uuid": "539fba21-2e30-4129-886a-dff74b2bf7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712649324, "uuid": "e54a6ed5-72b2-44c8-929b-081435b99297", "value": "f133eeb1404ac906ff04843908f0e52a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45931871-f68b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678852, "uuid": "60daf194-beae-4a14-9d09-7d35ae53828b", "comment": "Malware payload (Mirai)", "value": "bff3ecb76cafe0910095898345e4abac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678852, "uuid": "a7f2ad87-e30f-42bc-afa9-950307460f83", "comment": "Malware payload (Mirai)", "value": "55283f06790c7c89c0d7f0bb7ff2f15a801f670a4b325e2ca94f3c5a5af06c38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678852, "uuid": "3d560c9d-1fe9-4863-a628-c1f1791b356b", "comment": "Malware payload (Mirai)", "value": "a2a93fdc6e63c0ca569b5d3bad54de69d3f70402", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678852, "uuid": "1ebf04fa-e04b-477b-bcc3-630a52e83f70", "comment": "Malware payload (Mirai)", "value": "252e3fbc8cdb1ec5f4223e7cdc6c082e6b2df12120c78701c337db0c18783a86ec9de0a976b466efc97260746d583b17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678852, "uuid": "5b6fe855-1014-48d7-bb2a-11ffa4e180c0", "value": "T17963AFB2C01E69D8C6944234B5998D791B23F90595B71EF99AC68E928007FFCF90D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678852, "uuid": "4882d0f8-0c80-4ca6-929d-1aeedc647511", "value": "1536:I/+9E/eSxaA3tdV4HqHB+uHXVoU9Fhaj2IHCj:I29UemptQHqHBvCULcj2IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678852, "uuid": "754fd459-7ed2-4f19-a768-a28653be2e1a", "value": 70708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678852, "uuid": "61655e17-4d1e-493a-8ee2-6564b2d4a3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678852, "uuid": "59746222-f0ea-4f9b-9672-3928b9cda35c", "value": "bff3ecb76cafe0910095898345e4abac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39e18cc-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692807, "uuid": "9e5b8721-2ceb-45c2-a068-1cf1e4097573", "comment": "Malware payload (Blackmoon)", "value": "0b4af6bf3596314509ea38bb65b7d622", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692807, "uuid": "cf9b75ee-7af4-4d07-8623-6a0794b238e7", "comment": "Malware payload (Blackmoon)", "value": "55813133f759653a5058c386e8599013168fd95ec185139d952bcae4022e1e24", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692807, "uuid": "9610bfd6-f84d-4d42-a534-8faa46a2019d", "comment": "Malware payload (Blackmoon)", "value": "681e669f8a67b97198607375565adf515c4fd1da", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692807, "uuid": "a3e80478-5fcf-42d6-b9af-9f7615cc22ec", "comment": "Malware payload (Blackmoon)", "value": "41503d77555c905edd12623a05f11b9af6e3db298e8c00ed65c4a172285d57dfc74ff47c24d82e10f7332942e6a67ed0", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692807, "uuid": "ae29e597-1687-4994-a108-ce92185af01d", "value": "T12885CF93F08280F2D92D153814B97B3BD67A691E0935DB8BA762FD765C32D82923710F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692807, "uuid": "1018017a-a27e-490f-8330-3bff9e4382d6", "value": "fa32697a83d3b6688888de5b3cd08e4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692807, "uuid": "2069f94e-f1f4-4c5e-9c28-0a915984e9ce", "value": "24576:HfqMeY3QBhoWYJgIDWAeTkzZ+RkFN/yKBUZZAFDrrqBh3SWgSklWXKBUZx:HneXoWS5ZRN/yKiZEDrKBST1WXKiZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692807, "uuid": "10a8d4b6-c414-42f3-a5e6-2f2abbb175eb", "value": 1841892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692807, "uuid": "8ced3ac8-c3ea-4683-a094-5d99512b97ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692807, "uuid": "6eb8bb01-4353-4f10-af90-8e0a8942cf9f", "value": "55813133f759653a5058c386e8599013168fd95ec185139d952bcae4022e1e24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5cb272-f660-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660368, "uuid": "4aec1710-09ad-48f6-aba0-80353d0b0de5", "comment": "Malware payload (Mirai)", "value": "a7670f9023a03751f4cb0f39bdb93516", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660368, "uuid": "94db9540-204c-428d-9b5e-8f2723ead510", "comment": "Malware payload (Mirai)", "value": "558ae5e9a5c8cf4505be9c1dc00c7482db641c73654c16690dba8a41af861944", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660368, "uuid": "6318e80f-200e-4af4-87a2-9cfeca9bbefe", "comment": "Malware payload (Mirai)", "value": "20b6a30a50f91927daf4ddf786376a147af20458", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660368, "uuid": "96d08ff6-ca07-4479-a21c-5cc8e2e6fc73", "comment": "Malware payload (Mirai)", "value": "83417237aa7b6abf0b26137fa4ba2a626226214b4bce31c07afeb34b08131c9ae836c6efb67bdef7edfde1b004e7d04a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660368, "uuid": "9f83813b-9d2b-4141-bf21-9583dd164a7e", "value": "T1E2B2D0B2B062493097640EB7DBAE678A72871FFCE1E7B1333A2445795BE10167C79302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660368, "uuid": "df00f427-3e90-41a0-bc54-a16d5cc840b0", "value": "384:N1hftcpipwZh5x/onLzokp3njldtMuvcbQ1GTRLms4yOhymdGUop5hU:ntpm3mnLzokjMcc8ETRLmsPOs3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660368, "uuid": "e9cb8d69-adca-48ff-ae27-3e56df152d8f", "value": 25416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660368, "uuid": "3945b148-185e-45bf-911f-4c51bbfc0064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660368, "uuid": "6b8036b8-f8ea-470c-873e-1f05d682c8a6", "value": "a7670f9023a03751f4cb0f39bdb93516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c495603d-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692809, "uuid": "00c102eb-237f-4962-8823-09dcfbc87250", "comment": "Malware payload", "value": "84fde430036f68dc3336eccda01f91a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692809, "uuid": "05bdff4f-6e0f-43b2-97ed-ed3c72965568", "comment": "Malware payload", "value": "559cd7c08e22ad0b0cc72602acf3dcd4485f579d5862efd5574c876c72f99216", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692809, "uuid": "c20d39b9-1f43-4c34-8f6a-88babf0bf888", "comment": "Malware payload", "value": "a98cd9fc7df683499d6618b9bd708bef0092184a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692809, "uuid": "5f7cfe75-0000-4461-a702-33cc2d5ee3ff", "comment": "Malware payload", "value": "32f7c99c21e29db38b4302d6a9df9ebcfbf1da8c95083a727b56fb6b5c3caa69a886729488694b9f0bdc8f4e2065df86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692809, "uuid": "e8f152d0-a24e-46d5-a0d7-cf076a24e317", "value": "T1C6A4B8137221D491E15957FB62EB433879B8875438F0CE23EBE4DD62ACB11629B1EB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692809, "uuid": "410502e8-668f-44e8-a4c4-2c3dc3a4ad8a", "value": "47b8255ad5482cd954f979aad5057652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692809, "uuid": "d5af04c8-f985-40fd-aeac-79e88bf227ea", "value": "6144:Wvk3Q5ibjnNuuXckaL7pbRBkce97awo7L7oVT4q:WvMQ5ibjnwka3pbRC19Gwo7oVT4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692809, "uuid": "99e3dda1-77b4-4d32-a113-4fcf19314622", "value": 449181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692809, "uuid": "12ef3060-bc12-4d56-9281-232b7798345d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692809, "uuid": "26f1ac6f-e1f6-466a-a335-2f5d41e36525", "value": "559cd7c08e22ad0b0cc72602acf3dcd4485f579d5862efd5574c876c72f99216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa53424-f636-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712642576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642576, "uuid": "d3acd098-cca6-47af-9481-95a210242820", "comment": "Malware payload (AgentTesla)", "value": "5c3fe90d74bdc6a9a594eeee2ab409eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642576, "uuid": "466101ac-9a6c-4088-90ef-fe97b3cbc0fd", "comment": "Malware payload (AgentTesla)", "value": "5674c6bfbaeab5c555aecba94111e912ff485de188fe98f8f24ade761656a670", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642576, "uuid": "88ccd9b9-44d8-42c3-b3ba-7aad76553837", "comment": "Malware payload (AgentTesla)", "value": "b28092debeff499658eb7032e93eeb1aab627e28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642576, "uuid": "9b0f21cc-cbe3-4c1d-a2ab-d5a94448f62f", "comment": "Malware payload (AgentTesla)", "value": "4707f059ec6fc8c6ede68e46d0b8fb4c949a29bf3058d925ff8bf646181ce43f4bc056520de2cc18dceafcb25ef061f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642576, "uuid": "fa40904f-1566-4480-8ccf-9b8133459b5b", "value": "T19EF4120362ED7EC6C53897B53B3793C2C36EDE241461C60D6DD620CA98BDA137562BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642576, "uuid": "9957d084-3feb-42f5-9406-3b5ced86dedf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642576, "uuid": "b82acf42-7943-452b-9592-0749b1a4f179", "value": "12288:RB1oVeonJAM+RSWkPe/f5IsYcuVYF0IGndq/px4lH6ct:Zo5mM+cbeXGs/uq06/pSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712642576, "uuid": "607a332c-a603-4092-a34d-060a1f2fa72c", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712642576, "uuid": "97372f24-bb25-44fb-9d62-b4a3cf989521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642576, "uuid": "1b29fd02-ce5a-4a6f-8ef3-26a7c5f50bb7", "value": "Quotation PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59e6fec-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692811, "uuid": "cc78e416-a10f-4f5e-b740-4ce0db2392b7", "comment": "Malware payload (Blackmoon)", "value": "221910e307b7e40e3b017f7d217e9772", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692811, "uuid": "a5a8ef10-075f-42ef-8c76-d1296991661d", "comment": "Malware payload (Blackmoon)", "value": "56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692811, "uuid": "d3258a3a-8b60-4028-a82a-bdf4b254f290", "comment": "Malware payload (Blackmoon)", "value": "04e9a897039cd0b43bb6ab99a56a6eac947cfbc8", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692811, "uuid": "b07a4572-876e-4b7c-93d9-19fd98e431c4", "comment": "Malware payload (Blackmoon)", "value": "74e54169f6dffd740fee942a5217a4ad327938f9e9b89c086781c120fde092fda66298a81862160ebd36cd165d197295", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692811, "uuid": "bb030a88-adea-4d34-bf18-2a18d74563ae", "value": "T128B4E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692811, "uuid": "6752d24a-bd8e-4613-817e-03274ac75197", "value": "3072:6VmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPDJKUuTx871KD:6cHpJfHElepVuWwP5YcQfg8J+oj/J+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692811, "uuid": "02972dc1-d1b8-4cbf-8995-a3ea20e063fa", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692811, "uuid": "5563b2ef-ac5c-4841-840e-cf6d42d8b05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692811, "uuid": "88bfab96-415e-4f77-82bb-225595af9bff", "value": "56c3dd1fb00b2235dcdfd44064a7a5defbf6b47c5699d91a6adb0088544fc797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73802d0-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692840, "uuid": "6d1d4c9b-8e66-46ba-9fec-5dcb59a2b148", "comment": "Malware payload", "value": "e37c74641e1ec31df3806cb754762d6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692840, "uuid": "ee3fac7e-d851-44ed-ac91-a751b922f5ca", "comment": "Malware payload", "value": "57dda95bbf78899616ac85639c9f538646b4a9e802d4d9e39da4cb564ded506e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692840, "uuid": "5ca81629-7915-4237-a39d-daca94bcd2ba", "comment": "Malware payload", "value": "d4124a0949747c78f6ff2e3d260090fe10e2e407", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692840, "uuid": "830974ed-daa9-46a9-911f-8443f2ca1278", "comment": "Malware payload", "value": "e3c3fb6d196391eaf90d1afcd090d314be8a4af88b91c74a5716121dab34f6330e748bc558c8e8918e55812216fd9911", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692840, "uuid": "9ff7446d-6367-46a4-8621-2f1e7aea1a75", "value": "T174772332F6E180F0C49615305666F37FA778A3014B2CDED79384EEAD2E311D1E66B64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692840, "uuid": "a820858b-90ad-4d94-9983-8c3033dbfd1b", "value": "e83e864706bb2096bb2f0eec855a4e23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692840, "uuid": "22d42991-e278-42c7-8474-31ee78e29221", "value": "393216:vYTRNwMVQvqINip+5Yyi3Xx5zdojWXlwumwJgGcXJPDv0UBwAZfZYLHDK+:iPVQvm+qfOnGkDv0UBwKYfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692840, "uuid": "29bc503f-8e85-4a1c-b958-f00ee2a5e55e", "value": 34072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692840, "uuid": "f77732af-c987-463f-914d-9a86b40675b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692840, "uuid": "89b7f6f8-028c-4831-9eb3-33336c847721", "value": "57dda95bbf78899616ac85639c9f538646b4a9e802d4d9e39da4cb564ded506e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8323430-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692842, "uuid": "d2193a23-493a-4f5d-9a47-ec2d247fe086", "comment": "Malware payload (Adware.QQpass)", "value": "2e84f114e1da56280a481a025b1095df", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692842, "uuid": "9faf5633-eb8a-45f3-ba24-3a2d8d34b4b2", "comment": "Malware payload (Adware.QQpass)", "value": "5841c22372c5c9681051cbe6c1c11cc8ad95c1ac8d04d2a518fbfb4d194c4d94", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692842, "uuid": "e03f8607-2a89-4de4-900e-f67872af4aa1", "comment": "Malware payload (Adware.QQpass)", "value": "d0f9d8295d450368f9335fc1e447157041bb5e4e", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692842, "uuid": "053672a4-a6bf-4a2e-a5af-59d9e7071797", "comment": "Malware payload (Adware.QQpass)", "value": "7cb05d33c84c03c12b1316f64418537ac91820de4636866507e67a0fc0629173d528da65cae151e963dbc8fd88a7a7e5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692842, "uuid": "f6527238-9aa4-4894-bc3c-00e70ea0788f", "value": "T15984960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692842, "uuid": "e156dc30-44b6-4d5e-a8d7-25e6b6c9b1ff", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692842, "uuid": "aae97030-e1bd-4e45-a6b4-e625b69e024a", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22V:7vqWQub2lrE0B55FpekPdb/22V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692842, "uuid": "7707f04b-a748-4141-ab5f-93b5c4fca465", "value": 406141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692842, "uuid": "e6db35ee-5aa7-496e-837f-b6e8cef3c86f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692842, "uuid": "61ebef46-1a63-4a2b-94d6-d05558cd5b0c", "value": "5841c22372c5c9681051cbe6c1c11cc8ad95c1ac8d04d2a518fbfb4d194c4d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714dca57-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651867, "uuid": "cacff433-6ca7-469d-833c-8ab6463c38dc", "comment": "Malware payload (Mirai)", "value": "d25d879bd5925d2e4122124eecc32db8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651867, "uuid": "8086a464-9071-48fd-839b-748892a60d24", "comment": "Malware payload (Mirai)", "value": "59cc8ea34fd78eb0ceed660eeee9698ea544afbddb30eddd167b98b0669818b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651867, "uuid": "497a07d6-ba27-450f-87c6-1d95bb7644fd", "comment": "Malware payload (Mirai)", "value": "4427cca615de395125300e2d785883fd94c47938", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651867, "uuid": "97cc3a10-7e6a-4eec-b2c0-df0dbe23d98f", "comment": "Malware payload (Mirai)", "value": "9b821ee58b4ce7314d7afdb35da8b7c4884249ea354fc36854633cd9b30065afe0841c5339b3b4ea63514b65321f739a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651867, "uuid": "1236f108-735e-4dec-8254-4242547d83c6", "value": "T191533A55F8819613C6C5127BFA5E028C3B2613E8E2DA7207EE229F21379692F0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651867, "uuid": "73006181-50d7-4713-b45d-758470e4de46", "value": "768:LsIO8Q1e9Iq/NLEQwsqKpxVYz/hwjhTdI/N+JSSaMrMXSGo6HptVrzAvvwBYI:5ObZq/9G0pxVYt0WqnrqQ6H3xAv4BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651867, "uuid": "25f1d34d-34be-4fed-8647-92a789fcce17", "value": 64648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651867, "uuid": "72c7512a-3c33-4559-b15b-701dd119da41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651867, "uuid": "9026d969-bad9-4423-b2f6-462d29f3fe33", "value": "d25d879bd5925d2e4122124eecc32db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a07f6d-f67a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712671624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671624, "uuid": "253dc844-b3fc-41f0-b8ad-596e30a03d31", "comment": "Malware payload (Gafgyt)", "value": "5901d370669e74725ffef7e07094b1f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671624, "uuid": "776dc195-a9df-4bc3-bbe9-33d310117643", "comment": "Malware payload (Gafgyt)", "value": "5a68d8995473473f2e1297699b108cd1d689dd299b6d5b103ca6736be717b285", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671624, "uuid": "6888bc8e-0a40-40f4-a9cd-0a9518187333", "comment": "Malware payload (Gafgyt)", "value": "4ce7500b5f0e67e3bad0288039199375a72e2837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671624, "uuid": "6f1abc22-26d4-48f0-b779-61ece60e07ae", "comment": "Malware payload (Gafgyt)", "value": "c57c136a866af0e81a1eaee9e5df86a5cc8bfd034610828195c1fcb53b14cadbd3d7749b1fce731a93fdfb0f7784dced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671624, "uuid": "ffac8614-593d-45eb-8ea0-6e51a7b1e2e9", "value": "T15FB33901D5518B27C1D2277AFBAF425D37232B68979B33115A24BFF82BC279D1E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671624, "uuid": "6416a6a7-8a36-42b6-8c30-a66858ca063d", "value": "3072:OaKh4ut9WuRg0WSGDa5SMXzfbmNQfPfXv4n:OaKh4uFWSGDobmNQfP/v4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671624, "uuid": "62eec54f-4dd1-406e-b117-9817690f5604", "value": 107843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671624, "uuid": "19cc56bc-afda-457b-a9b6-72bd635bb0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671624, "uuid": "75fd1106-a5fe-4fe0-a44b-b11ca9ce3936", "value": "5901d370669e74725ffef7e07094b1f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f2b141-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712671930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671930, "uuid": "7bf3e453-a864-4567-b7ef-9b73adfeb1a3", "comment": "Malware payload (Gafgyt)", "value": "33b62ab7d63948c12c9e3497ed20515d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671930, "uuid": "02c4000f-0cb1-4a6c-903f-624d88b15233", "comment": "Malware payload (Gafgyt)", "value": "5bccd2c32b9ba2dcc57e1138f5c99a6c58b49f17b1adbc628352de8764ddfd65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671930, "uuid": "92befecf-dce8-476b-9ecd-b89d2b276d7c", "comment": "Malware payload (Gafgyt)", "value": "dce3d5bb68db4c8a86291637fe5ecf1e76085bf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671930, "uuid": "fe7db72e-10bf-482f-8f9c-67784109602c", "comment": "Malware payload (Gafgyt)", "value": "29993787c8c13595526020b24b4e71722a23bf32f33dd147bfd3554027830b2c36a5788d7c41aadea1c5b4507c7234d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671930, "uuid": "09996b2c-9b72-423e-a92e-5c838356f369", "value": "T19A832903771D0B43C0AB6EF029FB27F1876AF96116A36180B10EFED45772AB42512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671930, "uuid": "5d4695a9-459b-4f6d-9d34-fb93e346ac1b", "value": "1536:lQ2P4MoLMZ1wl85JuGp7kchcSj3Sv/Rz8oCjGhBEmQ7Vh2jqnaz7e:ldzoLMZ1wltGl/cSj3Up/hBEmQ7Vh2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671930, "uuid": "5962a348-ee9c-4302-af35-0fbdef510fc2", "value": 81327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671930, "uuid": "0943b999-891d-4be0-9efb-a49c8c02261d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671930, "uuid": "ac805d15-49d5-439a-bafd-a3f144286217", "value": "33b62ab7d63948c12c9e3497ed20515d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c11c958-f67c-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712672313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672313, "uuid": "0a910bee-27e3-46b9-a452-2dcd453bef80", "comment": "Malware payload (Formbook)", "value": "da413ca47c6dea97217897173f1f709b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672313, "uuid": "242284f5-d022-4649-8858-d4e2a3796dd4", "comment": "Malware payload (Formbook)", "value": "5d4acc11bad8229c2940b98c7d009b36319150307b77dcb684f2c8d47ec6e326", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672313, "uuid": "cdeac0cc-917d-475e-8e54-47140f2fa23a", "comment": "Malware payload (Formbook)", "value": "5ff81db9d013fcac7de686adfdf33bac6f4c4f01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672313, "uuid": "5e66d0cd-fe51-43ed-a913-47638f9863e9", "comment": "Malware payload (Formbook)", "value": "4f9f72ebadad027693f91515dfcee495dbc7d75795a4a7e73f06c6511b061fedf7102878ca032b69828908f366ca920b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672313, "uuid": "98f4f1b6-de8f-497e-86b1-29f09f2f7fcb", "value": "T12535AD02B3D2C036FFAB92739B69B20556BD79250133852F13982DB9BD701B1277E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672313, "uuid": "4e996199-00b5-4cc9-a058-16157d079e62", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672313, "uuid": "1cf4aa7f-a38d-47f4-a834-d29c89be04d8", "value": "24576:JAHnh+eWsN3skA4RV1Hom2KXMmHaGtg3xZ5Idb5:Qh+ZkldoPK8YaGsxZ5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712672313, "uuid": "cad7d6f9-f996-4513-b1d1-9aa5b098e456", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712672313, "uuid": "0971d73c-72d4-4e5b-b6a4-ba4884906533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672313, "uuid": "ba89f490-0365-4a99-bbf1-fa91481cb8f8", "value": "wphil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681e6394-f669-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712664307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712664307, "uuid": "406b031f-49c6-4762-bd57-5baa5ea928bc", "comment": "Malware payload (AgentTesla)", "value": "c8fe82a5c4bf0f70d6d1e53b62c3755a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712664307, "uuid": "b4a8e538-2abd-42ae-9619-38a4529cc8f1", "comment": "Malware payload (AgentTesla)", "value": "5dd02f730b0078b018c8ec2fdf0791b3d547ebea3ce57f8d7d4ac53253e8dff8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712664307, "uuid": "2b75ed8b-a3a0-4b17-94e4-ea7800f4da56", "comment": "Malware payload (AgentTesla)", "value": "cfe4dedf157b463cb18b697d8c3ca3a2c99b4776", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712664307, "uuid": "5525b62f-c191-4001-8b0f-5bc147c189aa", "comment": "Malware payload (AgentTesla)", "value": "bb5e46770d897baf65f9136c53da04124bcf1fd9483106d9c88e550450a8898f831190fe6c615f8201fc013e364fdd10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712664307, "uuid": "d8e20176-d977-4cf8-8223-730aade9b972", "value": "T18933CF1633D6D022D082497E8DC6C2DB53257CA1DF82AB0B71807B9F5A7E7C2DA13B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712664307, "uuid": "8e7be0a8-51a0-4e5f-8fd4-1ca5ef794ec2", "value": "768:N1yBP0tNFCybZey9F6434PeiV0JfmcCip781qAnC7Tn6i:N168tu6v3YcCkcqiC7Tnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712664307, "uuid": "33857d4c-8577-4376-95e8-e6db6d5759cc", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712664307, "uuid": "92445574-7ca2-4f7b-ac4e-77177376f033", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712664307, "uuid": "98e97057-3a63-48df-9123-90cbd8c48bab", "value": "\u03b1\u03c0\u03cc\u03b4\u03b5\u03b9\u03be\u03b7 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03ae\u03c2.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4297d1f5-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712674122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674122, "uuid": "3c5ea5fe-202d-46b4-9f2e-398b7b722e85", "comment": "Malware payload (Formbook)", "value": "313364f5421a1f967100c09b6768d2b4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674122, "uuid": "3e1f51f9-022b-4c32-b072-d6f478ec15dd", "comment": "Malware payload (Formbook)", "value": "5df56a1199cbca3645a293fd7c92f6d9055f998f0538bec7bfdefba2e4b0c8b6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674122, "uuid": "f9708b85-70a4-4418-8a43-cf00fe4cf9a3", "comment": "Malware payload (Formbook)", "value": "35df495432dff10fe4483f0654448b63b8f6bf97", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674122, "uuid": "ac49a919-c1d8-4dbd-a1a8-641799c9b02d", "comment": "Malware payload (Formbook)", "value": "50dc7be115147a1dcf6ed522689765c3b0badcaa8ff43ff0f93f16462c8152e6cca5a0f7443704645c6bae6967235717", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674122, "uuid": "2d13a2f4-b908-402d-a5ac-69fa989684b3", "value": "T130F433868E6EB81C4EC1382CE9CB35FF15592991BD16DB9CA1FB891C0844FDD0E6984B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674122, "uuid": "fe560ca2-680f-45c7-be91-5e17a9e99994", "value": "12288:PUlRLNar6iQWBRp2ecfp8LDvZiXXhnKHPOrlt4pkIEP5uBUzy3s:srar6iPnlcTHRoPOrlupkIEABUzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674122, "uuid": "86f40225-a0ac-4575-88a2-3451fdb36350", "value": 726460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674122, "uuid": "dc1274b3-3e90-4cc1-a778-980c0a1959bd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674122, "uuid": "1c9404ea-9cea-4116-ab1a-53c4b3593942", "value": "Remittance_90523_03.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9de8554-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692845, "uuid": "7055a089-4347-4194-8162-f916cba4c72c", "comment": "Malware payload", "value": "e62c8dd01651b0b125bc1cf30e99cd73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692845, "uuid": "5dfdab8d-5a9f-455f-acce-ba3a696ed1bf", "comment": "Malware payload", "value": "5e2de89e01d48c383780e2fc5e56619b4a2cd8a91b6a9c6040d8f360bad39db3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692845, "uuid": "3ce65212-7ccc-407b-aad0-87fe303c89ec", "comment": "Malware payload", "value": "5b9ee6c9f8f39a110427976c313d563d6dbb61f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692845, "uuid": "4675b3b9-ce9c-41b8-bcca-cc6b50b22683", "comment": "Malware payload", "value": "aa851cda9e574e3246ad2b7109e231c4497d619b1d20a604082232ff065cdf377a4b1a44b874b7904fd02c5132ce8e88", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692845, "uuid": "2fb60563-90b5-4a02-a80d-30f0bd742057", "value": "T11D85CF93F08280F2D92D153814B97B3BD67A691E0935DB8BA762FD765C32D82923710F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692845, "uuid": "af750181-30d2-4ca1-84a8-0015d6866042", "value": "fa32697a83d3b6688888de5b3cd08e4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692845, "uuid": "e341c514-67a1-45bb-bde9-fac1974499a7", "value": "24576:HfqMeY3QBhoWYJgIDWAeTkzZ+RkFN/yKBUZZAFDrrqBh3SWgSklWXKBUZq:HneXoWS5ZRN/yKiZEDrKBST1WXKiZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692845, "uuid": "7b9b5f6c-5a16-4165-99c9-c240e1b30e71", "value": 1841892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692845, "uuid": "1eb67ca9-9e41-4e5d-bcab-3e3e6bc9cf31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692845, "uuid": "1bb92a0e-dbc6-4788-b7f8-06ef8609a6da", "value": "5e2de89e01d48c383780e2fc5e56619b4a2cd8a91b6a9c6040d8f360bad39db3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0380b293-f69c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712686042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686042, "uuid": "c36175a8-5a6e-4e0f-a153-67f7b7d61401", "comment": "Malware payload (Mirai)", "value": "0f9cbf4ef0eb128fa507fe3f9e7915c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686042, "uuid": "9cb3a6d6-0691-4f4f-847b-b324a0eedd7e", "comment": "Malware payload (Mirai)", "value": "5e400d89d3c94784bafc1bcdafa1fde5653a8eeacf0ee275afdc701f83a904f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686042, "uuid": "17d1b2b8-7986-4709-ab5b-474aac9e34c6", "comment": "Malware payload (Mirai)", "value": "fc5aad62b798b891fd874570440a9356abd88e3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686042, "uuid": "3fabaa36-9c84-400a-8191-db775451cfc8", "comment": "Malware payload (Mirai)", "value": "9f21283eb558b58542a77d050566bc6cb80302f12c7bc92753ab0973776faec0be90126980c0f476d3418dd6b0cc0bd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686042, "uuid": "ddd1b4ce-747a-4cc1-8cee-863f5db02561", "value": "T1BF6302A9B1B74D79C9312AF59C30303370F16BF2E9FB72294A61465B25C5741B6EC4D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686042, "uuid": "ffdbe394-94b8-4cd9-93b9-bbcc3ab6aadd", "value": "1536:f5SXroDLHs17EjxBYixMuXTjLSrslb/W/HzJUyc:f5SbMs1EzYmnDjLSrQWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712686042, "uuid": "97298ecc-be39-47ce-93a0-20debdb410b3", "value": 67408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712686042, "uuid": "c4352308-6f73-4841-98d6-81002cfe9a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686042, "uuid": "0feaa8d5-7e9e-4909-9da6-558affa18ea4", "value": "0f9cbf4ef0eb128fa507fe3f9e7915c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae5e33c-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692846, "uuid": "6e03e5ee-5603-4272-a617-24ee0b88ec90", "comment": "Malware payload (Adware.QQpass)", "value": "06f998c10ac92b0a593cb79ef6622c83", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692846, "uuid": "8d889080-8e7e-43d2-8b14-633c5b4a40e3", "comment": "Malware payload (Adware.QQpass)", "value": "5ed166ef79808bca5d5e14358e8c98e06bf0dd6dbc4d74eca28f2bdb8a82ad3f", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692846, "uuid": "f28ddf96-e87f-49d5-a371-51531dc61398", "comment": "Malware payload (Adware.QQpass)", "value": "fd55ad1fbf617f27406bf2d26ed6ba23fe1616af", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692846, "uuid": "e16fecc4-ed5b-4356-85c8-943662858e17", "comment": "Malware payload (Adware.QQpass)", "value": "dadc375b6f6478ee5cb80a36c784ca28000694e31f5ec3c354b3d8d95df99ca09bd50d3fe91c0fedf7757488d81104af", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692846, "uuid": "8a3f91d1-5716-4e92-b3c2-19088f3bbc40", "value": "T1A794E913B522A895E11457F66BBA473869BC832038B1CE13EFE4DDB1BD715318B4E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692846, "uuid": "875c80b7-4731-490f-a3ad-7e0b84ea81f6", "value": "bab84fd0accd31d5fe97afc63a9ebcad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692846, "uuid": "0214c9f8-fd9e-4776-ab15-408efa7f7e15", "value": "6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqA1:c4Fm3b7yOAHNar4mUf9lJ82scqA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692846, "uuid": "8373cfbc-e9ea-47bb-ab26-7a43db8f30fb", "value": 442554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692846, "uuid": "3e320ead-d6f1-4a8b-9222-4f23e6c1ba4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692846, "uuid": "a3693f1d-1296-485b-87bd-7172eaeceddb", "value": "5ed166ef79808bca5d5e14358e8c98e06bf0dd6dbc4d74eca28f2bdb8a82ad3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdcbcdf-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692848, "uuid": "d7a20bed-df51-4c36-951a-560f5123e7ae", "comment": "Malware payload (Adware.QQpass)", "value": "bc4d8aa8e11ce8b0ae46111f5f363e1b", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692848, "uuid": "c42a87bc-71eb-475a-8816-41d1569e0f3f", "comment": "Malware payload (Adware.QQpass)", "value": "5ff426d661fbfbe5e7ef31aa8658145b5b2fdc0e80682d41c1beabec9f39ce0b", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692848, "uuid": "2a142308-087c-4543-9b64-ad1330489a86", "comment": "Malware payload (Adware.QQpass)", "value": "eaa1ccb6a429b5e9612a9cec2366d93ad5200de4", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692848, "uuid": "9f07aabe-4204-4d0d-8a3b-fe2c3e46e278", "comment": "Malware payload (Adware.QQpass)", "value": "739f69fd928d19a2251e58ac3c6057dcf66aea69436f44adeccdf8059364b489d6c7b66150b410694f7964aa31e2b2ed", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692848, "uuid": "3ade7b1e-a4e3-48ac-9714-9b0fc0ce126e", "value": "T1ED84B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692848, "uuid": "b7e4b1c4-2bd7-480d-944c-f436f8d20f44", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692848, "uuid": "4fc49ad1-5d62-43f2-94ba-488029ac8bd0", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1c:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692848, "uuid": "236a2171-7b73-4207-ae44-74e16148089e", "value": 375510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692848, "uuid": "8d209a89-aa76-4f69-a809-4fa3baa69ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692848, "uuid": "7b5212e5-e91b-4bd5-b541-a974fd10d064", "value": "5ff426d661fbfbe5e7ef31aa8658145b5b2fdc0e80682d41c1beabec9f39ce0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd67f71-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692849, "uuid": "d7cce555-c676-4e12-90f6-347e8d4107f4", "comment": "Malware payload", "value": "83710f667cffc9fc110ea147e72a8b0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692849, "uuid": "c173046c-e303-498c-9325-b79763df11e9", "comment": "Malware payload", "value": "60766f2e372c98002dcc639b84e58c99599f0236336d9c5f457b16c6b383b828", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692849, "uuid": "7ff9a9b9-b17e-4b33-a485-422b96b8bd6c", "comment": "Malware payload", "value": "9f914d7906d969fbd3eac9d20eaa77de328d12a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692849, "uuid": "614191f1-bc66-4e89-82c8-9011c10b1090", "comment": "Malware payload", "value": "127da12d27c2746accef58420d35bf25b562f3172746de575c461f592205173657185064796afb53dae7cbb547c601dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692849, "uuid": "d56adbee-c998-41cb-849e-ab627c47e857", "value": "T17FA4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692849, "uuid": "4ce69709-23d8-4580-91e2-da4eda8a5a27", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692849, "uuid": "e94f6b30-4057-4e49-9962-240c7754fce9", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubg:sZ++qlRBBOxQDU2XWIg6Big", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692849, "uuid": "c83c1d3d-ee73-402e-9c26-fb636c117a86", "value": 458358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692849, "uuid": "c4ca7f16-7221-4c6d-912a-08d2dbf4383b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692849, "uuid": "f2b63891-d757-4550-94a1-f148392a91f7", "value": "60766f2e372c98002dcc639b84e58c99599f0236336d9c5f457b16c6b383b828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea43174-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712669445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669445, "uuid": "10252c10-9c3f-417e-a5f3-c88c353d14ca", "comment": "Malware payload (AgentTesla)", "value": "85e4e63dbd2c863f61a33c9e22e596dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669445, "uuid": "60e1e064-5e70-473a-9352-85705f3fcba2", "comment": "Malware payload (AgentTesla)", "value": "60d9b4fd251539aa37f0bd3d453f36a9a487dc8827a741f4d7f1b869b768e68c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669445, "uuid": "a198ac37-d512-4b2c-9c06-71c10f58eb3b", "comment": "Malware payload (AgentTesla)", "value": "a6ff73e08b4c77b4c00e2e15fdb5196ddb954016", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669445, "uuid": "312f3b31-aafb-4415-becc-d81adfdca5b7", "comment": "Malware payload (AgentTesla)", "value": "493ade7eb75369a8ddbd6b36493be98e1ffcedbd308fa89fe4d2de8591afa02978d3b9fd85e0e4f20ee2c26f8258f16c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669445, "uuid": "9450aeef-40bc-4f3e-aefc-367587a47b58", "value": "T18E93382DD34B02598F620376AB1B1E5142BDBB7EF39552B1305C437933EAC39A1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669445, "uuid": "fbbacbbb-420f-4646-ab57-8d1dea703f68", "value": "1536:mwAlRkwAlRkwAlRqWuoUqfjmM9tDFO9Mpx9XDk:mwAlawAlawAl5uo/fjH9tDFO9erzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669445, "uuid": "6e2f5dc5-a61b-4256-9365-dcbb5d452140", "value": 97331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669445, "uuid": "7ea59ebf-265b-4368-b8eb-a748f72f4ef2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669445, "uuid": "f799d8cc-c450-4a18-aca1-da0366044bc8", "value": "RFQ-1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddecc345-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692851, "uuid": "29601866-e0b7-4127-9be1-62a771610809", "comment": "Malware payload (Adware.QQpass)", "value": "8253b9c116a957a9740b833fe527c6df", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692851, "uuid": "9bc65a68-7b61-459b-b77a-da5adb91d743", "comment": "Malware payload (Adware.QQpass)", "value": "621be0513d8d0a220b556bae17819a2bcb9af35e5ded754b027add7fbc0d6dde", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692851, "uuid": "3760e2d4-b89a-4379-b905-898af74cdcd4", "comment": "Malware payload (Adware.QQpass)", "value": "d463a3f634af7c0d0d157f43063b88877ff4b58e", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692851, "uuid": "41efbe30-88a6-4ff4-970f-2276dc01ff91", "comment": "Malware payload (Adware.QQpass)", "value": "16adb1147386dad6baf8d20a26f92092c468a00c23ed400f52ff96d0646e652f2a442ceabc3dfa629c21d7499b1b61b3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692851, "uuid": "4bc24b70-7234-4a1b-8f21-e516ed5dbfa5", "value": "T1E974950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692851, "uuid": "1092aa02-c3fd-42dc-918e-73d218a112ae", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692851, "uuid": "5c5ce0bc-b5b8-48dd-b557-216ca3a8b9b2", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudeY:b5/Q58drihGiLhmGNiZsx0B/zkXoeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692851, "uuid": "0389eb81-5791-4723-a1e6-2d1b2abba89a", "value": 346604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692851, "uuid": "b86e875e-24fc-40bc-b94e-3d3619ccc68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692851, "uuid": "32a88bfd-c893-44af-be48-92885ddcd579", "value": "621be0513d8d0a220b556bae17819a2bcb9af35e5ded754b027add7fbc0d6dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def95561-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692853, "uuid": "aa1fd3c2-7dbc-4590-b11b-5e8317a316a8", "comment": "Malware payload", "value": "c620b263a76c5479f3eedbca978634cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692853, "uuid": "afe5e315-817b-46cb-acf0-ae27e3af6da0", "comment": "Malware payload", "value": "64e44248d2bb556cd60dc8d0968279102d4552542159c25a058304ba39cdfb55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692853, "uuid": "a424f037-465d-4ffe-b3ea-78f355d51022", "comment": "Malware payload", "value": "62c0763cd09f1e352136fe4c4394e34d5096b470", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692853, "uuid": "34fd9d8d-13f1-4b3c-9413-27901e6510f8", "comment": "Malware payload", "value": "b43e7bc645c0c42697315fb72d32db38935be19cf69aa007fe57024f06f5cab4011b6be38c62a1641a9f2cf089f2bc8f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692853, "uuid": "9ebb9748-2b41-4768-9c39-7e7c0f21396f", "value": "T12EB4C813B522E495E11457F66BFA073869B8836438B1CD13EFE4CDB2BDB15318B1A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692853, "uuid": "71b0e769-fc3a-46de-b17d-4cf84a4cc1c2", "value": "6144:qwGdR+Yk/N8duBmG6t+UnRsRCQ/OJfbr7+C:qwoR+Y4NSG6oUnRsdOJzr7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692853, "uuid": "c941be1a-47fb-4716-8529-b00204627084", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692853, "uuid": "1136cfea-ae31-4daa-8429-5fa033046f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692853, "uuid": "e6b875df-4bd1-40f7-a3f8-2da5698186bb", "value": "64e44248d2bb556cd60dc8d0968279102d4552542159c25a058304ba39cdfb55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae33db6f-f633-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712641232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641232, "uuid": "337d95d0-b1a4-461f-bdbc-56a2025d1ba6", "comment": "Malware payload (GuLoader)", "value": "8a7bce00948b8df36abe3248ce5682eb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641232, "uuid": "6bc4b999-7753-4094-a5da-0e015085f47a", "comment": "Malware payload (GuLoader)", "value": "651d9cd8392674f29e96b3d529cb91278e84380b6bba0ab8919d5018ff2661fe", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641232, "uuid": "bf2f86fc-a0a8-45ec-9d57-ac9712d01eb8", "comment": "Malware payload (GuLoader)", "value": "da7637f80db5efef4da8c75593a3c9e8517b724f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641232, "uuid": "a86c2701-35b6-4e14-bf99-29b229a52af2", "comment": "Malware payload (GuLoader)", "value": "4c938a4dd61af79d0617be5e057886a59355eabfed3fca0d6fbb2c8fadacb558669f7c427b9c651cac6717c58c5748ee", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712641232, "uuid": "6c09cc58-1c7a-4286-b237-03ffc9f3a015", "value": "T1B3548FE3DAC526288A855AB7ED274B734DA4419D33031F7893BDC65D908399C82BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712641232, "uuid": "38576bd6-afcb-454a-9f0b-4559519d8c27", "value": "6144:U5h1/GPWvV+kcuUxouBmfgbtosqFH8sBsnQAViKiDDCQbJPQf2/7cgU1bLWBRcA+:fmFb0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712641232, "uuid": "7012a6e7-9020-438b-8c68-efe7d42b1b7b", "value": 279431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712641232, "uuid": "4f393736-f2e6-40e0-8c1f-886550493687", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712641232, "uuid": "7f20abb2-efc5-4e8c-b098-7448b64e032d", "value": "FACT AZUR TJ .pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfee23c8-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692855, "uuid": "1d82ed91-6c7f-45e1-893f-0fcf700f1a8c", "comment": "Malware payload (Adware.QQpass)", "value": "5e463d9bfc9ea14008632f79cf06eaa0", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692855, "uuid": "1bd35644-ce27-4ce8-a49f-8527e045ac05", "comment": "Malware payload (Adware.QQpass)", "value": "6546cd6a2971aa3ec699106c8f79d95e0cb673e39b58296dfdf7782e08a0b72f", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692855, "uuid": "15afb535-b85b-40c6-a54c-6057e0055bfb", "comment": "Malware payload (Adware.QQpass)", "value": "0139c266baa21f9263b2b9f5dd60f2acdd749185", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692855, "uuid": "c5142de1-a3c6-4bcf-b8db-6717e46dbea0", "comment": "Malware payload (Adware.QQpass)", "value": "b4b49cd631de08d126376abb493b23002ac7a7778c4daa1b42235df1343408d5139e71c887d2ae6f310de48f00bf3fdb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692855, "uuid": "56822653-9f60-49df-84c0-e4ab03c19227", "value": "T13AA4A61372319491E1595BFBA7BA433879F8836438B0CD23EBE4DD62BCB5122971A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692855, "uuid": "3a82f65b-292c-4d9f-aacd-12094840802b", "value": "d070a98a3bb72e151251c216b80dfd90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692855, "uuid": "0e296cdc-b22a-45fc-aca3-89e5c2b45639", "value": "6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZa:/vpv/R6H3U25fehHpAW+yOBOKCZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692855, "uuid": "a884884c-7948-4ff9-b13e-e85a67079bdb", "value": 462902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692855, "uuid": "61161eaa-d3cf-41d3-b470-6674eed8480e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692855, "uuid": "ba37e1fc-1d36-4d1c-935b-dec38242df82", "value": "6546cd6a2971aa3ec699106c8f79d95e0cb673e39b58296dfdf7782e08a0b72f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a4ca54-f674-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669237, "uuid": "1b3207fe-ae33-45b9-8c61-84cc550dfc52", "comment": "Malware payload (Gafgyt)", "value": "38a81ec7157ae46e43d4bf3683aab4f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669237, "uuid": "fd858817-f2b3-439e-8f6c-7077d19dbb17", "comment": "Malware payload (Gafgyt)", "value": "65ac77763fdd4dde3f9600b834a3ca59dd8129484ff59a2914c1eb0d4c0eff7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669237, "uuid": "60ecce3d-b1e5-4ad8-9a26-0270a1f6a4c8", "comment": "Malware payload (Gafgyt)", "value": "3a9c28991cc2a2b8d30c710de3bde61d3dd077b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669237, "uuid": "ce7fefd0-03de-4516-b55e-83022eb208dd", "comment": "Malware payload (Gafgyt)", "value": "6c69d6046a2fe60417c7570b51f0a6c026cf4106d949694331c9faaa1ec0b91897efb0d765371c5dc9abf39342e6947b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669237, "uuid": "d7cc9e7d-b07a-472b-8fa7-ffce0468ab51", "value": "T1DB143903770C0A83C0972EB02AB727F1979BE99216A76180F61FEE845373B756519FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669237, "uuid": "317a676a-abb5-49fc-85b0-cfa78af0f304", "value": "3072:PiWMqhpbTxcSjbXqwQcaGUY6yBNAUmegq+Q/A4arfse9Pbo:PirqhpbTxcaXqVvGUY6yjAUmegq+Q/AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669237, "uuid": "1556d189-76e3-4173-81cb-6a5be72d7195", "value": 190772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669237, "uuid": "11a2de92-eb22-4fc8-9059-d8dfdebc1cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669237, "uuid": "a0759e90-7e41-469c-b3b5-fc0578ac379b", "value": "38a81ec7157ae46e43d4bf3683aab4f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409c98c4-f6bc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712699889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712699889, "uuid": "48eb494c-99aa-4cee-a5dc-8db09443ee84", "comment": "Malware payload", "value": "4552629e678e390105b80553a9382b03", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712699889, "uuid": "811a8605-a539-4854-af74-3508a496a052", "comment": "Malware payload", "value": "668c8f5b13e710adbe48c4f83bf412debcb70d6977f93e45db2a0b557a72e128", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712699889, "uuid": "55414a2c-f851-4cfd-98f3-012ba62fcc72", "comment": "Malware payload", "value": "b7255184665549f8f2d743949d4f38229ac64fcc", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712699889, "uuid": "8d6b5fc8-0190-4c97-8860-94955e29a02d", "comment": "Malware payload", "value": "59ac4307cfd96b064ef7948bff3236345fe941698a491cd63ad796de82d95f585947c53051032b4230669a9d273a35e5", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712699889, "uuid": "f8a94fa4-365d-4340-bd71-da56bd53b6d9", "value": "T1B45733FAD89ACB167786E3B89C322A44D213FCDA4995C073F79892F44681F9D1366CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712699889, "uuid": "a8353d31-180a-494f-8e11-914e379cb227", "value": "786432:2v0LtkrlB/bdDye57OSHg8Vksb/ERIYHENWv:ZkrP/JDF5KqVktJHEIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712699889, "uuid": "af4f32d8-6e9c-43e6-ad2c-66680d3fdf45", "value": 27442978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712699889, "uuid": "479130ba-1c9d-4dae-99f5-e4c319b740ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712699889, "uuid": "277e084f-ed7b-4816-bed0-e1bc0e128886", "value": "12785910120909.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c6c3ba-f66e-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712666528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "ea89b2f2-f1b7-4634-98a0-47ddc3b23643", "comment": "Malware payload (AgentTesla)", "value": "569287ed1345f1f1d671aa2791ce9694", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "c3666a2d-8247-4b27-b63e-ce63ec5d2f54", "comment": "Malware payload (AgentTesla)", "value": "675b7ea4b230ad5e2fa488ffa4c59073171e808907cc9c5c5c230184a24b0864", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "32b53969-623a-4d7a-ab7b-ee674613cc34", "comment": "Malware payload (AgentTesla)", "value": "3b3e9b7f8a1d9bc8c75435882453daf064865c3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "52b16148-e2ed-4326-a462-c538a3cfd268", "comment": "Malware payload (AgentTesla)", "value": "1d982b28ac61c2256be9dd00294889ea5e690a2ba330be08294cb5300a5283aa65e59c446178fb428d7c64ddb3ccea7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666528, "uuid": "244e2b29-db0d-482c-b968-360c2a454186", "value": "T15ED3CF2DD34B0259CF620336AB171E5542BDBA7EF38552B1306C537933EAC39A1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666528, "uuid": "a1b443f3-37a4-4575-b60a-f0e9088f1480", "value": "768:bmwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjQk2C4Hlq0n9Yib88DH:qwAlRkwAlRkwAlRpk2CwGib885LicCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666528, "uuid": "6fc94125-8171-4818-857e-494b3a27b00f", "value": 136532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666528, "uuid": "38b360a3-1435-4b0b-adb4-17f6e8e4fb48", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666528, "uuid": "c142c05d-ea84-460a-b98b-6900246e8f4e", "value": "03224.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ebba66-f66f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712667118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667118, "uuid": "15067fca-eb13-4927-ab71-80e4671d5aa3", "comment": "Malware payload", "value": "ac8415fb4d174f1999c4dc86cb761a69", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667118, "uuid": "d68b47f0-91ba-43e7-92d9-b5c5530e2ebb", "comment": "Malware payload", "value": "676e969b082c27257c2687902adaca38193ed24e424c0129e14930c02d1ce37b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667118, "uuid": "1c307092-b2e1-43c8-8dff-2edcf1dbf175", "comment": "Malware payload", "value": "3332b2fd826b88f3dc5b30b3465ad38f3754984c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667118, "uuid": "81a5b857-e6aa-4a0c-a4d0-fe0a7e352035", "comment": "Malware payload", "value": "ab9ccdca47aab7a8e2341603fb5d616b194dd288271ffa45e74708f43589a400fdfd5d76f319f9955949a22c6b01a79a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667118, "uuid": "70835eec-9e75-421d-92b2-d3e00ce3e6b7", "value": "T168663307B8CA873DD88A037142D7937B8B22A8244923C516537E59587BE35D0B6FB3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667118, "uuid": "b2840ff1-ebbd-417e-8f10-f03c0aa0f00c", "value": "196608:DONAYYQwpvAcBOUdTKbeV8hGB0sKJCIF:yNAYspAcBXdqq7B0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712667118, "uuid": "5b48b1f3-1688-43e0-8a4a-faa7f1d726ce", "value": 6507520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712667118, "uuid": "0a5f8cb4-f411-43e6-a348-8c43e66d1265", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667118, "uuid": "f2080dd3-754f-47ad-8903-a806c3103858", "value": "18847_9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e4c86e-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692856, "uuid": "87acbedb-4207-4ab7-a4cf-d60817221927", "comment": "Malware payload", "value": "f27c460214d36b81e3ced4e57f5cb5a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692856, "uuid": "1524a582-3389-4a8a-912b-860683f9cb95", "comment": "Malware payload", "value": "699b222667bbc6d120abc8b3a01c5e38f34cf4695ad4ddfb67fa65ba88cfa8ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692856, "uuid": "4f1ebaea-999c-4598-ae7b-1d6e7df9588d", "comment": "Malware payload", "value": "6e681c3574c2ea438950f623e7dbe0682c91ce8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692856, "uuid": "5d91eecd-fb2a-469a-96e7-020d15f52573", "comment": "Malware payload", "value": "a6fd8fcc18978684ae4c6ec4e8ed6563fae5107fbeb2ea1f02dc5244ccac9cd73847a77924a85f9cbe3146a5c9bb8c43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692856, "uuid": "9b7b3410-fffb-4396-afde-b3fca76a1dd4", "value": "T16674950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692856, "uuid": "e795b1fe-64f5-424f-b627-3d1dfb874d79", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692856, "uuid": "26261d68-5a23-491a-ac04-82c12ee5b6cb", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudeh:b5/Q58drihGiLhmGNiZsx0B/zkXoeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692856, "uuid": "37d2d103-b279-42f0-924f-72750e15d735", "value": 346604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692856, "uuid": "1cea4571-b293-4306-b77c-0ac4fc5cd5d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692856, "uuid": "80930a4c-3cf4-4e08-99a8-96ab067ee356", "value": "699b222667bbc6d120abc8b3a01c5e38f34cf4695ad4ddfb67fa65ba88cfa8ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2954c4ea-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712665920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665920, "uuid": "24ba5bd3-ad00-4a51-a395-3e48f356eb57", "comment": "Malware payload (Mirai)", "value": "e9059ff87e59d67b85bb2cdf4a8b6ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665920, "uuid": "15bcc8ba-bcfc-4610-ade3-63e044005e2c", "comment": "Malware payload (Mirai)", "value": "69f5f9dbbb813e1813c2920dd7372bb3580574b6057fbaa274a011b6a6a0e533", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665920, "uuid": "92034ca6-74a8-467d-81dc-6a0eef583316", "comment": "Malware payload (Mirai)", "value": "0e3ec50d0d9872438a2dec9dfe65626d2f923acd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665920, "uuid": "b475f00c-453f-4eb3-97b7-66ee74dfb549", "comment": "Malware payload (Mirai)", "value": "45dae77d20f036e0bd6d80840d4e60ff10820d87d16827c860081c1538c5df23a60676b526159550ed47a4b75c7f28e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665920, "uuid": "4fa19767-82c2-48a9-a602-fb9afa52855c", "value": "T15D337DC18A83D5F9E8230176787BA7736A72E07D026DEA92D358E631EC53641E2173CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665920, "uuid": "980653f1-9cd3-4fee-8cef-af5bd2fc718c", "value": "1536:gNaQBiZtVFgAORuN2f08HSnAhyGGiG+goRrSz:gNaQBmzgAOs0HSAhuY9Ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712665920, "uuid": "9501af6d-eabd-4cea-8d33-2cc1dd65ba42", "value": 55024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712665920, "uuid": "7c31c405-acd8-4f39-afb3-d12208961695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665920, "uuid": "4760c279-8a24-44bd-b7ef-f01f46d10f2b", "value": "e9059ff87e59d67b85bb2cdf4a8b6ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c190a29f-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669611, "uuid": "9faeedc0-d1cf-4c6a-8b2a-ef755cb64ce6", "comment": "Malware payload (Mirai)", "value": "cd5abfb3aed82b6227657ac7fcd8d853", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669611, "uuid": "e6f7fdbc-068a-4fd3-bb91-e2bc0a0b6610", "comment": "Malware payload (Mirai)", "value": "6a5016b1c9ff3794e025489510c2d5d78afa81db5a2f0a8e01952c584e2b1eb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669611, "uuid": "6adddac0-808e-44d8-8698-71fe8a966f46", "comment": "Malware payload (Mirai)", "value": "aaf4e584339ed1bf1dd189bbf464f6b3d2c50896", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669611, "uuid": "d5199a40-01c8-4716-ab77-28d08e9f0bcf", "comment": "Malware payload (Mirai)", "value": "eeda474798d909adbfbfa8d71a9677692ed82f5f09618a369ffd59b529ae32e3f349a891179ca2ca73eea421cee0d6e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669611, "uuid": "1ee10ead-f69a-4750-9f5a-26ef206a6149", "value": "T146F2F1224B5A7271ED248876FCE00AC93B500E355CA63865021619CC7FC7B6FDBED68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669611, "uuid": "a99b007c-df96-45ce-ba53-06f84abfe8c8", "value": "768:4sCXgsGWB5xVrLyHnrO9e/NxCVMcz7ASGX9f+5LYUBgE9q3UELOC:4RXgsG+VrLyHF/3CVxz7Cd+5XKL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669611, "uuid": "31135e06-11dd-43e9-a913-4a45d72d072f", "value": 36080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669611, "uuid": "2f8a49e2-d230-4bcd-a08c-9f2ad11c92eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669611, "uuid": "6d67c36a-a7f9-42aa-b6af-bb4dccdcd68b", "value": "SecuriteInfo.com.Linux.Siggen.9999.28566.9228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ce3072-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692858, "uuid": "3b904c94-3c44-4762-a427-84cf97e584ce", "comment": "Malware payload", "value": "ed59faa4c873876024938e54771dfe8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692858, "uuid": "bec2d647-3bb2-4de0-b30a-191e4bc356cc", "comment": "Malware payload", "value": "6adedce33d9fef43c28df812acc3a1cc742bd5b07e85cb8096506510a94439bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692858, "uuid": "6d368cd6-4d2b-460c-a7e6-72bd7570e7ab", "comment": "Malware payload", "value": "5d0bdfd5610981e999808277c361f0452b7248b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692858, "uuid": "424cfb33-d7a6-47da-995b-753e4c0a861e", "comment": "Malware payload", "value": "63a3b570ef2b40ade298f85da83a86f3a1c68d8b8a99d36ee39150376df38508ff03b43b2e6b4bafb90ffcf095c3885f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692858, "uuid": "c2f7979b-65b2-47f9-ab0e-276fadaaa5a0", "value": "T1237496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692858, "uuid": "f97b940d-5d65-4ef3-8c6f-b92c09d4d7e7", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692858, "uuid": "82498216-8e22-4e95-b057-7c7875671de9", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxz:IXdaAqvRwWoe2XjSVvUYuyHWPBsxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692858, "uuid": "d2c215ce-8ba8-4e63-a473-ba9d4141d3b7", "value": 348116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692858, "uuid": "72b8bc67-0981-4f43-a8d5-f467e43c9716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692858, "uuid": "aaeb13eb-2226-4e2f-9f22-4ef70bbd9140", "value": "6adedce33d9fef43c28df812acc3a1cc742bd5b07e85cb8096506510a94439bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f78891-f60b-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712624122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624122, "uuid": "6dac440d-9593-4b3a-989c-458f4cdcf1f5", "comment": "Malware payload (Socks5Systemz)", "value": "a83fa5bb02751dbfa327f9ab06dca6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624122, "uuid": "3574d446-d516-45a6-993b-c72f1fdb6575", "comment": "Malware payload (Socks5Systemz)", "value": "6b251b357a4ff2ff8fc367c082918f11872bcfc6ba6b69059c0d876de53337a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624122, "uuid": "a6a8a844-4758-4b7e-9dd3-28fad3039564", "comment": "Malware payload (Socks5Systemz)", "value": "f16ae580b52c611b0666f26a27f2027b111ee181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624122, "uuid": "4a76ea0d-60d1-41bb-be6f-07e743ab2406", "comment": "Malware payload (Socks5Systemz)", "value": "7b04cad1e265df59fa78ffdf4e4a6e2774c18e70b153117505c1878bf685ac185149b2522c121b3892d57a0244244f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624122, "uuid": "c85043e4-e29b-4136-b37f-db05570c797d", "value": "T17B16333E839299B1D462CDBC85B2C4094939752D6934F21A6D8CDFCF5F3BE8805863D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624122, "uuid": "df5307a1-1bf7-4358-a6fb-f6f1179f6a5c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624122, "uuid": "bc94f7c3-2f7a-45e9-9863-e1a49fc62ef7", "value": "98304:CjOPRTI3Nar3fLobbeVfnGkSVqDWmbnsazR/7/qKwPLBzI21xQxE:DNIe3k/eVvGxUDdZ/q1LBMOxQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712624122, "uuid": "2d7f6cd0-6083-43ee-8bb0-64228f20893d", "value": 4208485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712624122, "uuid": "dddaea90-c8e2-4baa-8a8e-14e6660985bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624122, "uuid": "ca034a5f-0733-48ed-901d-1b0d7acf253a", "value": "a83fa5bb02751dbfa327f9ab06dca6df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2be9979-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692859, "uuid": "eed4dfac-b89c-41ed-a3ee-14ceb3dd3460", "comment": "Malware payload (Blackmoon)", "value": "5b295c9a50b4f223056cd6b78ca4cadf", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692859, "uuid": "452d5b6b-2724-4bc6-a418-33e289da4e61", "comment": "Malware payload (Blackmoon)", "value": "6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692859, "uuid": "5cf44ae6-7b5d-4c19-ab2a-bef73b3ba51d", "comment": "Malware payload (Blackmoon)", "value": "77741f23ca09a7a724b2ce2c4db76942b2cc8f6a", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692859, "uuid": "e50687fd-d5f0-4660-bc0c-cccd1f8a60c9", "comment": "Malware payload (Blackmoon)", "value": "b7ea9552407298f85b7d6aa08b0d93f148b2a6f67cc878208aaa306383d3cd513965b276315d379b130d46d34a471810", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692859, "uuid": "8fe75d8e-712b-42b7-bab6-8280e862148f", "value": "T16594B8137221D491E15967FB62EB433879B8875438F0CE23EBE4DD62ACB11619B1EB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692859, "uuid": "e11c8a29-7335-4ada-bd07-863b1d3b8a4f", "value": "6144:rvk3Q5ibjnNuuXckaL7pbRBkce97awd7L7o9T:rvMQ5ibjnwka3pbRC19Gwd7o9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692859, "uuid": "fbd8ca19-7859-4d60-a19f-e955b777a7ef", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692859, "uuid": "4f8ad0dd-a710-419e-83b7-5b51d23c2a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692859, "uuid": "de1ff113-bef7-4099-83e2-7c3ea3d23c91", "value": "6bc3d2c84fe9e6808ec252d03c462e8bf15a6d5b2e06355918c1a5f08b50fbab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d641be-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692861, "uuid": "b5274d81-eecb-4a44-8945-4fecbf072bf2", "comment": "Malware payload", "value": "ea140387da43108370e6bda747e9c0d1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692861, "uuid": "8f63b26b-6c8e-4c9d-93b0-cef0562518ad", "comment": "Malware payload", "value": "6be06a06050ced63aa3759e19121cd8b25614ea5d16fb536d159c30657feb639", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692861, "uuid": "f54560bf-ccc2-4626-9d58-a9fd784d9605", "comment": "Malware payload", "value": "39131b34bf2c6d6eab9beb07cde86b0cfeae6e8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692861, "uuid": "3d3032f4-2ab7-42ff-a483-144f44148c53", "comment": "Malware payload", "value": "3e6ec0a2ec974a4131db1722ee64ffe0cf6e34b1fccef0072ef35233101c0f5a1c813eb4135f85c12b11b212ea4e3057", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692861, "uuid": "bce9a741-6ab5-404f-b271-6d1916ab0ad8", "value": "T109A4B8137221D491E15957FB62EB433879B8875438F0CE23EBE4DD62ACB11629B1EB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692861, "uuid": "e9af0a3f-67aa-4cf8-b2ac-ce249203c535", "value": "47b8255ad5482cd954f979aad5057652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692861, "uuid": "8fc4bc6b-4318-410f-b0c0-c16c5915ae9e", "value": "6144:Wvk3Q5ibjnNuuXckaL7pbRBkce97aw6P7L7oBTvq:WvMQ5ibjnwka3pbRC19Gw6P7oBTvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692861, "uuid": "a835bd69-0924-4ac8-a9a2-0b16fde6777a", "value": 449181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692861, "uuid": "e3a3830f-bb81-4295-a7b0-2d13283ba31c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692861, "uuid": "5ac74175-0c1f-478b-871d-cc3e0f1908e2", "value": "6be06a06050ced63aa3759e19121cd8b25614ea5d16fb536d159c30657feb639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75003230-f67a-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712671630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671630, "uuid": "07e10adb-1986-4436-b739-8b7e15e4565f", "comment": "Malware payload (Kaiji)", "value": "4cc6092726dfd4dd9eb5115db7dec0ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671630, "uuid": "7390716a-ca69-4b03-a51e-2d96370ce55c", "comment": "Malware payload (Kaiji)", "value": "6c7e387d1c61ba836d3a65875b47b5091afa8b951ac9663a9dfd856fcb19f03a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671630, "uuid": "c7af4ed1-1867-4b9f-8e7d-3db8c5a23d22", "comment": "Malware payload (Kaiji)", "value": "36b537f8158bae191c4723d132a2e9166a56f993", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671630, "uuid": "74b004bb-2a6f-4273-b1f2-ac372eaf85d0", "comment": "Malware payload (Kaiji)", "value": "8db7a016a5daa9248bc4e43699a92388ed00b55a0b7db523188cbcbe62284ce4a13eeabfb1459462abf4c0f85cb284e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671630, "uuid": "73c70c5f-5eb4-4d73-9e00-0a644e44f7f3", "value": "T183363C5BB8824A82C4E4367ABC7D41D473A34EB99B9713666D05FE3C3EBE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671630, "uuid": "f4522e24-a86e-4a93-abcb-804074bfff0f", "value": "49152:oQdGkSpsqkVpXGi8TEeK1cam+lr0wSHyeVI18:oQYzpsqkVpXXeKzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671630, "uuid": "dca9f6bf-0861-44b3-aec5-f6af93970fe8", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671630, "uuid": "5a5b4e46-51f5-464b-974f-dddfa2e45aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671630, "uuid": "1713a83a-ff0a-4851-8f36-53e1da82c24c", "value": "4cc6092726dfd4dd9eb5115db7dec0ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50ae052-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692863, "uuid": "aa684b64-b442-4d64-9317-d626593f80a7", "comment": "Malware payload", "value": "7205f002df1c7ae0781745008e10caf2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692863, "uuid": "223de156-8867-45fd-a234-c0bb4619d848", "comment": "Malware payload", "value": "6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692863, "uuid": "146014a7-7e79-412a-bce4-18adac2a9468", "comment": "Malware payload", "value": "9a9b5821d3483ef15604d0eeb839d671cac694ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692863, "uuid": "5c5c3022-4b72-49f8-98f9-9cbfbe96004b", "comment": "Malware payload", "value": "15149fa2b44421cb8a910547793b3cbb654b83e13639fb6dd3ae67ead9d0f835c5c194d2c5797f54da5c94f9e0b422f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692863, "uuid": "59ec34a8-0d8e-4d66-aa37-cc980f8a9ab0", "value": "T11DB4E913B6229495E1145BF66BBA073869B8836038B1CE13DFF0CEB2BD71531975E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692863, "uuid": "00562a8a-fa5a-40e3-8a83-6b3ae0a99fff", "value": "3bb3093a5eeb1047bbdd41c02a894dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692863, "uuid": "e43aa2dd-c11e-45e2-bba7-ff5c9cd3eb3a", "value": "6144:n0m2FqgDAuSbAXKfz0c0sUIJH1H/yWaDq:nZ2FBqA0z0cIeH1H/yWaDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692863, "uuid": "85198d1d-32ab-4254-950e-497bcafa278e", "value": 531208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692863, "uuid": "dcc11c34-cf7b-45c6-a996-2cbf2ccf82fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692863, "uuid": "a9a2345a-e3c5-47ab-ad4d-2b0e533015e0", "value": "6db986c2918bb61f7093a335666fd42ffec583ad8ec46a4f22316d18fbf62815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9731683-f6b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694911, "uuid": "dfa0d407-8814-4fee-9387-fa67ba54b739", "comment": "Malware payload (Gafgyt)", "value": "5e60e25f847a7ee1af72ad13af1bd34a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694911, "uuid": "861854ad-275c-436e-a565-c054173107ef", "comment": "Malware payload (Gafgyt)", "value": "6e685a89b4c3f170b849ecc99d806fe00dea9ae7248caaef2afbb30bf473264f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694911, "uuid": "f7bb3cc3-c9c3-43c8-970a-63fc97a1bb83", "comment": "Malware payload (Gafgyt)", "value": "3c04a02769cfc5331e0b82c379a59643daa6bbae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694911, "uuid": "23b8c3d3-22b0-452e-91d0-c379fc0466f4", "comment": "Malware payload (Gafgyt)", "value": "39c4334ccf1a2d574c1dbc6f5bd2a50c05e697e84cff265613888ca1c79e870aa13678c14aa17d19c8b374b9cea95e1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694911, "uuid": "a2178f62-9ad4-4649-9335-08736b5115dc", "value": "T1BFF36C64E544971FC1E22379E6CB425D3B23479AE3E733044538ABB83FCA798AF62511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694911, "uuid": "63eae3a6-a077-4081-8c0e-ef31e6e6d8d6", "value": "3072:cqIXaFuFnwe3YpO4qDGqZEnDh4M/9ljiEmRwdBa7QA3N:4XaFuFn73vDGcEnDCM/9lmEmRwdBaMAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694911, "uuid": "4a6f84e8-5bfc-4cc7-b998-372d64f37bfd", "value": 172407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694911, "uuid": "ebec2805-8a14-4acb-a59d-b8a5a57f4a7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694911, "uuid": "12ff6b6a-41e6-472f-a003-26da1e44293c", "value": "5e60e25f847a7ee1af72ad13af1bd34a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ec207c-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692865, "uuid": "e2f8cfd9-384e-4391-a134-b05ad3a64940", "comment": "Malware payload (Blackmoon)", "value": "6708da536c54a1898ef5a945212359f4", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692865, "uuid": "fa40282a-e15e-4729-87de-bbdb03f38953", "comment": "Malware payload (Blackmoon)", "value": "6f3039407660591048262796a25d25a03c811d45dc973dae85ee7f136067439f", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692865, "uuid": "9d76902c-5dee-4346-8801-3fcb4dca7733", "comment": "Malware payload (Blackmoon)", "value": "28b5a66f9228be37a33958b3a931ce23187a1c42", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692865, "uuid": "b81e0702-7244-4793-bb37-c5a7944eeeb0", "comment": "Malware payload (Blackmoon)", "value": "c1a0c9d33de7c6c3994e45d7f31519ff43fb5edf419f19ca7cb6723e746df69a7d9a0da82c879a9f5974bc0849dfa1b3", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692865, "uuid": "1d7e85b7-1f23-4cad-bb49-450f46bbb31f", "value": "T117B3F823DA0289BAE06826B521FB0738FA7193B91C750963EFD5CEB17C52631DB4364D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692865, "uuid": "b054595f-9df8-41db-82e2-23a109928d44", "value": "38777b3eb947cc68a2158922f2c92579", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692865, "uuid": "e3b46f1d-2be2-44e1-8743-4e6ce50cf554", "value": "1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27qarf:bav9OdPx8wJ4rm7qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692865, "uuid": "1ebfcd1e-5978-4892-91c9-b9243d2f2683", "value": 116226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692865, "uuid": "7fb19450-64ad-4818-9a4c-1e7ee4da9b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692865, "uuid": "742e14f3-d886-4686-9906-013c65474743", "value": "6f3039407660591048262796a25d25a03c811d45dc973dae85ee7f136067439f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b4dc51-f69a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712685583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685583, "uuid": "a9852bd0-ac26-4fd0-9ee7-efc1a64d32da", "comment": "Malware payload", "value": "cd8965f100307025a9562c8ab7bdc021", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685583, "uuid": "f905b03e-f5e3-4af3-a8d8-ee6264137046", "comment": "Malware payload", "value": "6fa637f04205998b312dee522a694b5f4e3629e38c0c97ecac5910a59414462e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685583, "uuid": "998545ad-6a1b-416a-8ea8-6ed50a8ce454", "comment": "Malware payload", "value": "015426b91df70d80bc3f40233ab19eacfddc3791", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685583, "uuid": "806440c1-d7c6-42be-8404-555c753f457b", "comment": "Malware payload", "value": "346b371ce01dd401417d065f935c5c1639b074ea0a159fcd73955ea8d8ee8d8eec4324ae1970c742843c7f417d715a35", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685583, "uuid": "814e8c26-fb7d-4a90-84da-b2baffc1a4cc", "value": "T1940833EC6FC0B94174EC7FBE5D2B79A7E373909D9ED04C9231A416C26832C571D2A226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685583, "uuid": "e883d893-428e-42ca-a9df-4e65b70634bd", "value": "1572864:ySv5+KBjaR1x7pB+3PPxVKPRBb0n1eoGyHg+EMzR12sok8RJl:tAuaR1F+BVyROn1eUH6i2sCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712685583, "uuid": "ce0b9462-ea6d-48dd-ba2c-3bf2a2adb405", "value": 78032662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712685583, "uuid": "5b135487-15f1-4ce3-8dd3-4020dec56d49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685583, "uuid": "9951f69c-dd4b-4337-b770-592b9e267a11", "value": "SenPalia Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c76aca9-f6b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694889, "uuid": "57b99abb-1ed4-4ef3-ab53-639ca9dde86d", "comment": "Malware payload (Gafgyt)", "value": "ae04b39e39a615e0c6961a78b2a9ee8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694889, "uuid": "3e494857-9116-47ba-847d-13973973b185", "comment": "Malware payload (Gafgyt)", "value": "7005df1008b9c515ee3ca1bdb8747676ac175b69656588680a12febef44685ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694889, "uuid": "b4c916f6-5176-4e93-a878-57ad8bf3755e", "comment": "Malware payload (Gafgyt)", "value": "21610d049dde8444121565305af900ab86978bcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694889, "uuid": "f541744e-ee69-4e06-9dd0-9c77a8a1a1f7", "comment": "Malware payload (Gafgyt)", "value": "0f745580f981dc24e5d26875569bb3920a51f6e4a345c8db3c96a6bdd01215299cbb5e98e45df960af5f5a7c1b212209", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694889, "uuid": "b568da19-e886-4094-98e6-a1dd144517b6", "value": "T13DB30A90E848671FC2D327B6E78F4AAC3F39065AD7E737015A3859B81BC97887F65120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694889, "uuid": "6e40261e-d209-4c74-909b-e72d79ca32c4", "value": "3072:npQc51TXR/GtR2LGD7sX+mLuqQEDIBVXFkQ:nz/GrIGD7A+mLuqQEDIBVXFkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694889, "uuid": "49d39414-fbb2-4a6b-b7ff-d38b203532cc", "value": 113804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694889, "uuid": "5f63deed-c28e-41d3-b35b-2720627221e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694889, "uuid": "cf938bd6-e337-4158-9ddf-86d72159434a", "value": "ae04b39e39a615e0c6961a78b2a9ee8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc89a05-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712672262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672262, "uuid": "41fb84b2-ee9b-47bf-a380-59c7d63523cf", "comment": "Malware payload (Gafgyt)", "value": "effde65f7f5b54b179aef75e7dbfdd81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672262, "uuid": "52e1e230-e7e2-4de0-80c2-525688d1d1ed", "comment": "Malware payload (Gafgyt)", "value": "70fabca2438bb025327baa9452e91daf751f856748635e78a996769155442972", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672262, "uuid": "b7256b19-bc84-40ed-a745-59267a7c6a4b", "comment": "Malware payload (Gafgyt)", "value": "b8534563386734bf694f74a091bd5f5a28441cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672262, "uuid": "9452f844-2a5d-4654-80e9-4c36635dd5e6", "comment": "Malware payload (Gafgyt)", "value": "2578e60172d97a589b7ea4a84ff744c5b6ac6b6d1288e22890edf604c600fb93e3c86f14b0cda4c2cefc752c1741d539", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672262, "uuid": "387cd81d-cefc-4224-a88f-ceb31977c47e", "value": "T1B7B3A52A3A22AFFFE16C86310BF35F7097D5219226A19385F26CD7581F6128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672262, "uuid": "3e3520db-c697-484f-ae6d-f193e97269ff", "value": "1536:27j+1Tohq+XZ6NDmGf/Yo7exVXMsMNeUdPIUmkiIF8iCKrmne:hK4f/YrcsMrPIUmkiIF8iPrmne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712672262, "uuid": "29e628e3-11cb-402b-a23f-9b487a2a0cce", "value": 108974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712672262, "uuid": "23d28d37-cd7d-46da-9bbe-b29cfc0b69ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672262, "uuid": "98bc35dc-712d-4f47-ba5f-ac3694904ad9", "value": "effde65f7f5b54b179aef75e7dbfdd81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82c7c31-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692869, "uuid": "811cbad2-9b99-4601-bce0-634ac639ac70", "comment": "Malware payload (Blackmoon)", "value": "1722735d4c27bc5ff0789bafbc86d7fa", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692869, "uuid": "34d0268d-8d56-4361-9f1d-93a62e2bf7cd", "comment": "Malware payload (Blackmoon)", "value": "7121dd731aa2c7691920eebc437a77dfb219fcde909adb2a3dedb4a2a7c6e220", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692869, "uuid": "d1e43539-78cb-44f1-897c-2fcbc1b6fd2b", "comment": "Malware payload (Blackmoon)", "value": "37d874a2d8a3a2c67fb25516feaa72925d4075a1", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692869, "uuid": "9bcd4ed1-634d-4cb4-8876-4e63b85ef9b6", "comment": "Malware payload (Blackmoon)", "value": "b03434b96f03769ccccaae7415e7d04e3b8ad0626d8653d07be50a3c795a542ce0538489f6982c2db089d2246ad959e1", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692869, "uuid": "848faf17-aa18-4f2a-bc68-96fe9faa22b6", "value": "T14AD57C137230ECB5FE0C1A7685BD4735AE78115838B1C6BBF7A1DE76AD71A018722A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692869, "uuid": "c35940e2-a434-4cd9-b917-845eb9959312", "value": "39399841b9c8e4524dc461ff9b66709d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692869, "uuid": "1dbb87d7-ea7a-4bb2-85ae-db3c7f0c342d", "value": "49152:jF+P9VgqrzbfDULyOPtjN/lXekpomFsEB7yOrRBST1Wjyr:J+PfRELyOhN/lXe4FsNyOWWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692869, "uuid": "0c952ec6-0379-4d7d-99c9-d9de50baf26e", "value": 2974466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692869, "uuid": "9e193830-527a-4c48-9fd6-fd22ef8ec083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692869, "uuid": "05513517-0466-40b9-8cca-022c6285ebda", "value": "7121dd731aa2c7691920eebc437a77dfb219fcde909adb2a3dedb4a2a7c6e220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465ed67d-f6c8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712705052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705052, "uuid": "ac7eb4a0-20bb-45a5-8e03-921a43af5418", "comment": "Malware payload", "value": "fe9aa0bc26135f8405e53d7491123db2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705052, "uuid": "af18346e-fb3f-4278-909d-0d2ab45af7ce", "comment": "Malware payload", "value": "712621def7b98fe76602793846285be0b7d6218009065de8dd84ae4ed0ca3105", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705052, "uuid": "558d4aad-0f2c-4484-a42b-be355ae1a09c", "comment": "Malware payload", "value": "d73ae2973c4d2daabe6fbfe6b6f4153546873018", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705052, "uuid": "b0654721-f7a4-48b6-b1f4-f1cfa501d5a2", "comment": "Malware payload", "value": "e53b4341a9a45bb7a692172ef9e3119ea3ed771c3c3a47fcfb0d37a444943c2dacec2277d619d85c5df48a05f519c171", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705052, "uuid": "34386616-1faa-4c56-aec1-6df5ac3aa80d", "value": "T1762733073EE08F19D624ACB69575FB342359BDC81F085E1292583799EEF30E06371ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705052, "uuid": "ce30caf2-b693-4d9d-aa56-942af399d1bb", "value": "393216:BiTqnoBHAZHFbs+LMXsq4rd7Q6gM+qDhKeIx5jV/:BicotAZlbsbiZg+1zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712705052, "uuid": "1114a950-5b12-4867-a4c1-cf1d2665044b", "value": 20971520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712705052, "uuid": "e0211cf3-94ff-44d4-94ad-0eb55f668ea5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705052, "uuid": "49582787-17a4-451c-95a3-a564dc8115cd", "value": "SecuriteInfo.com.PossibleThreat.PALLAS.M.26426.24499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a58b3ae-f620-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712633011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633011, "uuid": "6da0c05a-17e9-46d4-bc78-9a0aba9798ee", "comment": "Malware payload", "value": "554e4f02cce9bfad4eb42a222ae83727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633011, "uuid": "d1fac5d7-3fb9-4462-adb2-28861b9148ae", "comment": "Malware payload", "value": "71e4be565bfad3cbceb84dbd8bc1339891e8ba1036bd8d6bd7e290e4585a6f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633011, "uuid": "fd685eeb-54f3-4415-a539-8f748d780974", "comment": "Malware payload", "value": "686d7296daa6b0e28ba18a8f1c6557c57e752f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633011, "uuid": "693792f7-b880-4007-9cca-0d0d2c0855ae", "comment": "Malware payload", "value": "5ddb44e3a9340506277701dbc62dd61888c58b10bc199977c4563ea8ed8ed279e166102cb3eec10bae9212dc804e0d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633011, "uuid": "d60ece9c-9c43-45ae-a4a9-90d334568847", "value": "T1DC46332227F0C4B7F574B87305759A6653B0D359908393938BA4AB4EAC3A9317F3B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633011, "uuid": "b96e26d5-26fc-45d3-a503-e7728ae89be4", "value": "1c042238f43557c055fca8642de8a074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633011, "uuid": "f0fcaa20-b37e-490c-a6f3-d9542017646a", "value": "98304:Rpom0K9bcmHlVHB42Vmoqw2/6y/1FkNH8yq2Qu5V9Fg/7afN7+day1ug:Re/K94mHu8uw66ycOyvQu5VjgDU7+1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712633011, "uuid": "ca96540a-48fa-421d-a32b-665bf7c1c91a", "value": 5681626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712633011, "uuid": "a32b150d-5550-4d91-9210-54de3e279d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633011, "uuid": "663b2ff8-c561-4516-a91f-8f4db1af6202", "value": "SecuriteInfo.com.Trojan.MulDrop4.6105.23715.19499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9226524-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692870, "uuid": "3873c4f3-0c01-4904-ac65-acb1affe51b5", "comment": "Malware payload (Blackmoon)", "value": "c38910ed1d6f156a07c59b1d8b5164ba", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692870, "uuid": "c85ad761-f63f-4f0c-8aa1-3d78a4df0e66", "comment": "Malware payload (Blackmoon)", "value": "72aa8d18265109bfa5401eff0108e55dc59e3334aa278e54e00bb3718a0212a3", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692870, "uuid": "6aa2a2a1-c9a3-4468-b02d-2a47a340a4fa", "comment": "Malware payload (Blackmoon)", "value": "76993b99f5a438879bff258d7eb2203533e3681f", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692870, "uuid": "b06e0c44-4ae9-450c-a28d-1266b50cc620", "comment": "Malware payload (Blackmoon)", "value": "d2a48aad2b27d4a336d60f1dfb50da4807c2056f0682de533531bbe528d8be2cc4bbee3bd8aa96fad494bffc6714ecb9", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692870, "uuid": "270d6d0c-a40b-4691-a0e5-90113d6d331e", "value": "T12DA4A61372319491E1595BFBA7BA433879F8836438B0CD23EBE4DD62BCB5122971A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692870, "uuid": "078fb83f-963a-4236-ba0f-9f9b27abe348", "value": "d070a98a3bb72e151251c216b80dfd90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692870, "uuid": "8946a2a4-2e4d-4c94-90ce-e06aca621841", "value": "6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZy:/vpv/R6H3U25fehHpAW+yOBOKCZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692870, "uuid": "f97227c3-1f05-4f80-b02b-4701c1104963", "value": 462916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692870, "uuid": "50a43901-c17f-4e47-94ce-38b500ac874d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692870, "uuid": "49b6525a-ad00-442f-abf4-7ca97f1d7961", "value": "72aa8d18265109bfa5401eff0108e55dc59e3334aa278e54e00bb3718a0212a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1920a7-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692872, "uuid": "e42224fb-b284-4a04-821a-8e91ace85a0c", "comment": "Malware payload (Blackmoon)", "value": "0089b2568ccdb7b801df0c5cbbd19dc7", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692872, "uuid": "ef377a2b-b186-4225-9151-faa033dd3d68", "comment": "Malware payload (Blackmoon)", "value": "73a5606dd57ca2eaacacda3e2386f50c81390d3be4a5277ef8375be3ab7d4a1d", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692872, "uuid": "e9205c67-121d-40f9-a7bf-ad9ba91ac180", "comment": "Malware payload (Blackmoon)", "value": "27463eaf06b65a79ba869da8fe85058f3784e245", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692872, "uuid": "767911e9-866d-44d5-b9ea-37704a2476bf", "comment": "Malware payload (Blackmoon)", "value": "fd4a596062a3801ba9d86d707bc3ebb17b10fce15ff7c182210136e35fa7bb54fc6111c384e2299ce0078a6d2d6e436b", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692872, "uuid": "eb3d0d13-4f07-440f-ab82-f827ca96ea51", "value": "T1CFA4A60376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692872, "uuid": "08bb4409-7bd3-4aed-b4c8-d168087f8f11", "value": "6144:FvbuWQu/cuaS2l8iE0B55FrJJJekPdI/2oAge:FvqWQub2lrE0B55FpekPdI/2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692872, "uuid": "4a624641-bbdb-407a-b8c6-123a4c77096d", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692872, "uuid": "9039657f-d073-46be-b9b6-cea9eb81d0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692872, "uuid": "60cc6e8f-950e-4928-8dd0-0e422ed8dc57", "value": "73a5606dd57ca2eaacacda3e2386f50c81390d3be4a5277ef8375be3ab7d4a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879be44c-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712669514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669514, "uuid": "996e512d-ac4c-4d3c-a7d3-e99789ad8f35", "comment": "Malware payload (CoinMiner)", "value": "6b1d9a9df32d39a44d1aeead4c00a167", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669514, "uuid": "79befcf8-1763-4d71-b79e-85ab41f54f5b", "comment": "Malware payload (CoinMiner)", "value": "73cdf7847b9d9e6a61beed964141fb1747f68b0989ff6a3246bb54b0a1298688", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669514, "uuid": "a3344505-e3bb-46d2-91f1-055157cc71c2", "comment": "Malware payload (CoinMiner)", "value": "2e47f37f9dd78f6b3dd4e7367958dccd241b341f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669514, "uuid": "b7537a58-92b3-43ac-bc23-a778e498d011", "comment": "Malware payload (CoinMiner)", "value": "092da41ea328d2d7b0670c00930c7a99035e9a6d20cca6ebbf8e1eb97872e525adc2263e1aff68a4fc02ba4c8e26d59e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669514, "uuid": "05930e7c-1d32-4fdb-b963-fc1a2e4eb1f6", "value": "T165666C87B8918642C4E43776ACBE81C433636EB99B9723576D04FE3D7ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669514, "uuid": "06a5edf2-a9ce-40cf-9b6f-26b0c85576a8", "value": "98304:2jiKhBqpOOip4EjXqJnCqH3AzJOYobSbF:2jiKzpnqF73ANwaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669514, "uuid": "f08fde78-7c79-4818-81d9-20cba6edc2d6", "value": 6709050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669514, "uuid": "024fe54d-b43a-40a4-a90f-015d68233a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669514, "uuid": "aa74940b-9708-4145-87f5-e2142c6e6b4d", "value": "6b1d9a9df32d39a44d1aeead4c00a167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5520f2ee-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669858, "uuid": "752a1bcd-a0e3-409b-b3c8-511a02dc3e48", "comment": "Malware payload (Gafgyt)", "value": "8d147d51a3c1eb97a0db2f1881c51f66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669858, "uuid": "ba26a721-9816-4485-9001-7b3728aca603", "comment": "Malware payload (Gafgyt)", "value": "74919826abb55c61aaff5bd2cb3f78523156edbdc060a48fe391cc56db541612", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669858, "uuid": "967974ac-e3c0-46e6-88c7-abeea66c7107", "comment": "Malware payload (Gafgyt)", "value": "564e00c19d0b7eafb5c25e5b286b56a080f48a53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669858, "uuid": "57d6920c-743b-421d-8023-5b0de05a2ce4", "comment": "Malware payload (Gafgyt)", "value": "1153e4efc22a6b2a2fb82ec2cc164f8932aacab07993003dc37404dd1c0f17ee59192aae16e5abc9ddea90db94b02bd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669858, "uuid": "7cd407f3-bec9-4475-89ba-4dc901577787", "value": "T16E934B1BA651C073C1430A7212EBAB550532F6F71B9A6E17E3AD2EF0AF024853167FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669858, "uuid": "86a5a0a8-a12b-4d29-98bb-9fbfb8249cc3", "value": "1536:f6YPvUmUQxkOD8mugU4lMCQUpzOo64XvGzNFSqmpEtMh4PH51ii:f6YPvUmUQxkOFu6lWUVPvGzTSqmatMqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669858, "uuid": "22acd167-2c8f-4c23-95a3-34a8e2c84a3b", "value": 96089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669858, "uuid": "3f433e0d-253e-4804-8967-c93db26a7ca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669858, "uuid": "3736b080-eebb-42bc-8dc6-054002f2d676", "value": "8d147d51a3c1eb97a0db2f1881c51f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead6f8c1-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692873, "uuid": "f6603abe-d07b-44f3-baef-ab08cc133642", "comment": "Malware payload (Blackmoon)", "value": "b029b3177a5d851af30027155da7dcce", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692873, "uuid": "422e2832-ce2e-4390-a24c-9f986340ad1b", "comment": "Malware payload (Blackmoon)", "value": "75591c993c31c970187975d1c4cbc15fa3e8475023beb8b5bdcadac3d7f173de", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692873, "uuid": "154b749a-c3e2-4149-b42d-1b1ece2829ad", "comment": "Malware payload (Blackmoon)", "value": "38982674af0e5448df386eae3659e78665b72bc7", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692873, "uuid": "cb779e9b-310c-4067-839f-a1d8de7d60e5", "comment": "Malware payload (Blackmoon)", "value": "5567aa6a222cfdbfe295335a1651ce9897f1cc4cf50317bacdbf92765c0a535fe46cbedd872faa3244fda4b9b9258330", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692873, "uuid": "df5c0d35-c627-406a-9fcf-b293dcba81f8", "value": "T1E023AF03ADC249F1E825427639BA077DFF3881C16D31861BCBB1EEB02973625B52A54E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692873, "uuid": "d9cc25f8-754f-4b1c-8e85-256eac1961ef", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692873, "uuid": "bda04acd-73c0-4a39-9226-6ed8fd4f38e4", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+Xl:w0hAW1iqdWNzI5Pd4CSyDt+Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692873, "uuid": "cb7caf13-6d63-40ce-b39d-79f5e9913a12", "value": 49246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692873, "uuid": "0cb2881a-fe78-47ce-a419-e12e87aaa524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692873, "uuid": "7e4fbf3f-42be-4b92-82df-a52768266824", "value": "75591c993c31c970187975d1c4cbc15fa3e8475023beb8b5bdcadac3d7f173de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcf8e4d-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692875, "uuid": "b34f4a6c-6ef5-48d1-8729-18c720369747", "comment": "Malware payload", "value": "5ebf47a6de326bf83e254895e416af4d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692875, "uuid": "8ace3f9c-f677-4849-9bd2-212523d94172", "comment": "Malware payload", "value": "759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692875, "uuid": "3a3fba3e-9f11-4b5e-bac8-edb8b82391d1", "comment": "Malware payload", "value": "02559db1fc9cae58c0a7e47898a9bc855c92e4da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692875, "uuid": "6487993c-03b3-4329-83e7-2e12eb1c4535", "comment": "Malware payload", "value": "91dfa9439dc8c245a664dba901676e9ba4f9f5281ad697c625a4661bf096f4a8e9862c0b86081d269a3ceb27dadd1388", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692875, "uuid": "fdc9673c-bb0c-4c57-adbf-fb3d6cafe9c0", "value": "T150A4A60376219491E1595BFBA2AB433879F8976438F1CD23AFE4DD71ACB1121871EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692875, "uuid": "05c02c9f-8086-4ebf-a615-1349277ec9c5", "value": "391b34fdb03bbbe961a380d74dcff2da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692875, "uuid": "b275e0d5-9dcd-43b4-b198-1fc54b5dc33a", "value": "6144:uvbuWQu/cuaS2l8iE0B55FrJJJekPdi/2gAge+HO:uvqWQub2lrE0B55FpekPdi/2RCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692875, "uuid": "e870c1d7-f8bc-4a10-9a06-bdea2fce1564", "value": 469766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692875, "uuid": "26134327-499f-4c50-ac99-b028e4583de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692875, "uuid": "8e4f976d-2f9e-4994-b101-24de45b77e76", "value": "759769fe18961d9cf00ce42880ec10551be8bafe7fedddc653dcf17008fd992c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04841ceb-f68c-11ee-a120-42010a9c002e", "comment": "Malware payload (XorDDoS)", "timestamp": 1712679172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679172, "uuid": "ae4ad7a5-5c4f-4210-9bc0-06556331cfe0", "comment": "Malware payload (XorDDoS)", "value": "694a672878a1f7945c020a0a3ca74367", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679172, "uuid": "9594111e-4664-4004-be96-74ee9489983d", "comment": "Malware payload (XorDDoS)", "value": "75bfd448e4274cc4e5804c43768f62a36ccb3fc3b1df06e14d9c892daa2cde19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679172, "uuid": "1df502d5-2737-4629-b123-a51c0bb411b0", "comment": "Malware payload (XorDDoS)", "value": "148caeaa8ac7fdf46d48fc2d1d0020d1bf41d442", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679172, "uuid": "0db75b57-53d2-48f4-a913-1d1d88205ff6", "comment": "Malware payload (XorDDoS)", "value": "c9e4d86facb831fafa7935b9680cd1aebf875dbee80044b786251ea446705a627a09d418d343d9fd8f4ce9ba196b416d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679172, "uuid": "d15b7724-d1c9-4f17-b046-986aedc1204e", "value": "T15CC45C56E383E2F7C82705B0134BF7BF4620B6359461CD86B7989D5AB9338F22A4D352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679172, "uuid": "bda8fde3-8d8f-41d9-b081-5d16974dd8c4", "value": "12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzP66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5PfjQn36Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712679172, "uuid": "03a4e554-23e2-4169-8680-41b285cceda6", "value": 548616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712679172, "uuid": "88b1144a-45df-48a3-a3fb-11185255af0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679172, "uuid": "1646da46-f299-4808-a697-e8af9c63ee69", "value": "694a672878a1f7945c020a0a3ca74367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71880f96-f65b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712658310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658310, "uuid": "b53d37bc-73e3-40de-a42a-3d5a050bb0ed", "comment": "Malware payload", "value": "15e5e31ee8f068cf994c9ff1d695c017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658310, "uuid": "d4a05f74-6c48-40b6-ba86-3d793eec9445", "comment": "Malware payload", "value": "75d36aa774b347934302171fb2b946ea9c6e2f2edc9a5eed4c3f2941c679dffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658310, "uuid": "ded82834-1be4-4e1e-b9cd-8ff98dc42aa0", "comment": "Malware payload", "value": "7c5f2958af41d590a977763c3e01a96e53135da1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658310, "uuid": "54719ab2-2310-4294-a723-ce1e84d53e36", "comment": "Malware payload", "value": "fdb9c996680bd6dab2ab74f0d1e1684fc59dc401a184bc5959814196f67dff197ff0ad461b6ee8fb737e17f2d0fde4d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658310, "uuid": "07c21a47-a53f-4764-99d3-0e1d2c4ec04d", "value": "T1DDB501607AD294F7F9620535402FA627C679BB544B3189C363D83B2D9A372C21F363E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658310, "uuid": "40eddf69-85cd-4f4a-8d33-508799782925", "value": "998aa17bdb177aa9cdef39798c0eac70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658310, "uuid": "ca4e624f-225c-4b62-bf5b-fc935f6752c9", "value": "49152:IW4uInRD9r2V4NO/TkKoFfklQQ4lLyfUcRdlpuhqu87+z9/NKTiFFg:94XnRBr2V65KUfFWf5dlpuhqu8uFYTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712658310, "uuid": "951ed1c5-71e6-42c2-863d-c8993b3fdf12", "value": 2377896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712658310, "uuid": "ea500815-4540-4d61-ad6d-7953e69e49a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658310, "uuid": "47091fc4-da52-4aed-ac7c-76d36e8bf7c5", "value": "SecuriteInfo.com.Trojan.GenericKD.72270643.10972.31445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc4d5c2-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692876, "uuid": "e70e7e70-668a-42b1-b337-747710d76f7a", "comment": "Malware payload (Adware.QQpass)", "value": "56904a456612c8593e8df6dc93df025d", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692876, "uuid": "40d3616d-5ffe-4203-9a2b-af471e16ff98", "comment": "Malware payload (Adware.QQpass)", "value": "760c15e7ff0ac2bd76f5f1de223a16aaaada083445ccae77339ab66f98e58bdf", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692876, "uuid": "4a730cf8-b9fd-4f86-8a01-7ca7f9265819", "comment": "Malware payload (Adware.QQpass)", "value": "e75973d93f2a1a01ba51f9099fd1778405d9e29c", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692876, "uuid": "07033abb-2af9-4120-b1b7-3b77feaf2e85", "comment": "Malware payload (Adware.QQpass)", "value": "d5e8d695372251eb007dd65fca077ee0ca812aa7d237d8bb380e48b7a0f5a74dfe4a5ff5c75f35c3c9918ac33d6f9915", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692876, "uuid": "171c9755-d174-4c88-9d81-309ea52cfb1c", "value": "T1A0A4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692876, "uuid": "8376fbc5-22a7-4d4e-ac99-fa22d5af7906", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692876, "uuid": "2976f56f-3a90-4d97-b44b-d32af4091e5e", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubJ:sZ++qlRBBOxQDU2XWIg6BiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692876, "uuid": "641596ae-eefe-48e1-ada4-f43b9a892c35", "value": 458369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692876, "uuid": "512d2c6c-748d-49b6-9ff1-4b060cffc6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692876, "uuid": "712a7a80-7935-4929-a965-a0b7997fb6c3", "value": "760c15e7ff0ac2bd76f5f1de223a16aaaada083445ccae77339ab66f98e58bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47827b05-f6c8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712705054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705054, "uuid": "d8fbcdf4-d3a2-47fc-b04e-e99ef261c3c0", "comment": "Malware payload", "value": "3acc209d7d412178d3a71c8a728eecfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705054, "uuid": "430c4b46-ebb6-4f60-9d64-2c20be294cfc", "comment": "Malware payload", "value": "761419edb99fbf2ff490f4bd0c797aeb390290b0c16537e116fb9827244db900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705054, "uuid": "319a12ea-63a1-4ed0-91fe-9b345eb1a3c6", "comment": "Malware payload", "value": "921403925ca535df26bee9c2e24325da21909965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705054, "uuid": "7ddd3960-b0d9-43da-b669-17262dd7ec62", "comment": "Malware payload", "value": "64d0ca946f1dbf25d5d51597823393373bfb3f63a7d82893592447d30a41e6dc5cf90441b0f2563d37d86d8556b0c54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705054, "uuid": "3c18ee2a-88c5-438a-a643-ac5cff3493d5", "value": "T150664B11FED781F6E5031471459A626F33306E028B25CADBEE847A29FE3B6D20D37256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705054, "uuid": "6ef9bd8e-36e7-407f-89f8-b75b945693fe", "value": "f898e31b174c0cee17f10c17d8c3a9ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705054, "uuid": "a9c7c1b5-4a3d-495a-98d7-96bd8ec6d7a4", "value": "98304:pnOyd1XPtHzAcgONT2S8Qja/FYaC99feAFQikQn:hzRAcH92S8Qja/FYajDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712705054, "uuid": "89b993a0-7141-4030-b58e-ece61b48e255", "value": 7096320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712705054, "uuid": "77f8a64a-1178-4d82-af79-50a13b1b75e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705054, "uuid": "354c5996-b391-418c-99f9-916755f23c5a", "value": "SecuriteInfo.com.Win32.Malware-gen.15337.18245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f72888-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651843, "uuid": "b10a4421-f1c7-4e96-9a18-e132dd84abae", "comment": "Malware payload (Mirai)", "value": "6c367bd6c8fafaaaed78edda929ca393", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651843, "uuid": "e5434cde-2fce-44fd-bccb-3af6a700458f", "comment": "Malware payload (Mirai)", "value": "763cf66023cd31bb833ead33b314d04f87c56f3baf4877af5f02984ae62ee80a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651843, "uuid": "5c463cf3-22c1-4c8f-962d-df5e83a09ce4", "comment": "Malware payload (Mirai)", "value": "cb53a009bb83336ac581c70fa09600dd91d37dff", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651843, "uuid": "95e036e9-1c93-449e-b37f-cae91e34e036", "comment": "Malware payload (Mirai)", "value": "bb4364ba2637e82d91601a902751dd26a2d6382eba73cfa4cc3960609a032cc2ed8a26dd3079c7a6a2d54c8ee36b41cc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651843, "uuid": "8eaf4840-ca79-4da5-ae5b-fe548bf21f8a", "value": "T17C532817F59280FCC48AC1746B6EB63ADD2276FD136CB2A66BD4FB222D85D614E0CC44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651843, "uuid": "a4d476f5-3df7-4a88-8472-a2b68b95dd03", "value": "1536:croIZnbIaWM2Wv8x2QPDPTi2fPpWPUtBZjlaZIAOREcXnU3:aTFFWMLv8x2KDPTi2ZW0BZJpAOREcXn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651843, "uuid": "0fd5a4aa-e3df-4f79-86d2-6e62208ce000", "value": 63840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651843, "uuid": "38ba5267-89db-46bb-b298-73e85e643f0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651843, "uuid": "648da093-4b7f-425f-8f5d-4f17806a5441", "value": "6c367bd6c8fafaaaed78edda929ca393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b4a466-f68e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712680375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712680375, "uuid": "0293c836-4501-4b83-a037-7853b6902c79", "comment": "Malware payload (Mirai)", "value": "8f825258b6e8f842a5c0e0e4c3884849", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712680375, "uuid": "4f6845c6-a9d6-4844-9385-73b4c99d30f4", "comment": "Malware payload (Mirai)", "value": "76709a0f36f86628b370d79d6ae254039f4c84e33e8864b6221c6220a0fe7132", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712680375, "uuid": "5e0d392a-3ba9-43f5-ad3e-9fccc91d0838", "comment": "Malware payload (Mirai)", "value": "7d4cf5e5fbdcaf0da622bd4be171d62cc90817ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712680375, "uuid": "506038a4-dbfd-44bf-9a3f-d17f4b91c456", "comment": "Malware payload (Mirai)", "value": "8c59d26edb0b45d50e1db851d7ac25b4bbe79e29dad6dac338f7c76095f69ca2a4a8d77106d31412050be37e54a39869", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712680375, "uuid": "3642db0f-9b6d-44c4-8a5e-da710bef0ba4", "value": "T102044D46AA418B13C0D72B79BB9F425533339B64D7EB23069528AFF43F8679A0E73501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712680375, "uuid": "dd7b19ea-f978-4a80-8cf3-85cc30b93779", "value": "3072:L4DkQv+BaSx4D9AmA3VyaiilqXHHs/9aIhTRVUUD8JmHTse4M/9efCb:bBaNeFyaiilqXHH2IoRmUwJmHTsxM/9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712680375, "uuid": "7ff925fc-7008-42d5-814c-796301327796", "value": 181375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712680375, "uuid": "02dc5c41-c347-4365-a555-8c8a1eca0701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712680375, "uuid": "f85c2a9f-b7c3-4fbf-aad2-4500c1c7fdb4", "value": "8f825258b6e8f842a5c0e0e4c3884849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1ef330-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692878, "uuid": "72183f45-82ca-4e9f-bda3-611a69d1dd4b", "comment": "Malware payload", "value": "bc2eea5ac684355f091c248492c3d119", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692878, "uuid": "b146e45d-caff-477c-bd86-92ad6faa227a", "comment": "Malware payload", "value": "768ef14ef73e93012d852ecbef0b107ac82dae975cc6c22c1a8d805aaaa6e49e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692878, "uuid": "321f36f3-44b5-44d9-b7ec-e97eda84ed4b", "comment": "Malware payload", "value": "804b98973470dfff1fa689acdfc92054f542e4f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692878, "uuid": "6e98f47c-e7e1-4adc-97f5-d6bc0bdec5f0", "comment": "Malware payload", "value": "404b8161de95ad0b7a6e7b6811c1f29f1ec68b44884256e88bdbf6019f3425c9e7e61bd84e8520aec1b1834e22dc20ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692878, "uuid": "8202e70d-d0e7-4e68-adc4-a01d5e01bce7", "value": "T16EA4A60376219491E1595BFBA2AB433879F8976438F1CD23AFE4DD71ACB1121871EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692878, "uuid": "9356453d-031c-4a67-b0ff-52bdc0f69a78", "value": "391b34fdb03bbbe961a380d74dcff2da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692878, "uuid": "f3e04962-640b-4e38-96de-a34ad5f3126a", "value": "6144:uvbuWQu/cuaS2l8iE0B55FrJJJekPdi/2bAge+HO:uvqWQub2lrE0B55FpekPdi/2kCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692878, "uuid": "77fa7535-3243-4f17-bc1e-39be0be31c2a", "value": 469766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692878, "uuid": "467dd640-6046-491c-aa9a-1b2b274aca93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692878, "uuid": "183d5115-e48a-4458-82aa-97f3ff83a2cc", "value": "768ef14ef73e93012d852ecbef0b107ac82dae975cc6c22c1a8d805aaaa6e49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef29fded-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692880, "uuid": "0f9094c0-cdb5-4d5b-a837-7e3a7620ee2e", "comment": "Malware payload", "value": "887f1e593611440fd92706cede020da7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692880, "uuid": "fbca116f-0c9b-4aec-a567-80cf1c870550", "comment": "Malware payload", "value": "76bd6b875ed2389a331f1ab31495c2e818c519dd0ce3199e8f09541972b56d16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692880, "uuid": "fd0d5096-5a85-4fd9-84ab-fbaabcdd48d2", "comment": "Malware payload", "value": "a448141a1683669b35b4ef304590c6abf405407f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692880, "uuid": "fb043f18-59cb-4d51-841f-2bd02dad7849", "comment": "Malware payload", "value": "08a72cf70ebb91ba60c8d1ccdff5c313e5e37085592fa9a9666b8bcb9a678c19ffb71b2630b00ed1f8d6052daf7e703b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692880, "uuid": "075bd568-01ca-4fb8-b5b7-b26bcf4c49b6", "value": "T1CBA4A60376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692880, "uuid": "b0217003-d46d-48dc-91f6-2620c0f5c9c0", "value": "6144:FvbuWQu/cuaS2l8iE0B55FrJJJekPdg/2yAge:FvqWQub2lrE0B55FpekPdg/2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692880, "uuid": "0bb59cd9-b879-4ca5-a6a8-49a09cc08b7d", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692880, "uuid": "3d9593ff-4540-4e54-a226-abcb1a97037e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692880, "uuid": "04edce1d-86e6-4624-afcb-b067df45714f", "value": "76bd6b875ed2389a331f1ab31495c2e818c519dd0ce3199e8f09541972b56d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84f665d-f681-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712674723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674723, "uuid": "30217821-46e1-448d-ae23-4875759c325d", "comment": "Malware payload", "value": "28e436f7e615a392d6054e4e4104aa1e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674723, "uuid": "508124c7-31be-491f-940c-e273cdb1e0ad", "comment": "Malware payload", "value": "77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674723, "uuid": "af1d25b1-6308-4d7b-aedc-cb433cf2f9f1", "comment": "Malware payload", "value": "be64172de97bb590bbfdfe11b2c8f9c51306842c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674723, "uuid": "f3a88e35-5279-42c6-92ff-00aaf8721b79", "comment": "Malware payload", "value": "2aca05d159d88778b50bc14d285c33ca5df28a88e2aa6fd4f69c2cbab940c4c6a7bf124f2541a22b999a3c08258d2f39", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674723, "uuid": "0efc2675-1525-42b3-bcdc-b969b153d3ea", "value": "T17F43E108E79ECCE1C651A575044F57B83639A2D4CAC0FF4A8A39FCB54BC23A51EAB5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674723, "uuid": "8b3c2379-faa3-40cb-9d7d-8626d06ede2c", "value": "768:ZFnM1dDlT2qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD15ogXnlq5bj:/mZ2u4OPKIxoEuDKJnlij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674723, "uuid": "a8bce995-2009-4d77-bd98-61d3df4a023c", "value": 58228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674723, "uuid": "1bc7df83-06df-48b9-9a2a-94372366ad62", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674723, "uuid": "5271905a-20d3-4ac1-b27b-10414409d90e", "value": "statapril2024-2420.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01c2334-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692882, "uuid": "4e8c5c53-5d10-41fa-9f8b-ca933461aa2d", "comment": "Malware payload (Adware.QQpass)", "value": "bec7c9faf5bb63cdc51302fe0ea5e002", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692882, "uuid": "c37275e3-bc61-44b1-a6bf-afb8973ba952", "comment": "Malware payload (Adware.QQpass)", "value": "786a239ae39c35117b5388ec4d7705898c5d1f3192c237f68be8db6f332b1a22", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692882, "uuid": "948cee75-65a2-460a-ad52-43dece33f7bf", "comment": "Malware payload (Adware.QQpass)", "value": "715d1d2cf44a04d8522bf6eef3721df1c26eafe3", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692882, "uuid": "00d117f6-1c46-4f5c-806d-bb8dc35aff60", "comment": "Malware payload (Adware.QQpass)", "value": "95497b71e21fa15062de54f83e3adfe5b4e4f60ce52fcf4ce5d3a4c0097daa57b8f3c9f803934af90c1ae60053b810a0", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692882, "uuid": "0f2b7d45-6827-48f4-92b7-963f4e832873", "value": "T11484960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692882, "uuid": "fd7e3731-785e-42cf-b2ee-2b30304a927d", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692882, "uuid": "2d7ebb10-1de8-438f-bbd1-0ab773685dcd", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22l:7vqWQub2lrE0B55FpekPdb/22l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692882, "uuid": "7a734262-3c57-474f-a8c3-30077c93b6e8", "value": 406204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692882, "uuid": "e81a6e30-bcdd-427a-9d31-2e6288fa035b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692882, "uuid": "ac78702f-8424-44e5-aec4-9fba042687de", "value": "786a239ae39c35117b5388ec4d7705898c5d1f3192c237f68be8db6f332b1a22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11a24f7-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692883, "uuid": "a17e818c-b4e4-406f-933e-23b20e8a36a5", "comment": "Malware payload (Blackmoon)", "value": "218b978b098a2c935dd831982e35a89b", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692883, "uuid": "961d08ad-5a8e-4b4d-9c51-2ed69dbf844e", "comment": "Malware payload (Blackmoon)", "value": "78f70c15a9899517feb5af49363ad78e17c89c162ef56e808c09fb2021ad0c72", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692883, "uuid": "1ba48804-e2aa-4086-9244-ee568764197a", "comment": "Malware payload (Blackmoon)", "value": "f4d155f03239d35ca4a3606926704fbb3ed2c952", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692883, "uuid": "0ae1584e-f2de-4616-8461-549835509113", "comment": "Malware payload (Blackmoon)", "value": "840f8bb3bfd8a9ca5e8d294812419df0ea2f1b5c98581288fcc1dfa5ff4e73abbad588c15d53fdbb88ba97afd8149ea7", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692883, "uuid": "b267656f-7a0e-4c08-a37f-dedcc948dcd9", "value": "T1B2B4C813B522E495E11457F66BFA073869B8836438B1CD13EFE4CDB2BDB15318B1A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692883, "uuid": "875b4282-2626-44bc-aedd-dc5aa83e1cad", "value": "6144:qwGdR+Yk/N8duBmG6t+UnRsRCQ/OJ//Yr7VC:qwoR+Y4NSG6oUnRsdOJ/Ar7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692883, "uuid": "e555d9bb-26ba-411a-9f83-24dd86148b28", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692883, "uuid": "4ca07d6e-5b67-49a2-babf-5c05e4c9cea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692883, "uuid": "65132805-90b9-4f14-9c48-5d298c2d6e8c", "value": "78f70c15a9899517feb5af49363ad78e17c89c162ef56e808c09fb2021ad0c72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797cf221-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678509, "uuid": "a3bd2560-5a27-45de-ad8c-0450d15c8100", "comment": "Malware payload (Mirai)", "value": "3be54179d82a62afe413f60c25e002c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678509, "uuid": "2ecc616a-96f2-47bd-b4ce-60579b221e79", "comment": "Malware payload (Mirai)", "value": "7949110bf277ffffbf7ee9bf6fdfba96e67d92220342169d2fd429fc5382d79f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678509, "uuid": "e412a953-d307-4c73-817e-57fb5821501c", "comment": "Malware payload (Mirai)", "value": "cf04c43f4f1795c1fdf866ae6ca9bf06767f1ab9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678509, "uuid": "9fdc6aed-4e77-4ec4-a3c7-92fcc59bbef2", "comment": "Malware payload (Mirai)", "value": "2e2efd28eb77a954ef767b7e4684d10d8681e64a6eaeb31b2118add386536bf55acd2338fc61566957c0170b353f2974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678509, "uuid": "66dd549c-2a00-49c6-b648-86aa4e71c065", "value": "T1B9333DF9F4225D2DF8CFE9BF5C214A08ED61274162830B1A57ABFC935C331649E12E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678509, "uuid": "df21b675-b1d6-431c-8971-4ade5d5eab48", "value": "768:zGexHkpJEoft9dg7WooIcl+lQc88X4rBfWRksiqB:qppyoftg7WooIDL88X+fWR3i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678509, "uuid": "b56c71a3-7ee8-4330-aa06-d1dabac1fc48", "value": 52156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678509, "uuid": "b5047f87-7304-45cd-bf4e-4e44df5133e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678509, "uuid": "a976f53e-d5bb-473c-8d02-584b4076bfd8", "value": "3be54179d82a62afe413f60c25e002c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1db36b5-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692885, "uuid": "ca5b7367-bd5f-4e0c-a1db-7bd5fccf5781", "comment": "Malware payload (Blackmoon)", "value": "c6cb6978d303233cb926fecbf45cd871", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692885, "uuid": "61a7a065-dfd2-4684-a251-8f112184c0ce", "comment": "Malware payload (Blackmoon)", "value": "799450317fb49e67281f9996cca2d5b40184a982f42ea9b19955a80a32bd2dff", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692885, "uuid": "e5eee0a3-9e73-4543-9b24-c092474a6c0e", "comment": "Malware payload (Blackmoon)", "value": "e858c41c438ee7cf9c0cb820d9ed722ef4cf6c59", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692885, "uuid": "12c15d0e-ce61-470e-8e1a-659133b57dd4", "comment": "Malware payload (Blackmoon)", "value": "3be13c5453edf98b83a1e2f2ac55caddac6323b6156d4352f1049e9e5b6cb661541180c53df20d72afd137e6126329fc", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692885, "uuid": "0c8355b6-2137-4863-a143-8d3f8009ff28", "value": "T12623AE03ADD148F1E825167639FA077DFF3881816D31865BCBB1DEB02D73225761A58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692885, "uuid": "0c0d3179-63fe-4db9-9682-351360a781da", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692885, "uuid": "82a77af6-31c7-4570-9746-9dd803124b85", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+e0:w0hAW1iqdWNzI5Pd4CSyDt+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692885, "uuid": "14f97770-4627-4fb6-a2b4-09513cb9cb88", "value": 49697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692885, "uuid": "ecf6dff5-276e-4b50-a842-e11e3f2c4599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692885, "uuid": "a94ad513-a975-476c-8479-e873f7c6b092", "value": "799450317fb49e67281f9996cca2d5b40184a982f42ea9b19955a80a32bd2dff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a983df8-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712674109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674109, "uuid": "a92c16ef-6836-4d59-a3b7-7f33623194eb", "comment": "Malware payload (Formbook)", "value": "54c771f587b2c6a96ea18cefcb2055fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674109, "uuid": "446af1b9-1eb0-4c7e-80c5-7ea510ef11da", "comment": "Malware payload (Formbook)", "value": "7a20c60af930a16bf38bcb27f7c02306235964d700392b96a52dd678a6977547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674109, "uuid": "151cba0a-5807-4de5-bc55-0871d78bd18d", "comment": "Malware payload (Formbook)", "value": "d608d942af88eea512edd088d749c466124b5bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674109, "uuid": "3db078ca-dc3e-45f6-9e80-04503c67019e", "comment": "Malware payload (Formbook)", "value": "8985044cf6fabac66c304176b194d96330aa28b9f6b3b4f684128fe1d2c3213a831b46bd87ce4ae9ff493f96efd894c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674109, "uuid": "b053c50c-bea4-44f5-82bc-0a9bf0d0ed12", "value": "T15C257ED1F150899AE86B46F1BD2BA43024E37E9D54A4810C5A9E7B5B76F3342309FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674109, "uuid": "15251c0e-48d8-486c-8a91-4eb43a89d9de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674109, "uuid": "d71bce8e-db6f-435e-8d26-ef508e6d9aa2", "value": "12288:QJ4B1oVeonPCnGYNhOVER4WfHcpOIGod7uN/gFEU1tcibfD5FA7vB8v68QCkR:QJ6o5PAFOVEyAWOE7uN/wtFP5FOkL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674109, "uuid": "ccf2db3f-2b95-4351-bc98-8cd0c339e3b5", "value": 1015816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674109, "uuid": "66b56abd-4832-480b-a181-9f1ca76a357d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674109, "uuid": "b5ee0cea-10ae-4585-affc-e2d3aefae54e", "value": "POVNL-OMAN-2024-8-4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2abcaa-f682-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712674997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674997, "uuid": "c2e5d930-98f9-4797-bd29-4f6ca14447ca", "comment": "Malware payload", "value": "8028ede3060f1db646c5b3f879267326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674997, "uuid": "3c047d7d-0cc4-4d49-acbc-5276ffb4b286", "comment": "Malware payload", "value": "7aed5aa8758938c17c370fed0cd384a8d4abbfabbaec3d9ea828b4c9a2663019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674997, "uuid": "4d97658c-beea-48df-a544-ce93ac67e005", "comment": "Malware payload", "value": "83f2f7712333bdfc56666f2abb83ca32312b7237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674997, "uuid": "d2abd5ab-1a12-4933-80db-4fd3d38697d1", "comment": "Malware payload", "value": "3fc794671ea6d1ec0b23d0ebcacd8b7c4b7c43334b7c7ff3c991369d9ac4c6d742534968dc02b7e13b51be051620aacf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674997, "uuid": "40a270b3-c83f-451e-bc3b-de338388764a", "value": "T111664BC1B990C24AD6296A71DFE9EFC8D3277E315CC4668BE9C4F73E0CB214944B95A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674997, "uuid": "da1bb4d2-9602-4660-ac8b-5e008df30fbf", "value": "49152:giUEiZADWRNeFGhtH1bIGVwXQyVgiP8bZkJrUVbU8RtpEo77cj64/Q1MSD9rj:giUEiZA4NeUBy5kbZkJrSUQQo77+1mZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674997, "uuid": "b7c8043d-bb82-4414-9031-cd3b8542331a", "value": 7050209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674997, "uuid": "8acbb655-983b-46f4-bfb3-94c1f002d002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674997, "uuid": "5968c00b-816f-4d74-9ae0-e6607eabd627", "value": "8028ede3060f1db646c5b3f879267326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29a31cc-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692886, "uuid": "3f2eeb99-6a79-4dfd-b310-4bce63f80fe1", "comment": "Malware payload", "value": "4a6e469940e6a5f0ac325863349a172f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692886, "uuid": "a6ee2b5a-bab4-4bb7-9213-9f18aa7e5524", "comment": "Malware payload", "value": "7baae99901713088f2a9bb395b5065d930aa752aef9b13525546f0a176ab1a75", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692886, "uuid": "2cfcb323-510e-4be8-bab5-8c49f0618565", "comment": "Malware payload", "value": "068d0be9502580fd8f67542b0eaa25b949b8a465", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692886, "uuid": "c6a11cca-93c1-4677-a37f-644b7eaa8b2c", "comment": "Malware payload", "value": "a66b6a49990f9d27d2980103959396bfbd145cdc4ad689a9a064849e0feff50f9432d27e432e06ff9ff1bd466fbbeb2d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692886, "uuid": "489638ad-3173-4380-aebb-04861b90f39f", "value": "T1ED23AE03ADD248F1E825427639FA077DFF3881816D31865BCBB1DEB12D73229762658E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692886, "uuid": "df15ad7a-273e-4b96-b01d-96148dc4f8f0", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692886, "uuid": "d76d4dff-51ac-497e-877f-92b4716c75cc", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+X5O:w0hAW1iqdWNzI5Pd4CSyDt+XA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692886, "uuid": "0e0c4644-7427-40de-a761-8dd510905e07", "value": 49738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692886, "uuid": "44113891-8a93-4be6-93e8-f32938d9d037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692886, "uuid": "04d2d34d-e6e3-43d6-b83e-17539a52fc09", "value": "7baae99901713088f2a9bb395b5065d930aa752aef9b13525546f0a176ab1a75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38315c7-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692888, "uuid": "02d3ae28-4c7e-4ac6-ae4c-c05bbec710ab", "comment": "Malware payload (Blackmoon)", "value": "4e41e5c0337518e0af73d40dcac7fe28", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692888, "uuid": "99c60d20-f196-459c-9b05-b1d989b6794c", "comment": "Malware payload (Blackmoon)", "value": "7bedb97f8d7696215bdaad9a743979047c71a798d737c4176af4c04f2bd1a5c8", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692888, "uuid": "de55af1a-70a7-438e-95b0-71bc9885fb9f", "comment": "Malware payload (Blackmoon)", "value": "2d0aac986459b1cfb11a3d80154053553bc43523", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692888, "uuid": "f99e0692-0c15-44f3-bc37-6f1fcc61c508", "comment": "Malware payload (Blackmoon)", "value": "f4170bfa2a75270d82cab45088c0a785bd510ad67e21a260dbf09150f1f157a66565b356b96b99e91855032d7fb2cff6", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692888, "uuid": "d0a40147-b85e-4bd1-a5ca-3fbe28850499", "value": "T17874950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692888, "uuid": "c4e91811-9724-4e2f-87f2-2f02eb548dd4", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692888, "uuid": "348e8645-cd5b-4b87-933f-fc9a58e0fe7f", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudeM:b5/Q58drihGiLhmGNiZsx0B/zkXoeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692888, "uuid": "91edd421-8dfb-4375-b526-82970bb089a2", "value": 346580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692888, "uuid": "1993e77d-b475-4ab0-baed-8c8ea39b2079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692888, "uuid": "eca221ab-f3dd-4637-9ea0-7acf252262f2", "value": "7bedb97f8d7696215bdaad9a743979047c71a798d737c4176af4c04f2bd1a5c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5debdb-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678437, "uuid": "927fe2fd-f096-46da-8ab5-a5a61b447962", "comment": "Malware payload (Mirai)", "value": "07ea39e96a48c395bc028b04bc1bf79b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678437, "uuid": "bd1bcece-aaa3-42f1-b330-a4f4c15435a1", "comment": "Malware payload (Mirai)", "value": "7c38349e66a6cc697a4b54fabb3251220e11ea648f5cc6737ad7995ac8c056b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678437, "uuid": "f0866621-e811-4d1c-ba12-6ec65f87467d", "comment": "Malware payload (Mirai)", "value": "bb326a38f87e2ef860e006088c8eb800e383fad3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678437, "uuid": "2d5be355-c1d6-43b8-8211-d5365b61013a", "comment": "Malware payload (Mirai)", "value": "fa25e227a52f493a8e6a0fdee129a1e3559ca43bcc436f4c9282a100cad7bf4341534b11bb3b88a68c6fae04b6b983a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678437, "uuid": "bc087bf5-7305-4912-83f4-766a58d83ca4", "value": "T13F730745BC819A16C5D423BAFA6E00CE3721A3E8E1DF32078D252F5077DA91F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678437, "uuid": "a1d1a11c-5053-459b-bb74-c22ae653dafb", "value": "1536:dnzkeTt7iKIIHkAkEN+AOOra7CHqRWhKMgqV4B69HH:dnzkeTkK2PQq8hvD4B69n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678437, "uuid": "d90e8723-67a5-4da6-a4bc-3dec66df331c", "value": 79204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678437, "uuid": "d2b3ec3d-0727-47ee-b26e-f20294fde6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678437, "uuid": "8a002cad-2f56-426e-b3f6-66e0d2e29f91", "value": "07ea39e96a48c395bc028b04bc1bf79b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119828b9-f662-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712661155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661155, "uuid": "825328f1-1b08-4eed-a9af-cd323e77f14c", "comment": "Malware payload (Formbook)", "value": "5c82e045f10a3dda865b4670484e59f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661155, "uuid": "ad9b2de3-6be6-46b6-9831-14a2f05d8b5e", "comment": "Malware payload (Formbook)", "value": "7d935526979defff85b919891f551e05cd6bdb2e0d5b5f00ffd5d41a15eb34db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661155, "uuid": "70609bab-f95f-4f40-b8a1-e44bcb0f6304", "comment": "Malware payload (Formbook)", "value": "8f6f18dceaafa4f14e2b2630b4413beef6c75815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661155, "uuid": "97fd3f32-1a30-4e7d-827c-87dbe8fd9cfa", "comment": "Malware payload (Formbook)", "value": "fb6d56d540a281be35a1934db4ea40c9a392fcaaa904b6eaa4aebf457ae09e8fe8d2334884a90bf2b5b39821ba798334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712661155, "uuid": "d62c8a1e-527b-41c0-8384-2def065bf8ff", "value": "T19FF423112344A641CFFE1631A5E064650FB0A6872F90EE0D5DBDB8DE1EB3390AB6D277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712661155, "uuid": "b984b0b6-de17-4128-8789-7d711dcc5237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712661155, "uuid": "4aeb2d19-79ec-40c1-9cd2-0ffa0f52a918", "value": "12288:p6yjyUZLco0MwXoPSHFJjVnSNZPqvD3TAGEU/UoFhurtpT2kR:zL+MwXUSXQNZPWD3E2UoPUnTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712661155, "uuid": "4cab7d72-80f4-4ece-bdcb-273ee1579942", "value": 743432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712661155, "uuid": "6138ebbf-2f1b-4b97-bf79-349603700b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712661155, "uuid": "197402b9-6c4a-4618-886e-bb899f00da42", "value": "0qeb8413hGkDVhh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93753614-f62a-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712637321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712637321, "uuid": "c74916ac-3a80-4f2c-8c66-4f797a677f21", "comment": "Malware payload (Socks5Systemz)", "value": "fe41fabf9b409eadae90acce6534b28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712637321, "uuid": "0078312e-9268-438c-a552-28183f03e414", "comment": "Malware payload (Socks5Systemz)", "value": "7e847076f8560068061420c672135ddcc99341b0ce5d80b5c98f234269d55b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712637321, "uuid": "5f5fb04b-5cf9-41a8-8294-6daed112d965", "comment": "Malware payload (Socks5Systemz)", "value": "0a7c4584463ca92af674c13c77eec6e36e6edce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712637321, "uuid": "31eb44e4-58c3-4ff6-bf7f-1e4bc2c443e8", "comment": "Malware payload (Socks5Systemz)", "value": "1a5cea18ebdf11f1c49defb2f98400b068d1459f973689f1e4c5d7a69a2d0d166d11fe1ce5ae3fb85cd3026c1c57a5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712637321, "uuid": "4fa07992-8f6e-483d-a621-319ca16c563e", "value": "T19D1633556BE214B8F523AFB1492E8D40792B7BA24938BF5F4A1C6B6CCE0FF351309215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712637321, "uuid": "7fed1fbb-b0ef-4ac5-a2ef-caf9a578757b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712637321, "uuid": "a235c505-c750-4a9c-a1fe-8cce5da9c1c0", "value": "98304:C3RZmPti/MAfokjLwxBiSdv4cCHKA6cUy5dCjwtoznS2QxX:mZmslNHPnqA6cFMKb2Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712637321, "uuid": "70905cc1-73d9-4a3b-9d56-af86080c13fd", "value": 4260114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712637321, "uuid": "22673ad4-619f-4706-9f4a-b8906c501a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712637321, "uuid": "7b710f11-76f0-441c-92e1-0e6dcf286799", "value": "fe41fabf9b409eadae90acce6534b28c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47f5e8a-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692889, "uuid": "265d179e-c322-4c5c-9e38-46e6219e7e3a", "comment": "Malware payload", "value": "f919e51c7d4883d7e5833664447c7928", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692889, "uuid": "69b6038d-f3be-4193-b5d3-16a461446f7a", "comment": "Malware payload", "value": "7efd62ff1b2b2eae158cf8e4e38ff92817a506dd4af7f1a107f54b525c693cfe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692889, "uuid": "dacf54df-ce08-4798-b11c-84f861b08e16", "comment": "Malware payload", "value": "34687990cd43e1a1769c2d0c59240ad112a9dc9e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692889, "uuid": "9ce2e172-e014-4416-8075-6c4abecb27f0", "comment": "Malware payload", "value": "557c8f20ceeb9d18bc84a4d8bdf129ee95f14a8ba961e707077ecf573772e3f5552299bffd57da09e2ce8b6080018ca9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692889, "uuid": "de19c38b-9ff7-403e-a824-724bbc14c885", "value": "T17EA4AE33EA4180F1E60656F626F56338FDB4C3835C164A93EBE8DE756D21A70BB27109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692889, "uuid": "f904c6ee-08a4-4fb6-a28b-461f5d96747e", "value": "c4cc56b23288e6ddcbc65e41dd25b3e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692889, "uuid": "a2f992b9-8c0e-43aa-ab58-ca9aa70784a1", "value": "6144:MXgEXaCpwaGa8JOAkvjW8Q1RwM1O37PvHSILWFa:MXgE9wPdJkvjW846/SlFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692889, "uuid": "f8554e4b-c844-441b-9243-178dfabf13d4", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692889, "uuid": "171d9619-8c54-4529-b532-6bcdd918cc8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692889, "uuid": "aad13ffb-3691-4079-818a-50a7f9844ee8", "value": "7efd62ff1b2b2eae158cf8e4e38ff92817a506dd4af7f1a107f54b525c693cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e858cd-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712694536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694536, "uuid": "681d8d07-8f4a-4fb0-9297-7adc96e0abf3", "comment": "Malware payload", "value": "7f8500b65287ca145f0d6e5593b4ee98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694536, "uuid": "02f8d2f0-b8db-4f5e-a82d-8c3af786907f", "comment": "Malware payload", "value": "7fe38024a881db710023cdfd6437d4b154f721dc5a13beddd6df321318bf9cc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694536, "uuid": "cb4e5fa1-fc48-426d-94e0-ec44e4bff66e", "comment": "Malware payload", "value": "7a96c2247e38260e3e7dcac2b3008d3cf6832c31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694536, "uuid": "4f61ed91-fa36-4423-9949-9037e4180181", "comment": "Malware payload", "value": "6e9eb446455423a39f7ba580e7045f5c83865e8e1df71a7c07666bbc32642ad9acedd4ca430aa0d812e2bc3d42dfbcf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694536, "uuid": "6420ad29-06f4-4ec3-bf86-70c213c10fce", "value": "T17FA319F394686ABEC0466A7025AB5D300F1E984BDB6F1E85212C57FC064F4C9FA4EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694536, "uuid": "d7bc2114-b5ec-483e-81b5-8abdc73508c3", "value": "1536:a4v+ZyBW52ZhW6eKNt2AJl9I8AuTlLzCF6hyukSsmcO0V2ZEoqf/C8:ak7BWihxRNFl9I6zGVfmB0V2Z7qf/C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694536, "uuid": "c527577a-819e-467d-b9d7-91697f2e05e7", "value": 102294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694536, "uuid": "56961e1c-8877-41d0-ae3e-883794e2580d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694536, "uuid": "21c5a6e2-b7c5-467a-a5e5-d66939c50e48", "value": "7f8500b65287ca145f0d6e5593b4ee98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e131655-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712671967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671967, "uuid": "1a61a3dd-58b0-439e-8616-f0c15ab5cc08", "comment": "Malware payload (Gafgyt)", "value": "5cdf761555cfcac36606bfa227c44ab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671967, "uuid": "6408c8ae-9cee-4ee0-ba53-b15284ef40c4", "comment": "Malware payload (Gafgyt)", "value": "7ffafdb7e5f3b7e52882a1a949541477464d16e8a70cb9a93311ebbdf165633a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671967, "uuid": "66a7b54a-d2bb-45ab-8833-24c0eae6e497", "comment": "Malware payload (Gafgyt)", "value": "da6c32024dbbc3cf7a0b70533382b2dd7f5746f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671967, "uuid": "527b675b-2a54-4cc5-a636-eb994dd9b846", "comment": "Malware payload (Gafgyt)", "value": "39ab79c26669b5f2f55ecfd617139ba03ab1a97a13223c99caaaed2257076f19438723db0dc72dd18b66a50b31d47ae9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671967, "uuid": "c1614e65-fed8-450a-866b-f2c8b5202991", "value": "T1E6832A41FD418727C2D337BAE7DF435D37356A54A7973301AA286EF42BC6BC91A2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671967, "uuid": "30150274-75b1-4f7f-814c-d43bc1923d35", "value": "1536:gIjDVhNQmvfzHfvfekyjGe66fxtOgyEePPxoNemR2qQzK/2AKtIe:BjvfyklP6fHePPxPmR2qQzKOAKtIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671967, "uuid": "35f8c74a-8603-4ba9-a442-8d98671e8cd6", "value": 88243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671967, "uuid": "18e92541-71a4-4f2d-82b5-e8659c08b323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671967, "uuid": "a94ddc0a-edc4-4407-be2c-05b4e7d23d2a", "value": "5cdf761555cfcac36606bfa227c44ab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f593ce73-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692891, "uuid": "7368b88f-3b26-4baf-89d7-164ce5aaa4ba", "comment": "Malware payload", "value": "d0a395e1540e4d157c223117442ee476", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692891, "uuid": "47bca5ca-3c9f-42da-b225-44898775a15c", "comment": "Malware payload", "value": "8096ab2207664b4699e48a7c1933d09456980fca88993bcde3356b0930dff9c6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692891, "uuid": "71257673-3182-4263-8c2a-ad72052e3cd4", "comment": "Malware payload", "value": "bd64ca3f41fc9802ebece9efd9d08e86742204ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692891, "uuid": "b25bc613-2d18-4c89-b658-6e589eae165a", "comment": "Malware payload", "value": "756c04656c5903fe0d044f03781c097abf6dbb0c68e1bc5439555753403f443650731e9aac91b609403fb1012be272b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692891, "uuid": "a043fe5a-0a89-4bba-9402-db2aa96e7848", "value": "T198B4D813B622A495E11457F66BFA073869B8832438B1CE13EFF0CDB2BD71571875A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692891, "uuid": "ea4ecf0b-2bc5-4f4e-ba08-d53d719e96f3", "value": "6144:PozXQKqfmiiyWwuiFOLeyOV0R7YRXxR6AC:PgXQKSLpOCtV0R8xR6AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692891, "uuid": "5ee21294-21d5-4198-bd07-c73aeaa030a9", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692891, "uuid": "b43a71dd-5d57-4e33-a131-5b22863ed8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692891, "uuid": "888e7b2e-12bb-4bbe-9af2-606a65e865eb", "value": "8096ab2207664b4699e48a7c1933d09456980fca88993bcde3356b0930dff9c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f9595d-f68c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712679493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679493, "uuid": "577c212b-9682-4eab-82e8-ce65a6cbd086", "comment": "Malware payload (Mirai)", "value": "39bf8f1fc0507e299ddb43944cdfdfaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679493, "uuid": "4d426550-3f03-439a-a868-1430308625c3", "comment": "Malware payload (Mirai)", "value": "80b084205d889b095afb8cd039f17d286e7a9b5bb4e80b277777bd4d7f19d788", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679493, "uuid": "78ce5918-dd92-4e98-bfd9-c4a6d7a1dd14", "comment": "Malware payload (Mirai)", "value": "998f5e8a2a1a02349146a234c32906c751cbf24d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679493, "uuid": "190f6c09-f604-4540-a99f-b8d97e4bbfef", "comment": "Malware payload (Mirai)", "value": "d71cd46d8eeed9180a274279aa38f448ea706c8c6fb369d6ea63603bf7520c48c8ae0d827d51aedf4426683098839996", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679493, "uuid": "702805c3-5de1-4df7-86c9-0b86bf9d0936", "value": "T17C2318C3654BE9FCEC164AB92272E3368F36B83F112CE957D389D6239C83A00D547199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679493, "uuid": "d635e8f1-ccc0-47c7-a0a9-cb2bf2d95db3", "value": "768:urVYfMiOGjzjpnhFUUnq+shf9xTCDlIfpu4sJ5W1b8qIx5rLsCjLLLLLLLLLLLLz:BfMiOGzVnhFfnq+qf9xTCDlIfRsJE1bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712679493, "uuid": "9e46d170-ca06-4cf5-b2cd-218af82d1314", "value": 48112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712679493, "uuid": "68db714b-e34a-43ed-94b6-27d20015a7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679493, "uuid": "8cce34d4-7fa3-4902-b302-14602b257b83", "value": "39bf8f1fc0507e299ddb43944cdfdfaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2025e1ae-f628-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712636269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636269, "uuid": "b43a7f4a-05ab-41de-af7e-b68582f0eadf", "comment": "Malware payload", "value": "a5cf12feb6f86d78b6007d5d91b24a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636269, "uuid": "95a668e0-a5e2-48d3-8d4e-7495fff25374", "comment": "Malware payload", "value": "81d1121c1898fd444f40cf2d3a6f58a054fc31118be3c6ce07534509b7c6a86e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636269, "uuid": "f8e23af5-f515-4ac8-a67f-4151e4e41928", "comment": "Malware payload", "value": "de4bf5a951d7ba473f24f11be915b78e5f25cb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636269, "uuid": "8719fe24-be09-4178-95fc-4674cd975efd", "comment": "Malware payload", "value": "c3ed58b740e962154193b8e819370d05277e8d7e20e7c4866ee52934c83cd3eda2a8b256310331fee61824dd250845bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636269, "uuid": "7a1df455-3177-4711-a902-5bb67ac83d17", "value": "T164459E307546C072EAD100B19B68EB7B892EE87D0F3644C7A3D45B7D1D20AC26B76B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636269, "uuid": "e6aefc95-6c25-4c59-b374-be2aa17b5b52", "value": "48a6bdee71f78d95d709149ca401eba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636269, "uuid": "f01464b7-91fa-4e31-9f85-c7384602a7ff", "value": "24576:GRE5rExeV29xhqGjlgggg8FAf6CmbqWO7Xj94e4e1w:GMoxvhqAgggg8q+qWOP2e47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712636269, "uuid": "8cc98c49-4b54-4b68-b872-b49583c7b6dd", "value": 1265856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712636269, "uuid": "98adea05-1b65-4afa-a94d-f696b7558c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636269, "uuid": "9e98fa45-5cd2-4301-8dd2-a52454f2a1b3", "value": "SecuriteInfo.com.Trojan.GenericKD.72085507.12317.8745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69244c3-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692893, "uuid": "f4140ed8-9840-44e0-960e-bfcd0a2e3088", "comment": "Malware payload (Blackmoon)", "value": "3f8fe7becee144517b8616d3e9299f66", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692893, "uuid": "7f03c3b5-a721-4487-8f14-b83e4af04ef8", "comment": "Malware payload (Blackmoon)", "value": "81ed693e67591f3f5ad962c027c90d5f844e1c25c1896632f1e95225370e2424", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692893, "uuid": "de16a2a2-271d-45b7-a830-8d6f635a37c8", "comment": "Malware payload (Blackmoon)", "value": "d8037384f5f4371356232dd271a4ff056aec7c00", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692893, "uuid": "906a91bd-18f5-4341-9d24-69d616523f45", "comment": "Malware payload (Blackmoon)", "value": "dc55b9f4f5b7ec350fe1161fc033d8cc7cb03e5e558709b5b9d18f82d84902dfeaa7ac3327c3b18180970a3650e70b4d", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692893, "uuid": "dc6268f9-3bb4-4e08-977c-a3b5ed67117b", "value": "T1E574950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692893, "uuid": "9f16c5a3-2895-43af-a9ff-ce814e5660d3", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692893, "uuid": "1f8be15f-4bc9-4e06-96b6-d21a90d7cb1c", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudeY:b5/Q58drihGiLhmGNiZsx0B/zkXoeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692893, "uuid": "226b4545-b5a5-466f-8352-56500815dcfe", "value": 346604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692893, "uuid": "818753c9-6f74-4236-b6a7-e6abebace47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692893, "uuid": "0d6080c8-166a-4595-ba24-6e867d3b2c30", "value": "81ed693e67591f3f5ad962c027c90d5f844e1c25c1896632f1e95225370e2424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d66f62-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651814, "uuid": "d397bcf1-0349-4a01-a6a9-2b978952f762", "comment": "Malware payload (Mirai)", "value": "69e399e085468e0efaa4fa9a98239ac2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651814, "uuid": "1f2a795b-4ac5-4bfd-a02e-32288fba5a91", "comment": "Malware payload (Mirai)", "value": "81ee7b8ad53ae0623adde64c11366247c5a10e14c73e9fc43a7a6ec1b4cae055", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651814, "uuid": "230c2e6f-7db9-4b81-a039-0e9dfd5cc8fc", "comment": "Malware payload (Mirai)", "value": "a29d3dd871ce1e0e5bcf74d12898168a929029dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651814, "uuid": "d7d7f9db-866d-48d9-8783-37f566803a66", "comment": "Malware payload (Mirai)", "value": "890bec3ab424251d56595699d8612421c399f9f288cfd48da5776dca38add2b4582899fe4bf2b60563a825ba95a9c6b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651814, "uuid": "2047d90d-942e-4ae7-9cc7-2db530ab0772", "value": "T19C634B21FA760D17C0D5A87A21F74B25F6F543CA26E8CA1A3DB10E8EBF256406543EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651814, "uuid": "5d4e2334-200e-43ed-81e5-1e57f7a3551f", "value": "768:C8soX5gZTgPT4yJH1eLMlOzuhEju8+55IO+lk5VPe4gDvje1tUw2uI4:C8sogmMe1Fk+8AQlk5dtl2uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651814, "uuid": "4305d262-bb03-4c71-8f0b-27d35f19add7", "value": 67192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651814, "uuid": "94fd3be3-24b7-4882-a2da-d99c8ded97c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651814, "uuid": "2aa7b0ac-6f98-482e-960d-a75b953ad446", "value": "69e399e085468e0efaa4fa9a98239ac2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bdb8bf-f66f-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712667115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667115, "uuid": "2c196b52-4494-4616-ac38-935a3b7696f1", "comment": "Malware payload (Rhadamanthys)", "value": "d9a13bb5645fe754cdc2a10a638660f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667115, "uuid": "c55b3018-e104-4fea-aa16-68e5ae810d6d", "comment": "Malware payload (Rhadamanthys)", "value": "82a6847b83bf25cb582bb942735a32197bd9b7b490ce50f34c4976005f4f9bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667115, "uuid": "2283ef7f-1b40-4bc0-9df8-983d61c447a8", "comment": "Malware payload (Rhadamanthys)", "value": "9922a24b92892f920430ae204954dc6e6e1758ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667115, "uuid": "6d357b43-f1ff-4e71-8eb6-f8f1bf17f277", "comment": "Malware payload (Rhadamanthys)", "value": "4d3d92d988d521ab1bee5fcca06bd69aa0ccea10a62aa32829c6ccea6d02e7b4371a48543ba0033ac9adf7b0f07921e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667115, "uuid": "98b749cb-daed-4db8-af09-0f48dba7843a", "value": "T1ADA46B62BBF59D88CD5D33F3C8506BE5065A433642F3E3885D286A52673F6698B0B13C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667115, "uuid": "26078585-3022-4bb1-a8e5-0e9425c8868c", "value": "1691b1f290a2ca836b091bdcee4ba1dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667115, "uuid": "f86f0546-980a-4bea-a53d-a9940dcd5d57", "value": "12288:/rrb2iDiSOv4VBHMQhPymqTCYw4oUGbjnm:/7DB/Dym1YANPnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712667115, "uuid": "b5828083-751e-4fa1-8a7c-232d7c6c4a20", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712667115, "uuid": "63afa39b-3844-462b-b20a-f8b74025fea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667115, "uuid": "ec619173-5dac-46a5-8294-8bfa101a7317", "value": "d9a13bb5645fe754cdc2a10a638660f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da04183b-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712694563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694563, "uuid": "c745d2cd-80d3-4ea1-81f1-83c2f7388568", "comment": "Malware payload", "value": "cca4a70dc23663da77f39675e8f49443", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694563, "uuid": "a447e7b7-614a-4c7d-bc13-20d19e6585c0", "comment": "Malware payload", "value": "836021a1a9a61f06051f838d6ab5df1bff28eebeb364c9399b20fdb9e17dc753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694563, "uuid": "94493b9a-2e52-4755-a592-03abf8273cd2", "comment": "Malware payload", "value": "d413b2c3ee3f70b631ed25ed7cbe4b89d33a4b08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694563, "uuid": "2c4fa65d-81b5-4f07-8141-775044d3507b", "comment": "Malware payload", "value": "4d37e52bc1e25a9f72998e18afc1d147894f5fa6028693f0b2487809b17111cd93c6b8b61ae5a60a373ee2d85778aaaa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694563, "uuid": "b8affe5e-f318-493b-b257-f074e660e253", "value": "T137A33AF7631D374BC48745F018AB2FF08F5CA5A792B21A80620DEB98077A9B0B791F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694563, "uuid": "5195332e-4ab0-4909-97de-eb6821ffb7d4", "value": "1536:1QqLZxdfYg11ENBUQ8Wango0a8NFc3j13BWZazOo7lIEmJOxV2D0swUf/3Q:1hdEgYKxwc3x3sY7uEmsxV2D0fUf/3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694563, "uuid": "38d7fa2a-9645-4401-b8c2-494040ee414c", "value": 106932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694563, "uuid": "402a6418-051f-40b6-909d-820b130091dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694563, "uuid": "aa1e46e2-32c2-4a6d-b38f-2581d3210768", "value": "cca4a70dc23663da77f39675e8f49443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db826e2-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712674114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674114, "uuid": "82cb5941-782f-4080-bfa7-5f3cce966f52", "comment": "Malware payload (AgentTesla)", "value": "d82368142afd0cda0cad0b069c9d9646", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674114, "uuid": "c5e13b47-1955-4558-b46f-4c6801993f83", "comment": "Malware payload (AgentTesla)", "value": "85905439f087889b1d0328dfca56bc1f0404f6c3be6fbceeab6253c774825ff3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674114, "uuid": "e270092a-1cd3-47d3-94bc-30fa1bbd3b2a", "comment": "Malware payload (AgentTesla)", "value": "6d96cbececbb3eb640a92eb043469f5a66cb65ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674114, "uuid": "b9fe0cc8-255f-4e7b-8dfb-189e3a5bdc9b", "comment": "Malware payload (AgentTesla)", "value": "e161a5a464475a1939aaa463c1c79e76864d933b52ac37f89eec099605a0b3900d9656707bd139086c924a7c5630abcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674114, "uuid": "411800d6-1e23-41e0-aedb-27d898c72656", "value": "T156E4236834329247810B2D9F083F1F16DC27EC86EF6CEAE691FF687110A95947A35B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674114, "uuid": "902dc8df-ca1f-451c-8ee1-7fbc03a23275", "value": "12288:ZYT0XyRuwfmXNCzECGer2oUZjj3IjZFqFm9MhLfuFrr:2QXYu1XNCzied6/3Ijcm9Mhcrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674114, "uuid": "c1fb7446-3004-44d9-b79b-a6597ccadef1", "value": 672078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674114, "uuid": "4dc8b70a-b621-4f09-a118-4073727814e6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674114, "uuid": "4106f2e3-ac5e-42e1-9115-cdeb83af4253", "value": "Quotation PDF_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fea860-f6ca-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712705936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705936, "uuid": "da22e1d2-b917-4d97-bd7a-f4811aeb8f8e", "comment": "Malware payload", "value": "21dec26ec9a1ba74b3983cac37c72056", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705936, "uuid": "4746d780-9875-4251-b69f-8d5c42eb9727", "comment": "Malware payload", "value": "859e679f8e8be4a4c895139fb7fb1b177627bbe712e1ed4c316ec85008426db8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705936, "uuid": "fa46fcc9-0d8c-47bf-8593-08e0647aa0b7", "comment": "Malware payload", "value": "087e00bfbfeb03a108f95c62750c8273bbc87c25", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712705936, "uuid": "3197a003-59ff-4c4c-9caa-1b6948edd700", "comment": "Malware payload", "value": "642956c84307cd68c279885e97240a9086495426ecbd27b8021e9cbee30e74414e6fcd9062dd92642dde2d1565d0021e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705936, "uuid": "e5a5040b-b165-48f6-9bec-2781cd3a3d99", "value": "T1A8F35B06B5C198FEC8D9C1704FAEF136D972F42D5238B16F27D4AB622E4EE205B6D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705936, "uuid": "47bcc280-613b-4b73-88cb-402081719a2a", "value": "3072:R3dC21J/8C/E4F4Jwhista1EYUFDdrMw02mWru6+F43HfD3VUdn:RtCy/88zG4rp0C3HfD3VAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712705936, "uuid": "63e9e39f-e012-4f75-a8cd-a2594e02ab62", "value": 163944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712705936, "uuid": "904bcabb-3146-4639-ae71-4bf3aa3f85f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712705936, "uuid": "1954c263-5e79-48f8-a135-688cef7457a3", "value": "21dec26ec9a1ba74b3983cac37c72056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7904964-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692894, "uuid": "10d92d29-bb8f-4185-9cac-b87a20bf0081", "comment": "Malware payload (Blackmoon)", "value": "440d0f05692d620fab1ca3e6c78712b5", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692894, "uuid": "37000f6d-5dd2-4d57-bf5b-9108a6abe45b", "comment": "Malware payload (Blackmoon)", "value": "873bc859b38d26cca01c389d96ac05dbad12c24d0225dfb5e8b8ce584c943a81", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692894, "uuid": "4bf28220-4781-4678-a2cc-545d04f21b81", "comment": "Malware payload (Blackmoon)", "value": "051bb5d16a094c07f8a79de33763f2930e06562a", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692894, "uuid": "77356249-5bc3-49b5-8bd9-a06281d91fc0", "comment": "Malware payload (Blackmoon)", "value": "040c2e5da6d15957506f5a6ac2ecea9d3403389496c9dc5cd8e7a37a56a1133da92fa5753b62ec82816f26e1f1386254", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692894, "uuid": "149103be-bc1d-4910-b54f-5546271f4190", "value": "T1E6B4C813B522E495E11457F66BFA073869B8836438B1CD13EFE4CDB2BDB15318B1A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692894, "uuid": "6d0154ab-c0f0-4d81-a7a9-717a0b740647", "value": "da4a387004bf1285d93edaa4d5233098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692894, "uuid": "f4543f8e-4fa8-4967-9055-f68b179db30d", "value": "6144:0wGdR+Yk/N8duBmG6t+UnRsRCQ/OJOr7sCYv:0woR+Y4NSG6oUnRsdOJOr7s3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692894, "uuid": "3d05b5c4-c406-4549-ab97-e1b168cc1c1f", "value": 531067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692894, "uuid": "ecd48afd-833d-406d-9d2f-5676f047c564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692894, "uuid": "c911de0b-b3b6-4195-9160-58e9114a5dfe", "value": "873bc859b38d26cca01c389d96ac05dbad12c24d0225dfb5e8b8ce584c943a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f888dddb-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692896, "uuid": "c383f302-c3eb-4870-8fbb-2334cb50bec6", "comment": "Malware payload (Adware.QQpass)", "value": "5c5677ef37ebe7122f8d4e75eb83f688", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692896, "uuid": "ad5858c2-f0b7-4eba-94e5-af4018791579", "comment": "Malware payload (Adware.QQpass)", "value": "88a5df474b906d1450e537408a03e92742fad2fae1d59f40d458b924bad2d660", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692896, "uuid": "7c2f362c-0d77-4949-a55c-13f358fc30fe", "comment": "Malware payload (Adware.QQpass)", "value": "f896d1c31151fd02d1829d5def7b0e343d2e4e75", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692896, "uuid": "a23697e6-ab40-4da8-8a26-6015ed25ea76", "comment": "Malware payload (Adware.QQpass)", "value": "2e2da4b9b166a4f180d390d56cf83615fcaec24b25628472180ce09fdd0cb0e1c4b6ec857d0653869123ee70a3ea5d06", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692896, "uuid": "2742d21f-7800-4f65-9f5a-bf256fd72e78", "value": "T1CF94E913B522A895E11457F66BBA473869BC832038B1CE13EFE4DDB1BD715318B4E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692896, "uuid": "5e422f0c-5fa6-44d0-ba48-869c48d4dadb", "value": "bab84fd0accd31d5fe97afc63a9ebcad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692896, "uuid": "3427126b-92dc-4727-acac-92c08dd5ac1c", "value": "6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAS:c4Fm3b7yOAHNar4mUf9lJ82scqAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692896, "uuid": "d4e15fb7-6211-4204-b249-57ec830e03ab", "value": 442587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692896, "uuid": "0a41a9e7-4d3d-4e3c-985b-5f22a2a62300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692896, "uuid": "3f8e99b8-81a9-45c5-a5e3-bb00a7c78f0d", "value": "88a5df474b906d1450e537408a03e92742fad2fae1d59f40d458b924bad2d660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e36eaec-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669525, "uuid": "6a104774-f481-4bff-bb90-440a8608f9f9", "comment": "Malware payload (Mirai)", "value": "0777c08b2d723cec5a924eab4126a84e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669525, "uuid": "22103923-1810-4f99-9975-7e2fcad56685", "comment": "Malware payload (Mirai)", "value": "897bbe209a5a19f7aa1e6cebd0ca618e8413fe2041c3b2af13fcaff1c6df634e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669525, "uuid": "1cfb3387-b4a2-4077-ae9f-a13442a633ea", "comment": "Malware payload (Mirai)", "value": "408d71f844fc2b93de09f6fc851024597bcccfd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669525, "uuid": "67e62d37-eef7-4dc8-a3ae-ade09974ef8e", "comment": "Malware payload (Mirai)", "value": "df26068c75cbeb2cda58309f7a7fbb76413831d32685cbd7fe1f72b3583521151c862071133f1445043b35b903435a00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669525, "uuid": "481b38c8-d638-49c8-92c6-6a8e4e5cafec", "value": "T13D533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D321659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669525, "uuid": "822cce0d-21ac-4b72-95c3-c44e6333ce43", "value": "768:me4gpsM204GEkRbjveXG/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozgyx:mo3EkRbDdoiz6IFn1X48B2SEzNfAuJAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669525, "uuid": "619a0213-acda-4211-b4b5-c4e57c2a291b", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669525, "uuid": "e72b786f-f991-4547-a04a-d5cc3b5f7c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669525, "uuid": "d20ab485-8a90-4a55-8b4e-b6714fc6c686", "value": "0777c08b2d723cec5a924eab4126a84e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab858f4-f6b7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712697731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697731, "uuid": "1a8000e2-0364-4d5e-b4b6-115f3c95272e", "comment": "Malware payload", "value": "5303dc07d70eee1781b56f5dab99d72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697731, "uuid": "9f027e05-d103-4b76-a3de-9c4128c19748", "comment": "Malware payload", "value": "8abbed0d042aa9c5d7fda0ab2fefc3a4523cd06f8db8e5b7935e8f79e4a1bc40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697731, "uuid": "17bf42f3-ad7b-4be7-8048-4fd2ec17542a", "comment": "Malware payload", "value": "16aeb33325960e850ce7f63519ed10c39d986cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697731, "uuid": "2fb0440a-e87a-45b4-a003-2e65da8fed7b", "comment": "Malware payload", "value": "7eacad2a0430b1a00a1d6367fa1afd95779f8d7a11b5693399708367d17996668195e80774c5916690e7d0e0d6a11a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697731, "uuid": "7a145e76-7426-49e4-928e-bd9a9bd1966c", "value": "T103D3D01177A0C467EAF64F714AB687EB1EB1F91028244F077BC0672E3DA2A91ED1D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697731, "uuid": "db5b7275-fca3-44f2-a453-9eccd23e22e0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697731, "uuid": "e42c9412-c2c4-45a3-a354-b7edd69d0742", "value": "3072:8n77v00hEoDEtau9ceALCNgegaH2tvhOEA1RJCir86SrSrw6Ia3x:8740ItmLrxs2t0EyL+Zah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712697731, "uuid": "772d86e8-1999-4f65-acc5-85f541247f32", "value": 138847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712697731, "uuid": "242fde94-1f34-4f63-a6d9-311f28e6852a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697731, "uuid": "dcfdfd2a-e8ce-4fe6-ae8d-9538c0595747", "value": "SecuriteInfo.com.decompression.bomb.10050.7069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc73cb00-f6bc-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712700204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700204, "uuid": "ce97c2ef-c61a-4968-ad7d-2264f7229aa6", "comment": "Malware payload (DCRat)", "value": "5871e8ec0525f7850cb608382a5f30b4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700204, "uuid": "ca3089bf-0b6f-4d8b-a2b5-037daa3f5038", "comment": "Malware payload (DCRat)", "value": "8aca56991f81e3d4ed9da29b87d8e7109a4017d9c35b44fd4d24885c3666bfef", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700204, "uuid": "541fdf65-55be-4ba5-bd7d-1849badcbdb5", "comment": "Malware payload (DCRat)", "value": "acef833944d86a6f0560519831a36be76514dbca", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712700204, "uuid": "b8f4defe-dfe9-4487-b13e-ae08e4487c8f", "comment": "Malware payload (DCRat)", "value": "ba7161f1409d5f476768508df34b382569889cb54a21ba2874fd66c060fa1b5f3549b19c79b2d0582e752ad34c92dcc9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700204, "uuid": "d53aec29-7e06-4526-a9c1-ffdadaf3c2b1", "value": "T157559D2A379C03D5E177E17D8ACA4B89EAB1B405432197CB05A046AD2F27BF44E7F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700204, "uuid": "bb171dab-b8f6-4107-8252-26cdadc52069", "value": "5be5c0729ba1156c48a7f08a7314848c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700204, "uuid": "76088669-1c2d-45d6-ab6f-3ab1aa0de4fd", "value": "12288:GsFxpE2JExvhVP3dUQJJp2tCKIPJuWRXNdMTNHWsSPtWKHEpr7MfJq+/l4U4UsUR:Gc2hJuCXPMhH/iGprAfJTJNXqfZb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712700204, "uuid": "8ceb0aa5-49df-4893-afb0-09334e588dad", "value": 1317864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712700204, "uuid": "ac8837d6-c850-48fa-8e73-311761115697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712700204, "uuid": "7468e4df-4c62-4cd1-8b14-d3aa4f585826", "value": "5871e8ec0525f7850cb608382a5f30b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8f5309-f681-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712674676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674676, "uuid": "0fa307e3-4150-4bd9-96c3-d26097b3abc9", "comment": "Malware payload (CoinMiner)", "value": "8b8b82d63e46e7ddca195bda023e400c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674676, "uuid": "79296374-3f27-4fc0-ad88-81446998136b", "comment": "Malware payload (CoinMiner)", "value": "8ae1881e4e5270aaed224157584949d4fbed8d0e27136aabc6268659bbbf6188", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674676, "uuid": "4368b7ad-d012-4144-b263-dde7f44732e0", "comment": "Malware payload (CoinMiner)", "value": "6b5fcb82a79238120a3cb27386d5eb71c51b9bb5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674676, "uuid": "2e879aa7-1421-4025-beaf-0e506a20ff52", "comment": "Malware payload (CoinMiner)", "value": "68bc9e25ec4e2479dcee66a29d8ebe559f81a1363514ab30b5645eaf8cf806e811a9ace526d0b4737eb3fdf066e5453e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674676, "uuid": "471685d5-a232-464e-8731-47253bb1364b", "value": "T131669D65BD1EE563E7C823706B7582D8323EBC489F819327AA14FB6E59F235C8F12111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674676, "uuid": "3ea4e6f2-88c1-4f48-9c9c-f7ad193a77af", "value": "98304:slzimQTiii4FSDPvZE3HP+i2iG8eyaHS+AvW73L:Fip4iPywiXtmDiWjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674676, "uuid": "143d5170-4609-4c2c-a88c-e2a343cda309", "value": 6555697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674676, "uuid": "8f266a89-9861-45fa-b53e-9f76e79a2594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674676, "uuid": "da00053e-c392-412e-a9c0-12a60dacdc6f", "value": "8b8b82d63e46e7ddca195bda023e400c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657ceea0-f66b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712665161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665161, "uuid": "c0216508-a058-4bec-b2e4-dd3ecf0f2b70", "comment": "Malware payload", "value": "4bee512b3b3aadfc609dd4298f7a830a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665161, "uuid": "81e097d1-6a1a-497c-b046-9e1ed9711ccf", "comment": "Malware payload", "value": "8bfed7467d8bca317afb6dfe26fad157cf8400ca7afb69277a6d20419c55c30e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665161, "uuid": "1ca21da2-f4ef-43cd-bd09-88ededf9e5eb", "comment": "Malware payload", "value": "735e53d6bf96579580cf091332f9dbb15640a11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665161, "uuid": "6714d184-278c-4e28-a757-8b9e5958940a", "comment": "Malware payload", "value": "739f32849c02603a263d475ace113dc98e24da9036a936112c3e22da5d0c931dfc594c8a0255c813537898a78408d001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665161, "uuid": "3440a4fb-012c-40d3-9c2f-d82f934160b2", "value": "T130737C15D78688F2EBD3417054BE67D3DA35B9272B04E9D3CBE02E86AC712D0A93D391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665161, "uuid": "92550eca-65a3-4298-aef0-7c036e54ded1", "value": "c552a31531df962b2298e689961d15c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665161, "uuid": "62aa2fe6-ab8b-4dff-9dca-eefa6cf18696", "value": "1536:ugRh6VPamHMiZ4Um6wjGv5ut4qDvEJW9BiJAKkCl:ug/4PaMZ4Hg5uHDvEJW9IAlCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712665161, "uuid": "2725776a-ab3f-4e71-be80-807ce4be8c1a", "value": 78703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712665161, "uuid": "ed9a2bf4-55ec-4a20-8095-3c08d58471f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665161, "uuid": "e737187d-65e6-4a2e-ace6-e1f10e1a1a19", "value": "8bfed7467d8bca317afb6dfe26fad157cf8400ca7afb69277a6d20419c55c30e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b1da0d-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712677990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677990, "uuid": "a5fd2c97-152b-4bcb-8645-49b2a1efe3de", "comment": "Malware payload (Mirai)", "value": "41341571519bfbea4a85599736ac067e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677990, "uuid": "c5be6943-db02-4029-86b2-ea187624c73d", "comment": "Malware payload (Mirai)", "value": "8c1372b43f4fd33079afb19a610e3d885bea87d8b52b3df8d937ff3022266e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677990, "uuid": "b7c84955-7452-44a6-931c-33f26534f565", "comment": "Malware payload (Mirai)", "value": "e5c0cf4ef3f8de36914e6a6594e350146884636d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677990, "uuid": "27861970-fa64-4071-8473-c37b16acccb1", "comment": "Malware payload (Mirai)", "value": "4bf31bf19b51dc8f4abccf77bafd8d78b01914195749cd01a39208667401238ef000b8b85cf8ffd2dc78d4f3109731a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677990, "uuid": "076093dd-96be-4932-a92b-2f9134425324", "value": "T149237C76C56AAED4D8488174AC35EE741B93F00983A72EFB1AC584B9404FF78F6093E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677990, "uuid": "89c9343b-5eb3-4171-b713-bcbc488e3b1e", "value": "768:Sa7eo4I0edaGHV5wt1FXMHGxOc/LoipLEoCcoA5bpKmz:Sa7wJW15wt1Ec/LZpLEo4AjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677990, "uuid": "e35e6a77-a88b-4964-b30c-dae90b62cad3", "value": 48980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677990, "uuid": "34e7c76a-91dd-4345-a546-7dd6240cb6bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677990, "uuid": "f65e6b70-8f63-4e7d-981f-9aaec39dc6d6", "value": "41341571519bfbea4a85599736ac067e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89ab7e9-f677-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712670562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670562, "uuid": "ef02d15d-9be8-4673-86b9-d24f8552d3c4", "comment": "Malware payload (njrat)", "value": "2bc6e494ad1dffc7fa6e818dd8a57f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670562, "uuid": "597bd2d8-ee2f-40a8-ac71-3a4ab4a489ff", "comment": "Malware payload (njrat)", "value": "8cc02a93a6ec92e0bf059ee4e7dc879cff73a03419673078d774fbe3eaa19139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670562, "uuid": "34c9c816-8248-4839-91ff-44dc080f0226", "comment": "Malware payload (njrat)", "value": "37c9c6924b2175b465011b5ebaa383f624709fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670562, "uuid": "2d53296a-4416-483f-b46d-c89d9ca1f79e", "comment": "Malware payload (njrat)", "value": "f28e8cce5ac3944c840c96f96badb457f42c5e391ff0e21b6c37e9282a6af94a514adf5a5d4f6c8e37c4566e200aee2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670562, "uuid": "9a867bc1-710f-4939-b4bf-d57b44b6091f", "value": "T166E2F84677A54229C6BC1AFC8CB313214772E3438432EB6F5CDD98CA5B676D00245AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670562, "uuid": "ff0f9e2a-730a-46f7-900e-220dfb73b40c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670562, "uuid": "fbfbb981-4ae6-468e-81f0-927eb3e51f17", "value": "384:u0bUe5XB4e0XrOnaiaXLilpknDEWTUtTUFQqz9eObb0:/T9BuSpaXWlt0b0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712670562, "uuid": "6c1c4841-3bf5-4107-b113-26d931a0f923", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712670562, "uuid": "d7265042-e21a-460c-9053-3891286df00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670562, "uuid": "e28dec78-54d3-4981-86b8-b43513376fd8", "value": "xvONQE15fXnp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9946ee9-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692898, "uuid": "c9fddc5c-1383-492e-b3da-aab890bfef5f", "comment": "Malware payload (Blackmoon)", "value": "a0abc9b568ecaedbaa97275980661174", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692898, "uuid": "a804c5d3-3b0f-4435-a8b8-6138a0f911bb", "comment": "Malware payload (Blackmoon)", "value": "8d6113a90dd18104a7ae2586fa414ba80beef922083b8bdadfede1f5a81d07e0", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692898, "uuid": "d9c45aac-9b87-40b7-9a95-c43b88a01918", "comment": "Malware payload (Blackmoon)", "value": "efad7f2696246ddbbc46b65303fc56e7740211a9", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692898, "uuid": "0c34b2ab-294c-4d1a-b3b7-99844af3849d", "comment": "Malware payload (Blackmoon)", "value": "22e0d1782fb1c9388a1e30140011cfd0f9a51e16f4aeea8555c7f7062fe974e4e81a0374dd5212bd01358e3244a54fef", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692898, "uuid": "f85139bb-ad13-4418-8b13-3aba46442924", "value": "T12084B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692898, "uuid": "61cef52c-0281-4654-811a-24619eb98531", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692898, "uuid": "9237fd26-c59b-47a3-8a17-8bc95ef8d0bb", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P16:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692898, "uuid": "f7c978f1-af36-419c-a4f3-27d276a27a1b", "value": 375224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692898, "uuid": "8a7a302a-a586-495a-935c-9e6b5ed65766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692898, "uuid": "d6723a3f-492d-4f61-b76b-75f4b3334773", "value": "8d6113a90dd18104a7ae2586fa414ba80beef922083b8bdadfede1f5a81d07e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d559972-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651860, "uuid": "6eb65728-3132-4f24-86d4-7ea40ec40fd5", "comment": "Malware payload (Mirai)", "value": "fb7acc6aa10f1aacfdd0bc296135b26b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651860, "uuid": "c07aad8b-f0d9-4a64-b22f-fcc233a50266", "comment": "Malware payload (Mirai)", "value": "8d8565f1c529facbb1f02fb2b752343ef705087cc0274b8c825f8ea4e5e0e5c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651860, "uuid": "e2ab1433-3066-4eba-938b-840c0eddba08", "comment": "Malware payload (Mirai)", "value": "c1edb92c2b1144e04020f5fbedf6625b90d3bbfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651860, "uuid": "95a83bc2-6229-4b79-9d54-7687f6cd2f00", "comment": "Malware payload (Mirai)", "value": "d30cedd9f10c2e9f53949872956ed08ba0e48c88a288187e85093d9a95d6978c90576a7e4114a02f53db55150cab6325", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651860, "uuid": "a5c70092-3afb-4492-bf78-27e7f2ae17da", "value": "T10D83E70AFFA50FB7DC6FCC3706A91B0539DC954A12A47B367634C828B65B14B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651860, "uuid": "5ce1fb1c-9487-4c25-baca-a877946412f7", "value": "1536:GByluwft/xN7A19xp2rBZSRbOvP0ZIBKCu:G0zf9Ap4BxoIBKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651860, "uuid": "a152caef-b1e2-4d16-879e-7407878df6ed", "value": 80900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651860, "uuid": "e02268af-8add-442c-a1fe-cdb75d310585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651860, "uuid": "a841f543-89c1-4658-bc49-61f29a1a6c44", "value": "fb7acc6aa10f1aacfdd0bc296135b26b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb6d1ae-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712669875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669875, "uuid": "7f5b2361-816e-4af1-a65c-c3ff1bf46b38", "comment": "Malware payload (CoinMiner)", "value": "b0c7521719bba4d0c31c61faf7325f35", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669875, "uuid": "8b869b78-d926-4b96-bfe0-cba1026c87d8", "comment": "Malware payload (CoinMiner)", "value": "8e677e3484967771a5518c91ac2bca998e8e91a39df12ef2672ebd80558ef71c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669875, "uuid": "b43288d9-f4de-484b-bd1d-60ea2e573087", "comment": "Malware payload (CoinMiner)", "value": "e1a50302ebb83f19978d301e7702ebe7899c390b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669875, "uuid": "62f08a7a-663f-4ec3-8b5d-28055fd19f53", "comment": "Malware payload (CoinMiner)", "value": "de3eea99fac8795335189a8fc173c350d1d9adee81d3e2707f9b9d29a81f3e434c5e524663c6a6e5fb3c9067f922ec9c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669875, "uuid": "3ffdc838-743c-4396-963c-6a7310b16c9a", "value": "T141766C51BF44EE1BD2A4223099B6C33473D5BD0485A13523BB96F71E2EBE374981ADC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669875, "uuid": "b371c6d7-f76a-4020-945f-718c5811c78d", "value": "49152:OruyY0XyIy6hi0wKg1xbnqEFnANVQF/0RVMKzlIUKlkJcTukqUUdoxx2JG3+sTiR:OruyY0vDKKzlIUKuPCVPltcGPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669875, "uuid": "d2db4cba-5222-4521-a278-2e0a8dcdb254", "value": 7389990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669875, "uuid": "0244bea8-61dc-4127-8079-ad1bc5d31d64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669875, "uuid": "9839caf1-533d-4802-a198-7237a11ff781", "value": "b0c7521719bba4d0c31c61faf7325f35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c419011b-f635-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712642127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642127, "uuid": "24f97897-1453-4e81-b490-c8bb789d624e", "comment": "Malware payload (Socks5Systemz)", "value": "af5d541c450c2fae1b1c104528813038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642127, "uuid": "3dc8bed1-9cae-469f-bd68-d121c1f61659", "comment": "Malware payload (Socks5Systemz)", "value": "8fc201090d34fb3d4a9d1dcddee20c0acbd0c389051d7e5d5a0636c77868e72c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642127, "uuid": "210b545e-6a08-423c-9b09-aae89f0b933c", "comment": "Malware payload (Socks5Systemz)", "value": "bb4ef8d46353460e0409119e2dbaeb06b18314c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642127, "uuid": "acff1268-f634-401e-9986-de9191a02a2b", "comment": "Malware payload (Socks5Systemz)", "value": "e5a2344eb0fb14aa66b5509ba3bf11c50e6489f3cee3d9626472c7717d1ca8d3a70c33be9ab3dc92ec0898eebd89b803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642127, "uuid": "32f722ad-34e5-4916-9e33-b0696fb9bbe8", "value": "T104263313AC1DAA33DBE148B21949D489F23339A79B386416E74C93CD877D9E54B8CB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642127, "uuid": "d030d8be-5ea1-4f70-a04e-e64de0e1f345", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642127, "uuid": "bf3a8e3e-9b62-4464-8caa-5713f39f3b9e", "value": "98304:iivYe0VCWqCpTX/oqQsFwD0K1E3iwNiulKmK//bRA0kY:Hv/WDDGUfKW39NKNLi0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712642127, "uuid": "f628639b-e14a-4135-bdbb-d68ffb145bbd", "value": 4470408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712642127, "uuid": "7ba1d4a2-84a0-4026-98e6-f726e9d57102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642127, "uuid": "050a753f-3f7b-4119-8556-aa799961d9fd", "value": "af5d541c450c2fae1b1c104528813038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69adf701-f67d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712672899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672899, "uuid": "e878c4aa-8e4c-4cbb-afd3-259e40bbd000", "comment": "Malware payload (AgentTesla)", "value": "bface8626cf9e3c0ecd0aa4af5c3b2cb", "object_relation": "md5", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672899, "uuid": "33af69aa-1d28-4561-a03f-c24cf532cda1", "comment": "Malware payload (AgentTesla)", "value": "91b8e1cfbcfbab86c0e8ed3aa2c1cf9bdc1dad0db6bf69c4e555007043c85fab", "object_relation": "sha256", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672899, "uuid": "ece67af5-e515-44cd-82b8-e29b899623be", "comment": "Malware payload (AgentTesla)", "value": "588cac4213a5a8b0fc322a5243a954c90961a75a", "object_relation": "sha1", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672899, "uuid": "3298bb3b-4901-409e-92ee-86ecfd106625", "comment": "Malware payload (AgentTesla)", "value": "87ed948c3977e781b65d47034e491dd9c3ccbad099ac9c74c19a59f7cfffc127538eb84d125cb3eb03047dfc328fce04", "object_relation": "sha3-384", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672899, "uuid": "4dd3e54b-0144-4206-b1a7-c56cdd4cd2c4", "value": "T177037D0EFAD4D826C2F9CF73C8E2120A4174A54AD513DB1F78C41B6E5E122CCA552EB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672899, "uuid": "059e5ea5-fc50-45ee-a69d-069c5f3162bf", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672899, "uuid": "74961647-d5a5-481a-ab18-cdb6a0a38f15", "value": "768:6qUnhrBOM3g2oZZht2ocplb4N1rWFfn7zsko4gJpF:MkNht2Hj4nazsko4ApF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712672899, "uuid": "fa380e6a-5d91-4021-9307-2a457232fe1e", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712672899, "uuid": "3dd9b87b-4a4d-4a20-a44b-2b89c9864a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672899, "uuid": "ac7ee4a2-dee9-4223-8bbc-9df04fc277fe", "value": "pinchs4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac1636c-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692900, "uuid": "249aa9cc-f961-4d37-bc25-3e91b2187cb9", "comment": "Malware payload", "value": "e85a0049754f3d3d6bf2d0b1edeb7664", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692900, "uuid": "83f84564-d63b-4162-b989-7dcb0fa224c4", "comment": "Malware payload", "value": "91d54a460dbb7a790bc808f65eb42f2640fe65a0801b9674fbd4a097103013da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692900, "uuid": "c16bec96-f753-4aa2-9dd3-daac04323a02", "comment": "Malware payload", "value": "d4954846dfa14ed0ebe9ce48ac2043ca99d765d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692900, "uuid": "cb308579-bd87-4af4-9dd0-1ecbc611b847", "comment": "Malware payload", "value": "c26996afd649394dd51e342eecc11918d96e63f9b344e0874ebd5a4d061a9235312e4dc7c6b1134b575f00148b2824f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692900, "uuid": "d8c9a727-2fa9-4341-9117-45798ec3585e", "value": "T1C1A4A61372319491E1595BFBA7BA433879F8836438B0CD23EBE4DD62BCB5122971A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692900, "uuid": "4f75caef-19f0-4013-87a9-b3a0e83a0848", "value": "d070a98a3bb72e151251c216b80dfd90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692900, "uuid": "8a5d0648-38ac-4d47-8a4d-2ce905112574", "value": "6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZL:/vpv/R6H3U25fehHpAW+yOBOKCZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692900, "uuid": "e0b4f6f8-5e4e-4a64-823c-4779cdba1b3a", "value": 462888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692900, "uuid": "0b065316-12a8-4361-9d61-fca334e12233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692900, "uuid": "611a1977-be15-41bc-b394-b0708a115aae", "value": "91d54a460dbb7a790bc808f65eb42f2640fe65a0801b9674fbd4a097103013da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb57d0b-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692901, "uuid": "e0a961f9-a812-44e8-a3dd-0e5569a1f301", "comment": "Malware payload", "value": "e42a8fab14515c57bfbc85669e206754", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692901, "uuid": "22cc9311-c5e4-467d-af70-86baecfdee65", "comment": "Malware payload", "value": "9201a001981d512bc68b9d677942007331c0a2b570f6637cb158de12624a1cd7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692901, "uuid": "fcdb09b6-8f04-47e9-a42f-7faea707a735", "comment": "Malware payload", "value": "7d7eb4346282b462eb272af0acb1dc188a67a57c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692901, "uuid": "99eea194-9d2d-498c-a695-53b1d2ef249a", "comment": "Malware payload", "value": "3aed66fd5f36eaa21333ba96b53922d8fff3f9c324d54a237671d66f1bb5d3521beadc52a6d3a4ad02b89aa5ec112333", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692901, "uuid": "6348f333-94c6-4c24-a15f-a106cd2c0725", "value": "T113A4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692901, "uuid": "5f6710db-a480-4c78-878c-5c06e83b1a8a", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692901, "uuid": "141cb0d3-2c6d-416e-a78d-5086609e6e79", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubZ:sZ++qlRBBOxQDU2XWIg6BiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692901, "uuid": "817656af-0ab1-4626-a228-fc4f8ef58c8a", "value": 458374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692901, "uuid": "20d8931e-cd21-4d9b-9e0d-5f35df3bedfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692901, "uuid": "e8a64c69-591d-4b8f-aec0-0f1d3fed9507", "value": "9201a001981d512bc68b9d677942007331c0a2b570f6637cb158de12624a1cd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcae8daa-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692903, "uuid": "6a69e737-281d-43b2-8e36-48f47b02db16", "comment": "Malware payload (Adware.QQpass)", "value": "37f6b1f15db38b82e1da82684eff9341", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692903, "uuid": "762f3b20-5290-4351-9ccb-9c192d7f9754", "comment": "Malware payload (Adware.QQpass)", "value": "930bb917a04f60ac37facb633aa7fba7f35c66cd766ae357ed1dcbeb52d28dd3", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692903, "uuid": "97c03b8b-953d-4dff-8e19-3334347a3094", "comment": "Malware payload (Adware.QQpass)", "value": "fb37d6590fa4fb74a7e2bb2633c15bd8f32f17bc", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692903, "uuid": "02d22cd3-806f-4852-a89d-843dda47b61c", "comment": "Malware payload (Adware.QQpass)", "value": "07ebcbe0d1359bf855d624e0ffcb9f6846d1635872cdb2b3a6a48ec39b005dfdd5c79399a6d74706472caf722f504da8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692903, "uuid": "17775e32-ba70-4951-a3ea-3b81fda3ee41", "value": "T1A8A4D813B622A495E11457F66BFA073869B8832438B1CD13EFF0CDB2BD71671875A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692903, "uuid": "5917f73b-5051-400b-b01d-40a858c912fa", "value": "dca55ab828881de2079e4e62880ac2fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692903, "uuid": "61518f7e-6985-44f2-814c-f77266ac0c91", "value": "6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAc:xgXQKSLpOCtV0R8xMSaAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692903, "uuid": "72f22261-d875-458b-8114-035239b7aa99", "value": 451154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692903, "uuid": "d038c1ee-d197-4beb-9f91-c3a694ff61fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692903, "uuid": "085b3264-bd2d-4045-b0a6-be5986364ead", "value": "930bb917a04f60ac37facb633aa7fba7f35c66cd766ae357ed1dcbeb52d28dd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cf5c0e-f69c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712686066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686066, "uuid": "4b7bc608-183e-4df9-91ae-2237015f931f", "comment": "Malware payload (Mirai)", "value": "c304cec6d52316379ea0b82eb0fbe080", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686066, "uuid": "50ee7b75-41b2-47ce-8f5e-2046aa9e8af0", "comment": "Malware payload (Mirai)", "value": "935e8ae2e26ccde9566c293e1892910e3ce000a42dac5e7081c7ebcd21e28e03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686066, "uuid": "0bd20eb0-4f54-4d72-aac3-13fc40b822ec", "comment": "Malware payload (Mirai)", "value": "90813e765522b7d2f316a5e9c5470a33f3943f7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686066, "uuid": "8b671a60-5eac-4144-9ef7-a1c9bdf78c4e", "comment": "Malware payload (Mirai)", "value": "65d0476667ad5603c60fccda4f87ccc922616ab35a768d43e4d1f9036963d79f066430e7eaccb2292e8dc3c9ffdb004e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686066, "uuid": "b60ce9f9-424b-4d0f-84c8-4a9664914a23", "value": "T1EEF33A01B32C0947D1672EF0363F27E193DFDA6124E9F644255FAA8AE272E321146DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686066, "uuid": "d7f4a74b-950b-4a22-954e-01781babfe58", "value": "3072:AFKiweB9p5oDB9p5pW7B9p5zD1odZ3fxTZNToOgz/ZyVcU80ZZuuW:AFKiwJWLixTZNTrgzgeQZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712686066, "uuid": "dabf7714-b232-423d-880f-14915f72f1c9", "value": 166768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712686066, "uuid": "53eebde9-84e8-4f0a-b21b-25f26cd600d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686066, "uuid": "02dc54a8-b3d8-4955-bf4a-45207e113a35", "value": "c304cec6d52316379ea0b82eb0fbe080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad7242a-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669519, "uuid": "b58189e4-f1dc-491c-a8b0-064e5edd28f3", "comment": "Malware payload (Gafgyt)", "value": "b81dd8d126e843e57f5ad57d67a181b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669519, "uuid": "7ec13b36-1c93-45a2-bcc4-108e461e4119", "comment": "Malware payload (Gafgyt)", "value": "93e998fe4bc3a6539468a3a7144665f097687eadb56a5fa440c0372cd224fe20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669519, "uuid": "8d59802c-02d6-4efd-a38c-1b84a0209f07", "comment": "Malware payload (Gafgyt)", "value": "4cefd2c36c7a863e1de52e93931547819ece0b06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669519, "uuid": "aa09d3f8-3eab-41c2-80c6-1e80ef0c2006", "comment": "Malware payload (Gafgyt)", "value": "12927b363a6ace33ed4253a308f6f730b8f7010e3f26614ee4e2665be053778b3445e16e40dfa488d49cf23ff02fdc56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669519, "uuid": "089baedc-221f-4fd2-9950-f345ea05e84c", "value": "T19344A5067B918EF7C89FCE3302E6860124CEE05756A43B6BB674D66CBB0A90F45D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669519, "uuid": "3e9a42c9-c735-4613-b0be-459bffabfd82", "value": "6144:0JQ5FypCE0kL7lJDQdvmlBrL/MYUngmFeDZZP:fFyocOvmlBrL/MYUngmFeDZZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669519, "uuid": "3cac627b-26be-4602-a140-e19dad5786a1", "value": 254705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669519, "uuid": "d2ae1866-acb4-4926-a65d-15e891a9adc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669519, "uuid": "3a540027-f1f9-4721-bef7-c7238a2438f9", "value": "b81dd8d126e843e57f5ad57d67a181b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39701fe1-f6b7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712697729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697729, "uuid": "819d129a-2bfc-45e2-a09d-9eeb9bd3760e", "comment": "Malware payload", "value": "12bd32c54d014ca722ac95b87bf78331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697729, "uuid": "cfb93e6c-4da2-4158-b58d-5e43b7596f23", "comment": "Malware payload", "value": "9462b76ac528bdec226b714ce6e8756fff28f33048897ed1e11ec73218e8d1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697729, "uuid": "e292bf90-5027-4d28-9a59-4d024581b8ea", "comment": "Malware payload", "value": "96828fa8bde3d52a84a979e2b056dda403d05841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697729, "uuid": "14d79d39-eec9-45ee-97da-708fa92dd50b", "comment": "Malware payload", "value": "ecde5cdf4d1d33b58a4179cdc7fb699f385dc2d20666e98a79805038d7d574610abc3d5e2a9e4c277769627c7d05496f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697729, "uuid": "bed6b0c3-fec0-4bdb-838e-6de7d39a7a18", "value": "T1FBB5331933D6DA74F680347A0846C6B066F6F456171386CF7B8C5A064F72EF5AB7820E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697729, "uuid": "6c49132b-9827-4309-9950-4a261a9ad09b", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697729, "uuid": "9b97ecfb-c1f6-4bd8-b420-7b5d18373096", "value": "49152:zgwRwVkqb4dzwJSxAI+hbusA0Oyo9T/DSNNdar0RIzJCD:zgwRucB4SxqbusAvnroYID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712697729, "uuid": "fc68e890-f2af-4b34-aaeb-3bbaa3cbb812", "value": 2457036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712697729, "uuid": "986675ac-c35f-4700-8c10-f218ca8b8179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697729, "uuid": "ff6332fe-ab71-4758-9b75-3de3ad6682f7", "value": "SecuriteInfo.com.Tool.Nssm.5.28597.25829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc69bdd1-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666220, "uuid": "5ea838de-7fdc-4fa8-a49d-01babb94468d", "comment": "Malware payload (Mirai)", "value": "39ed72cc9322aeb71b0204bdff20ebb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666220, "uuid": "95153b45-ceb8-4152-9600-d8a1778370f4", "comment": "Malware payload (Mirai)", "value": "946870a69ab8f9f8bf936555398c1a3ad79fdd5d859a7d5a9d1ca2808c65c257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666220, "uuid": "50fdaf1f-a38b-4ad6-be7c-4bf26b2ae1b6", "comment": "Malware payload (Mirai)", "value": "168628d72e36e3b401b781c72b21046f77c3a021", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666220, "uuid": "4253164c-3257-4b22-80c8-675527151a02", "comment": "Malware payload (Mirai)", "value": "a474dbe912d949191c24303d50bd3314cf3358c1d85067d9495273e3ef9261d753756a49f7fabec69654e1ff48981f18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666220, "uuid": "1a558678-8bb4-4f5f-82e3-1b5e200ac5d3", "value": "T120133C42732C0947E0525EF0793F1BE093AEEAA120E0F189690FD75A8276F735186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666220, "uuid": "c0feef3a-08cf-41cf-892e-b16e31d84f22", "value": "768:6pcuHoRV9T3oXc5cmXbzMlfL9i05RrSHMJETj:r3BoM5cmXbQRLpvrSHHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666220, "uuid": "6758566e-6386-4731-9c9e-13b0f7935db8", "value": 41972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666220, "uuid": "42591ba7-a687-4456-9df0-1bfc03f45e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666220, "uuid": "297c31ce-6422-4d91-b10d-4da94979305e", "value": "39ed72cc9322aeb71b0204bdff20ebb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71614c23-f680-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712674201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674201, "uuid": "72850390-6ec9-4363-803c-168a5720130e", "comment": "Malware payload", "value": "7ee6d5e989576fa8fd64299c925ec9cd", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674201, "uuid": "711bf01c-b968-4327-b957-68dc7b5e7929", "comment": "Malware payload", "value": "948d7fbcbd463c95fc5aa552b6c001f7b91f723ea56343f578631101ea0b9d59", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674201, "uuid": "09bc0a44-9eab-4e02-91aa-9d63f898d929", "comment": "Malware payload", "value": "b7a983206aa54e5abece5010c67a903ddcc331ea", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674201, "uuid": "12774de7-1d01-4bfd-8302-270c076acb10", "comment": "Malware payload", "value": "9784cae9b1abcb103aefa9fd3bb7671f693870200da342bf308ec5d1031afdd728780697a0274bd16e13a2a813a7dcee", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674201, "uuid": "ea710358-a6e9-4583-9cb3-120f5ef755a6", "value": "T12E43E108E74ECCE1C650A575044F57B87639A2D4CAC0FF4A8A79FCB54BC23B51EAA9C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674201, "uuid": "6cf80ec2-a5c4-4381-8f74-bed330fc72ec", "value": "768:ZFnM1dDlT2qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD15ogXnlq5n0:/mZ2u4OPKIxoEuDKJnlO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674201, "uuid": "e3905905-ae93-4be6-968e-79296e432c94", "value": 58226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674201, "uuid": "4d0b9948-c877-497c-a286-866640a9272f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674201, "uuid": "810e2504-f1a0-40d1-b8c1-f03c69ebb350", "value": "statapril2024-3192.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd74a3f4-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692904, "uuid": "b6f239fd-3ba9-4a42-b9fe-06435fcf04c3", "comment": "Malware payload", "value": "8ca072fc9b614f704195ebf49e18ba0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692904, "uuid": "b3ae8270-73f3-4050-98ed-6aac3ac5f5ba", "comment": "Malware payload", "value": "95d6a0ad706e8a2b8aab598ef1bc74b091de08b59c5308698b60838991ff4247", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692904, "uuid": "84d1bf22-cd7a-43df-8145-129e8205abc9", "comment": "Malware payload", "value": "15f6b9e5618b530a74510bffd8780f4dce8b59ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692904, "uuid": "57e629c5-90ec-41e9-90f0-40bab9cc1f7e", "comment": "Malware payload", "value": "f87422f5bb608a915172acf6adf07448d56305a7deca09c315d8379d60e5d3331b0ba1b049ecf305dee7c70b6211cf9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692904, "uuid": "e056fc57-cd0e-42f6-95d0-383d0b70886e", "value": "T10923AE039DD148F1E829067639FA077DFF3881816D31865BCBB1DDB02D73225762A58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692904, "uuid": "f216d06c-3d60-4d0e-9066-65ea16b42a31", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692904, "uuid": "8e460850-5edf-4d2b-b91c-714a2aebd017", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+ev:w0hAW1iqdWNzI5Pd4CSyDt+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692904, "uuid": "986d2365-41f5-44de-9428-90cb4a46c152", "value": 49779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692904, "uuid": "8a350f8a-8b33-4bd1-8042-2a33d1509684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692904, "uuid": "f8136336-6c81-47a3-a0cd-caa890e6f5fb", "value": "95d6a0ad706e8a2b8aab598ef1bc74b091de08b59c5308698b60838991ff4247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe402011-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692906, "uuid": "4a60bd48-b1af-4909-abab-4ee7ad185eca", "comment": "Malware payload (Blackmoon)", "value": "8e10fb5dc1b2189f52e75184d375fbe4", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692906, "uuid": "0d1d066c-08d1-4ff4-9e0e-7bc35f4c9f59", "comment": "Malware payload (Blackmoon)", "value": "96113c75a89768e084cf6c222bb0fa7c972ccbb435cfef445c74196ed6357119", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692906, "uuid": "5ab61886-32b8-4803-825c-fd7e3740f349", "comment": "Malware payload (Blackmoon)", "value": "4dc71567251199d3a5fa8c2289799e5f561355c1", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692906, "uuid": "e45b34b7-20b1-44a5-95ab-ff4f2d9ed3ff", "comment": "Malware payload (Blackmoon)", "value": "d4484dfc9458d52c10b26cdcb5b04f4d1fe0e1aca1db8870fcd57619de9c40b949b5432bdda412c43d63de352a29f321", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692906, "uuid": "813b7dfb-4422-48d9-ab81-2a4f3c61706f", "value": "T18223BF03ADC24DF1E829467639BA077DFF3881816D31865BCBB1DEB02D73229751A58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692906, "uuid": "1731627d-9e4b-4aa5-a5a6-92fca2435d15", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692906, "uuid": "0e14f89c-3db0-47fa-892d-62c1daae4c65", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyuG:w0hAW1iqdWNzI5Pd4CSyuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692906, "uuid": "7c89be47-4fec-4605-bf93-4070dd34daba", "value": 48139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692906, "uuid": "589a1089-f078-4b90-a693-360395f679ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692906, "uuid": "d50d2eab-a7a8-443f-b0ef-b910346368ca", "value": "96113c75a89768e084cf6c222bb0fa7c972ccbb435cfef445c74196ed6357119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff35320f-f6ab-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692907, "uuid": "cecc4baf-bd30-4d3b-8438-1e0596299b4f", "comment": "Malware payload (Blackmoon)", "value": "07c286fc278d5b87fa2510cbc50691dd", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692907, "uuid": "4c72ced7-23e5-4bbb-bada-0bf40d95beb6", "comment": "Malware payload (Blackmoon)", "value": "96445ae765d1c9ef741b1987aab10b316fe12d11d7579ec237a0bb221df6f605", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692907, "uuid": "15750b5d-6505-4851-a4bc-5aac1f454830", "comment": "Malware payload (Blackmoon)", "value": "b4c0166d681b26a44bfd4f18c8a1519d8707f6de", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692907, "uuid": "e558960e-9f88-44da-b16c-628ed5b3fd2d", "comment": "Malware payload (Blackmoon)", "value": "62b7b02532abe87fa2ab0a520b084a4472ee4086973a22290520b38d757b8220b329bcc122255d1576a015a5fd594f7b", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692907, "uuid": "a1fc04b7-44b8-4ab1-8a10-f30b0591a128", "value": "T12BA4A61372319491E1595BFBA7BA433879F8836438B0CD23EBE4DD62BCB5122971A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692907, "uuid": "c95b4a2d-3bfc-4c6d-9d16-297bb3e5d2b9", "value": "d070a98a3bb72e151251c216b80dfd90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692907, "uuid": "84744573-4f11-4b26-92dc-f69f6cb15820", "value": "6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZJ:/vpv/R6H3U25fehHpAW+yOBOKCZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692907, "uuid": "251e9f6c-697d-428c-9b10-aaed87f5b34c", "value": 462888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692907, "uuid": "cc430a7d-e660-46d4-9291-5604c42505cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692907, "uuid": "bcdc7285-e2e9-405e-83bd-00b72a401dba", "value": "96445ae765d1c9ef741b1987aab10b316fe12d11d7579ec237a0bb221df6f605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbdbc49-f652-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712654438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654438, "uuid": "a7c7b10a-1ea8-457d-a819-b81e032e4467", "comment": "Malware payload", "value": "a3914ece8c4fa14beecb7b899a51aa0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654438, "uuid": "fb7a4f36-30df-4cd8-88e7-5c1e5b2a1bd1", "comment": "Malware payload", "value": "964d21a23ac05459497614d01403634d0b4fadf9e667ff90ce6871ae354616aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654438, "uuid": "88431a96-5f65-4ef9-a736-9ccf2cf96771", "comment": "Malware payload", "value": "4cc1a1e146862078ef5fa9e44a8bf1cded608a9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654438, "uuid": "532c45dd-cb93-4a60-94cb-e7080d7dff12", "comment": "Malware payload", "value": "a25233b2a1a46ad36c2b8099ec645f8abfc46fc09855851d0d2029738157e21848f2029b454dd43a9808cd0fe14e47c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654438, "uuid": "3a2a87e4-4afc-4d7d-b07a-55aad7fe2c2a", "value": "T1C627339793F1C472C36AD73C8A67FC201A21FC5B64CA793139A4AD1E3A39C75843A9D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654438, "uuid": "e5b83141-ccb6-4423-8c9c-dc96c067e8a4", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654438, "uuid": "6e348181-8037-4896-9e40-2a144f277733", "value": "393216:EqHewzwsEBcBjhoZdLXoNCP/Rvgh9N6JQQfL2LVu3I8oAGrfR:P+w8sBoZdroNKvmI4uY84R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654438, "uuid": "42993745-50ae-4314-8fc6-7d0baa920fed", "value": 20840856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654438, "uuid": "c1cd3e7b-a72d-4aca-b2d3-abb3a2096f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654438, "uuid": "b70d3938-a643-48fa-90c3-c9d663488838", "value": "SecuriteInfo.com.Program.Unwanted.4119.14479.22111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0032cabd-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692909, "uuid": "37b71c52-21a4-4a31-b3ad-9853765f5ca4", "comment": "Malware payload", "value": "e6d99c6df146ffb4007e007e22ba5ef6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692909, "uuid": "34063aed-dba0-44e5-8fc4-961fe7397793", "comment": "Malware payload", "value": "9698b92534f99e0f5b884fb7985c5a53a365ac21b23e12cab162a539ccf7fe66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692909, "uuid": "aa95c76c-c8dc-49bc-b8a7-a806f92573a8", "comment": "Malware payload", "value": "8daadb3c935d47335c4efb2c71fde52a9e5b8ef2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692909, "uuid": "7ff87283-9e6f-4473-8f34-84c16e43e3cf", "comment": "Malware payload", "value": "e80548bb54f170a25d5f86c59b94f9b1ec6093c785b8c7a591e4253a528242f4e2df6e875250639183ba79431fb3d4dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692909, "uuid": "45766c90-1420-4fd2-b471-63b82fbd1788", "value": "T1EBA47D33EA4180B2D60556F221F11339BFB49B435C164A93E7E8FD75AD32BB16B2350A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692909, "uuid": "cbec80f6-5449-4c79-92a2-cd17d1f6e2d0", "value": "c4cc56b23288e6ddcbc65e41dd25b3e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692909, "uuid": "957b5d5f-9991-4cc1-bfe1-4e36746d823d", "value": "6144:ndR2G2BieCIuM8u+wiifvx8TOMUqjHPPvpf:ndR2G6rCIubuGifvx8T5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692909, "uuid": "b18a2bb0-2daf-43d0-a324-eec8e43bd138", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692909, "uuid": "67b5f17a-e2b3-4d6d-954f-e995e682fc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692909, "uuid": "f8f8cbc6-a74e-45e6-9057-cf7345204c89", "value": "9698b92534f99e0f5b884fb7985c5a53a365ac21b23e12cab162a539ccf7fe66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020adc27-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692912, "uuid": "7935b49b-f70e-4dae-bcd2-3cb1dd3a4267", "comment": "Malware payload", "value": "d55234e703c601880f1f9392678d0dc8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692912, "uuid": "3fa41c0e-fb3a-486c-aab2-02e1d20b98dd", "comment": "Malware payload", "value": "9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692912, "uuid": "929ced77-7343-4b18-8892-8cacb6003e20", "comment": "Malware payload", "value": "59435f8d2b585302447486b7719d209b45309cec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692912, "uuid": "3535bc50-7804-422f-ae80-5fd9da670999", "comment": "Malware payload", "value": "3954724348ef1aeb1499dbecd7763055b7daed268e8173d62d4a38412571195fb28f28b5cd05b0d5d20990fbbc49d925", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692912, "uuid": "9640563e-ae64-44a8-9d3f-33edf1b6ddde", "value": "T1C595BE63F19180F6C92C1539DDAD2336FA74629C0A258BF3EB92DF751C31E90962721E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692912, "uuid": "6d76097b-516d-4b63-bade-a53e0e57eda0", "value": "3828b63943b359ca8aa20e37d5ff8fba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692912, "uuid": "eb03fb7f-ab1c-4b53-96a1-9c88499157e8", "value": "24576:9r0TxazTID9UhQtRlA6Jz7kzSRciXSD3FbbBN/IyZJbOOEHqBh3SWgSklWNy+:9ZzED7tRX8SWwWpNN/IyjEOBST1WNy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692912, "uuid": "6e8be510-7705-4b7c-8905-152267ffa926", "value": 1898026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692912, "uuid": "43c8165f-31a2-4d97-b8fe-4fe75f01b654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692912, "uuid": "5b323978-4d4e-4e7b-9773-da8bbb218792", "value": "9711bc0fcdf0f0f42a46e859d7c26ea61d50b05aae3ec269a1edf668081330f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d5db95-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692913, "uuid": "a7474763-8320-4df2-84a6-037b66bc56c0", "comment": "Malware payload", "value": "e61defa5572eb9c072f5773826cc3b71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692913, "uuid": "a814903d-e0fa-4d84-97c9-d628dcdb8e42", "comment": "Malware payload", "value": "974e141ee7567305c104f7bb78817ea5fe2f75804c7fd425e2158da9b671568f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692913, "uuid": "4325d7e3-c109-4739-87f2-7e51cc6e937a", "comment": "Malware payload", "value": "7df858fda654644ce1e34b404919fa2c53f21931", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692913, "uuid": "4bddf31f-7f17-4da5-917d-58a2854694d3", "comment": "Malware payload", "value": "b61e730fd87e4a1fe6665539de0180885f1b903ef5514e8770d03008b0bada4de8a030beb0363653c3ce92f4b518aa89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692913, "uuid": "8c6f63dc-3a34-4ae8-abc7-5b133a585f3d", "value": "T17B23AE03ADD249F1D825427639BA073DFF38C1856D31865BCBB1EEB02D73226B52658E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692913, "uuid": "70581978-e0c8-4f82-b4b5-c1675d55a21f", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692913, "uuid": "27623e98-f88d-43ed-a67f-8ecc45269e44", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+4JU:w0hAW1iqdWNzI5Pd4CSyDt+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692913, "uuid": "e1324f05-6982-43f5-a97a-7bc44bc994ff", "value": 49697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692913, "uuid": "60084619-3a53-478c-a5df-48eff74053ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692913, "uuid": "f4d87158-36e7-4ea3-9f7f-022d5885cf44", "value": "974e141ee7567305c104f7bb78817ea5fe2f75804c7fd425e2158da9b671568f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bca559b-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678057, "uuid": "c8558138-34fe-4bde-9bd7-f05e3d564e50", "comment": "Malware payload (Mirai)", "value": "820f3715c7b86d582d68bf491cc1728b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678057, "uuid": "f946fabc-a775-4ada-9650-881c0e664685", "comment": "Malware payload (Mirai)", "value": "97c86a17993432e6d800615c00622b8470beb088813b849df5495ce0de092396", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678057, "uuid": "7fa58232-bd0d-4a8e-a1b4-dc55d2b21fbd", "comment": "Malware payload (Mirai)", "value": "d27abdceb1547f062b4cdd828957d1377af267e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678057, "uuid": "8aea34f2-5129-4721-9dd5-6c2edf89de12", "comment": "Malware payload (Mirai)", "value": "5ddc05a2650a8ac8186be301ef8265100becae27a22ccf55751378712924bab14125f5c263b3c3aa273596b059afaeb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678057, "uuid": "86239daf-3b39-4c13-9beb-b05935bb6966", "value": "T15CF31945FC519F26C6D212BBFB4E42CD372A17A8D3EE720399259F21378A95B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678057, "uuid": "c4a8bc4a-2c83-40ab-ac39-76204c9f3801", "value": "3072:Eb8xG7QfRVIKKqrP4vTvb44/WudFbZ3AwHf:s8nfwKKKP4vLb44/3dT3AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678057, "uuid": "662bf0df-ff68-4694-a573-a8234c52abf2", "value": 162464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678057, "uuid": "62cbad0a-2292-44dc-ae37-0973565ca86f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678057, "uuid": "816fa4dc-b20e-4304-9f89-6fc2d76bd4ca", "value": "820f3715c7b86d582d68bf491cc1728b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d4953c-f653-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712654720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654720, "uuid": "7d637846-36b3-419b-808b-a4767aa1adca", "comment": "Malware payload (RemcosRAT)", "value": "9a987344afb7334bd5fceeae97055408", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654720, "uuid": "ae75f240-0e6c-43d7-8c8c-8a30daebf464", "comment": "Malware payload (RemcosRAT)", "value": "985dda76570c9efdd692eca4a7bef55c99cbcac5ae7683360c115ea5529ebaa5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654720, "uuid": "ff952c5c-d552-4efa-8eb1-3b51bdb5245c", "comment": "Malware payload (RemcosRAT)", "value": "946845c94b61847bf8cefeff153eaa4f9095f55f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654720, "uuid": "aea1274d-9150-4bac-ab44-037c8205ee94", "comment": "Malware payload (RemcosRAT)", "value": "823b8d823936bd2f5d684e1781246d7c24e5918ea1c6d5a7157cf34115621241df7f2f1d1c222611d1faa9acc57afd58", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654720, "uuid": "0acc8d34-3f94-433a-8c35-29c962a9fc61", "value": "T1C316C6D72DEE568597053B9BB74BEC980B2FCD310FC26EDC40D60698860B64F3990D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654720, "uuid": "e80edf5a-311d-4569-9e2f-6bed5497f7fa", "value": "49152:XgJ9GvW/Z22bISDp6JXl62tBW7Abb/1XaN+Nkn:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654720, "uuid": "b657497c-11be-4b6d-a136-ad6698b771ab", "value": 4077724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654720, "uuid": "e7018a0c-0677-4134-aadf-7ed6c224a3f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654720, "uuid": "c96d7b33-4c31-406a-823e-efab85632080", "value": "PO3488-0337.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c4727d-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692915, "uuid": "46b993f0-fe45-43e0-ab10-f269107eae0c", "comment": "Malware payload (Adware.QQpass)", "value": "4cfa917510615db87a83b936caceec7d", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692915, "uuid": "6e19560f-271a-4225-a868-962d1def97ec", "comment": "Malware payload (Adware.QQpass)", "value": "994a6c279e2849c4eb2d959776bc2c76f78c5b575558edd71e59ba1bc14f0226", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692915, "uuid": "2aefb82a-3db2-434e-9980-eaf9f368ae67", "comment": "Malware payload (Adware.QQpass)", "value": "3fe01c8759df8f2ca3a6a4e677148a57f7eea4be", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692915, "uuid": "26846cf0-ae7c-4f30-87a7-160e2f671ebd", "comment": "Malware payload (Adware.QQpass)", "value": "f0eb5a081210517bc9e7450927fc5cb5b71b30c7039d08935677925aaf7e906b7bf86737560fbb1358904de1acdb412c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692915, "uuid": "320f3a90-cc8e-4ed2-a80e-9f00b64c5059", "value": "T11684B603B221D891E15857FA63FA433479B8975438F0CD23EBE4DD62ADB1522971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692915, "uuid": "d6d5445e-195f-4243-8c8b-08fc0ed53935", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692915, "uuid": "ee1014ab-7b14-4d6c-b831-430073b7d7f4", "value": "6144:MfweR7gpANB0sv2YYuwfDoOPV1x0GwYpkDuC4RhV:u1R7gpAwsuvDNP/xyqkDuC4TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692915, "uuid": "91b33800-b4fb-4d20-a384-785b9b9ee394", "value": 375537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692915, "uuid": "5be23952-63c7-4d9f-a415-5814925e4845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692915, "uuid": "5701328e-ff59-455e-8dc4-ce80d6d4d098", "value": "994a6c279e2849c4eb2d959776bc2c76f78c5b575558edd71e59ba1bc14f0226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0e0ae8-f660-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660693, "uuid": "aabc312d-9946-4462-94ed-e35d63f24b03", "comment": "Malware payload (Mirai)", "value": "7bce3ffa793bff76986bf8ede4178460", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660693, "uuid": "34cf2a09-66b8-46f2-ae37-43db9f46fc50", "comment": "Malware payload (Mirai)", "value": "995601d9dc015bac6e62d276d344388d25091a2bbca570563e3dd7223733f35e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660693, "uuid": "65f49799-6b70-45ba-9e20-e51ce566e37f", "comment": "Malware payload (Mirai)", "value": "ef6701817ceb19beafeb895667fd1743ab786f10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660693, "uuid": "21c2867a-8365-40a7-ae1f-ecf3f79d6998", "comment": "Malware payload (Mirai)", "value": "6900d0fbb005f92acf66e4bcffd38764bd578c5b02187424e9933fbea1f524349cbbb5d52d1f693fa0cacf7e7b91b113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660693, "uuid": "0dca7949-445a-4d26-8046-773f7ab008c1", "value": "T178F2E1EDB57A1CDDCBDC047740CA6EA20489A0C5719B1F4D63E48C86D1FA21B7D623BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660693, "uuid": "7320850c-db8b-4ec8-8177-b51e868b31d2", "value": "768:DQ9gJnTDeCe6140PKDXmeVeEnRB/ooYpo7eUAlFvC82HQ5e9WO:S4ve7S4B2ncr/orof4FvCrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660693, "uuid": "64376418-2f05-49b9-ad88-889fe9e36a4a", "value": 35024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660693, "uuid": "400f9359-757e-4d24-a944-c62a0e34e764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660693, "uuid": "15d8b0cf-8b28-420c-a12a-74580f4dc1e8", "value": "7bce3ffa793bff76986bf8ede4178460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04924b5a-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692916, "uuid": "1f9832c6-fdc7-401e-8650-7dacbed75158", "comment": "Malware payload", "value": "d2f5b66ab0cf13771e89fe1656c89947", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692916, "uuid": "17eddb53-7a17-468a-bb3a-f46c70865217", "comment": "Malware payload", "value": "9aeb0906f67c78e464029d5af304c60b9cdb3492a4121e14454331af8e5c60bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692916, "uuid": "19a09e41-e421-4c13-93ae-279ac3da9810", "comment": "Malware payload", "value": "40898fc048db0e22239f10b66cfc625a607fbcb5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692916, "uuid": "8d8b6ceb-0422-4001-bb06-b2ce644da632", "comment": "Malware payload", "value": "d9ee6e91e5caf6497cc97bccfb49a49c0884a31968f8529fc3221847222c784a8f2fc1493c6855fe6f0e4070a956a605", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692916, "uuid": "45e2f560-4e11-4310-a363-ddd149503919", "value": "T12523AF03ADC249F1E825427639FA077DFF3881C16D31861BCBB1DEB02973625B52A54E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692916, "uuid": "d4fac5c4-92f8-4148-bfff-865dee97bacc", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692916, "uuid": "65fe0e0b-a8e6-482f-964a-c29d92713c08", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+XQ:w0hAW1iqdWNzI5Pd4CSyDt+XQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692916, "uuid": "28b7b144-5c5d-4e21-b655-b90f1813eb35", "value": 49287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692916, "uuid": "42a1e645-4bf7-4ac9-971a-7bfde19def47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692916, "uuid": "b6aa101e-678b-4924-89ab-1c08247608ed", "value": "9aeb0906f67c78e464029d5af304c60b9cdb3492a4121e14454331af8e5c60bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0df3d81-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694521, "uuid": "2a3d8062-2f80-4719-bd56-160a77950a24", "comment": "Malware payload (Gafgyt)", "value": "471f88d2c133527605065bd3c2dd199f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694521, "uuid": "2279891a-54f1-482e-b9f1-770749660ccd", "comment": "Malware payload (Gafgyt)", "value": "9ba9d587df1801270c1008060c062a26a02dbe61bcb959470cbc882a5d22aeb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694521, "uuid": "542be988-5cc5-4ce7-bfad-13a881b399e9", "comment": "Malware payload (Gafgyt)", "value": "f2e604b0391b53dfc77fb98dd04aaf36bc1d968d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694521, "uuid": "b7702615-5360-48eb-9169-50ac3c0ba640", "comment": "Malware payload (Gafgyt)", "value": "c4ecd0ba487698d33c3abfbe0ec97f3bf0b9c2c0d39fd3b95c51a1ee5bc5de644a7e5346381b5064fce4993637ecc870", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694521, "uuid": "35ddd57f-f62d-47f9-9d8c-ce396a0f8468", "value": "T1BCE38266BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694521, "uuid": "41fbc785-eaf9-41b7-8295-1c3bd1482ed4", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytV3pLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflNgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694521, "uuid": "8b6683c3-7d02-48d7-8a3b-9843aac1498a", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694521, "uuid": "42f2c732-b7e7-41ed-a71d-d3159e99c62f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694521, "uuid": "6283ad27-10c0-4c38-bd6b-8241b6486255", "value": "471f88d2c133527605065bd3c2dd199f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b870167-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669869, "uuid": "8377915c-9d7f-425b-adac-4b7d7a32fbfe", "comment": "Malware payload (Mirai)", "value": "ef7c1767eb3cb6a13f1e648cc01ec916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669869, "uuid": "ee10dc45-7ac2-4571-85f5-cf54c659145e", "comment": "Malware payload (Mirai)", "value": "9be7535074095f8c2ef85bac087b47465cc4e5d457b93ded4d495560ac3e92ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669869, "uuid": "fefbad4c-6799-4cd1-b889-f22ca260dfcf", "comment": "Malware payload (Mirai)", "value": "7ec36850c05def2b4127817d509b5ab491fdf50c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669869, "uuid": "b73bf587-c16c-42aa-9e38-54dffd201a5d", "comment": "Malware payload (Mirai)", "value": "d48526f2117ca2a9786d3608e588b904e1b053111d86663bddc88c95f796eaf009cdf96507d1ae2f930455a11524c5f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669869, "uuid": "07eb98df-b46f-4d4e-8621-4055ebf5924c", "value": "T15743841E2E218FEDFB6C863547B78E209259339626E1C684E15CED011FB034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669869, "uuid": "15dcf546-f895-4f30-b508-16ce1c095d9d", "value": "1536:2A1lLplScxORe2na04YbV2fnVvdRX55g9Tze:31lLXScxN2na0wxT5mRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669869, "uuid": "4dbc1b6b-2960-4f4b-8960-e765233832d6", "value": 55252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669869, "uuid": "2ff99031-e746-476c-b838-ddd5e23d7a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669869, "uuid": "53e3f0f0-b3e7-4200-ae20-cbcb9d03ed9f", "value": "ef7c1767eb3cb6a13f1e648cc01ec916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040d0451-f64a-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712650825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650825, "uuid": "70bc2a51-3f77-4941-abd5-00664df9bb96", "comment": "Malware payload (Socks5Systemz)", "value": "5f62490d4ad9db77a2d1671c3bcd0328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650825, "uuid": "9192e63c-791c-4563-a563-cba4286ec977", "comment": "Malware payload (Socks5Systemz)", "value": "9c0151a17e929d6de857367cb47fcd146713b5a73a54a7469a8d3ca5cc7bf3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650825, "uuid": "b326a7b6-e167-40c2-9961-bd31d9d96a71", "comment": "Malware payload (Socks5Systemz)", "value": "13cf6fbc66ec38b83bfb6baab889b2b948373d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650825, "uuid": "103abd7e-c6f9-4af7-ab46-a053f4047113", "comment": "Malware payload (Socks5Systemz)", "value": "a8c7c953b70b8f3dc73c803a458fa5514792e3358ce948f733ce206786586576e2cca680b411ff5aa7da56a5dfa01190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650825, "uuid": "302d11e5-a4f6-4be5-8d38-7c6cf86b8601", "value": "T1B006330BE8A6987CC8B56534DC225611EC037E353C702885A91F1ADEAF279D1DDA73CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650825, "uuid": "137aa9b0-a9af-4765-8039-69488c805938", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650825, "uuid": "ce9c311c-6687-48bb-98bd-8b03fc681ce8", "value": "98304:CXhS6H3obp+eGsWivih/KH5V4mq1/4j8kl6K8:0eGsWivixKZV4D1Qjf6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712650825, "uuid": "9438c8f5-f098-405c-bd1a-45d8fdd2613e", "value": 3853470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712650825, "uuid": "28e1b998-8682-4e5a-97a6-7523df605a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650825, "uuid": "338fab13-17c2-495c-9238-65e87285ccc5", "value": "5f62490d4ad9db77a2d1671c3bcd0328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ca03f2-f604-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712620837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712620837, "uuid": "aa50e017-74d2-4608-a408-7470703f12f1", "comment": "Malware payload (Socks5Systemz)", "value": "1ca99f83afca3a777e952b218aa9067c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712620837, "uuid": "26bb10cc-5779-4880-8de3-f75fe7c2ba29", "comment": "Malware payload (Socks5Systemz)", "value": "9c21afd731160bde19d988b015287e37c11337578767bd4f0bedc4359c7dba77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712620837, "uuid": "e38782af-7c3a-49c7-bb28-cc3a4b79036b", "comment": "Malware payload (Socks5Systemz)", "value": "e7085f979ea000c436bf14e3a2313a1f3ca69238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712620837, "uuid": "d8c1bc6f-aa09-4922-b9cf-755c5a39af0b", "comment": "Malware payload (Socks5Systemz)", "value": "142ceda93d3ec1cdf1184ffdfa9b40159c92d4876acca1dcc1ba9601b6326d5f8ec3731a1558513a5ea7d0b8f74fa6c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712620837, "uuid": "1085362e-60f6-49d1-849c-b8d8378c8495", "value": "T1ED163362C1EF7931F171C9788A02A42D09EA3BB85C353EC4B5FC5DAE5737BA4064A2D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712620837, "uuid": "4017fc62-8647-4067-aa43-857ca1040ea0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712620837, "uuid": "3e763545-b6db-4d0c-b068-9ed490ac9430", "value": "98304:CVzn0/IIkuqsyEOgDtwxGtqS8b16kh8vAVl8dFQxE:aI/hJqxrsmUF89sQCFQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712620837, "uuid": "8356e574-2d87-4ec0-bb36-b37886c0d6bc", "value": 4211982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712620837, "uuid": "b82826a9-12b2-43f3-8b25-1a0069c77daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712620837, "uuid": "889a477c-aa4e-4888-81a5-6a92058dc72f", "value": "1ca99f83afca3a777e952b218aa9067c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf99b586-f6a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712688505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688505, "uuid": "eb2c98cd-ff7f-40b5-a785-2c9443cbff3d", "comment": "Malware payload", "value": "9b61e665a0a7412b97c1a6ef4b739264", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688505, "uuid": "290057c2-adb1-4559-901a-c3da82544d29", "comment": "Malware payload", "value": "9ca7136b6a84b8b4cc5770ef872d4cad3c0de028c1f23e639befa7edadd1bdda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688505, "uuid": "eb9532a5-2a76-4443-a117-46725062e1e4", "comment": "Malware payload", "value": "93460b8b2e552e4a3199836cab82bcf2c987640a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688505, "uuid": "b0c896cb-3bcc-4b17-9dc0-fdc5ca4b5b96", "comment": "Malware payload", "value": "70e04b897ea4d9f674f2e04f1192d854889ad0b14d4b5cf645576ff4feee1d3f5aa3e76ee9df0423210170002a572611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688505, "uuid": "990994af-c30f-4480-bd51-b6ce51f45375", "value": "T1568533F26343B357368ADF39FAE62288E48736A8CC6374E3BD914651D13F9349E51248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688505, "uuid": "23963ede-6a07-41fa-b249-43c4824adeb2", "value": "49152:6KGp9/epwQ7QJmDyzu7iLKjE7li/uQhnp1MmaOHjtOa:6rp4BsmDKaiLxi/91p1MLOHhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712688505, "uuid": "e2a11ee5-1bf7-4ef8-8447-69a0523d67bd", "value": 1828800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712688505, "uuid": "be378419-2ba5-492a-953a-eff02d12d5c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688505, "uuid": "059eafa7-344e-4c12-994b-7311de63c0dc", "value": "SecuriteInfo.com.ELF.Agent-CRQ.22194.21085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285ad381-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712677944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677944, "uuid": "8864c25a-610b-4fa3-8b28-f6967b1558ca", "comment": "Malware payload (Mirai)", "value": "2275ffdba0f069ac78ac12f72acc62e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677944, "uuid": "a76de5a8-5ef8-4bce-b28b-90f5948e2d7b", "comment": "Malware payload (Mirai)", "value": "9d18ce9d7b7c58d2175c67107baf866cb86369cf8acd195959fd776957c0d1ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677944, "uuid": "644a4078-fe26-4d03-a48e-dc437850960c", "comment": "Malware payload (Mirai)", "value": "dc2b78d503c160e89a3d5730083ec8ddfcecb71a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677944, "uuid": "81da9be5-96c1-4da4-98e8-13cf7f5984b6", "comment": "Malware payload (Mirai)", "value": "cee632d8df5b9bb9b7af7342ec67399deab1ebcc0981674377ca5b2d6603d4512d7118d4630df2dd9aa26d976e2b6969", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677944, "uuid": "7acbff9a-990e-482d-9c33-c0588e164b81", "value": "T1F5631981B8814A16C5D813BEF92D01CE33226B68E2DF7216CD116F5477C6A3F0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677944, "uuid": "c36f7f68-7bf4-4010-9b28-1785649f6176", "value": "1536:iWnvcKwB0GbszUNaXC3DcqR8eKKHzkI+i4/xlBKXR:EK8xbtajqk/xlBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677944, "uuid": "fa33a041-db39-4547-99c2-bd8c151759cc", "value": 67848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677944, "uuid": "4b03042b-5e83-4a8f-92ca-b63c502a25b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677944, "uuid": "0fdc6cf4-2f6d-48f0-a055-a348da81b9a5", "value": "2275ffdba0f069ac78ac12f72acc62e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bf111c-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692918, "uuid": "772fb5ab-f087-4f83-a377-61bb51e26bdd", "comment": "Malware payload", "value": "d5239ba56ef2f39b1da523e804f33625", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692918, "uuid": "506fc668-960d-48f1-96b6-c5cf4591d414", "comment": "Malware payload", "value": "9df901aa003bd47016ef7976233bcfbc63a7f74a21537a38498110cdf1955341", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692918, "uuid": "5fce9ca0-1836-4008-b8f1-0d5554e57425", "comment": "Malware payload", "value": "a9399024792609e7943c95a5e7b61c75255606e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692918, "uuid": "184a0956-f108-4d3c-9d5b-fb55aca690f0", "comment": "Malware payload", "value": "6a7b5a8fc3828430a3566cfb083144376633f140d214515ca99f8d1b817b8f73e3070584c3211ee08d8cdcea1c47b9a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692918, "uuid": "526fe712-6c5a-4e39-b164-37b9d3b1c8ff", "value": "T182A4D913B622A495E11457F66BFA073869B8832438B1CD13EFF0CDB2BD71671875A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692918, "uuid": "fbcd9973-41bd-4c28-9fc4-f685356eadbd", "value": "dca55ab828881de2079e4e62880ac2fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692918, "uuid": "e35db7f2-c476-4562-8455-caf141aef40c", "value": "6144:xozXQKqfmiiyWwuiFOLeyOV0R7YRXxMSaAn:xgXQKSLpOCtV0R8xMSaAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692918, "uuid": "8c419ba6-e454-4f0a-a735-3618c09342b4", "value": 451187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692918, "uuid": "f39d053c-ea65-4c9f-b692-40af65d6d5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692918, "uuid": "e83a55a9-f84a-4fa0-b6a7-5a59859e143a", "value": "9df901aa003bd47016ef7976233bcfbc63a7f74a21537a38498110cdf1955341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dddaab-f65c-11ee-a120-42010a9c002e", "comment": "Malware payload (Latrodectus)", "timestamp": 1712658726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658726, "uuid": "d80a020a-a77b-4173-b8d2-46a59fd855ae", "comment": "Malware payload (Latrodectus)", "value": "7d3984674aec72426e2dcbd38539c54a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658726, "uuid": "6714b880-a1bd-4085-9864-2b25971b5c65", "comment": "Malware payload (Latrodectus)", "value": "9e7fdc17150409d594eeed12705788fbc74b5c7f482a64d121395df781820f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658726, "uuid": "ea0501da-a907-4f43-8594-95a65333f552", "comment": "Malware payload (Latrodectus)", "value": "3548610228011247d1e2edc962219466cca9a1a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658726, "uuid": "321cc01d-3c68-4511-871a-413235bf1a48", "comment": "Malware payload (Latrodectus)", "value": "6bb9aea599bb26cb58c12e552fb47664155d89ee8001befa1be81a6e494adde65475c3fa103048d0f2e03d976dc81167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658726, "uuid": "fb50cb4d-07bc-4135-ac7c-fe542dbf1859", "value": "T163734087DBA661E8DCBAD174D2927627F8307C985038BB0A8F519E225F32735F42D748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658726, "uuid": "7671bf3d-adfc-4e3c-a1e2-513e857e084c", "value": "db7aeb75528663639689f852fd366243", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658726, "uuid": "a37f1150-aad5-43db-a91f-76856490cd6a", "value": "768:UiC/DyfvDF9JN137zub7+IJSuCMajTiAmPbjQL5Nhs1+igyX9MDy:7C/DivXBOJSuwjFmz0Lvhs13gyX9MG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712658726, "uuid": "797473b2-bdd7-4a44-a4c7-aeef029faaa3", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712658726, "uuid": "ab6a8b99-e926-4851-a012-8b191b332914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658726, "uuid": "6e7918d7-cffd-423f-bff7-d333f16e51da", "value": "9e7fdc17150409d594eeed12705788fbc74b5c7f482a64d121395df781820f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ca7d67-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712671945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671945, "uuid": "f16e5d4b-598c-47c6-9fad-2de4df661ecb", "comment": "Malware payload (Kaiji)", "value": "3546bba3b8b9b0b1efde6cfde42c2c3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671945, "uuid": "3102dae0-bb3f-40ff-90e5-8af28b41c44f", "comment": "Malware payload (Kaiji)", "value": "9ebc0aa8b917cb4f775dce6a81d79623c812f9392397f1b5a63b7a9d9ab87ef0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671945, "uuid": "d4c6820c-217f-43d4-9674-93a4373a1b95", "comment": "Malware payload (Kaiji)", "value": "d2a30cfa814167f8b418ef5c4d6b961892b25c8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671945, "uuid": "388ffbc2-16df-40bc-9f9e-4d99000b6dc9", "comment": "Malware payload (Kaiji)", "value": "a10509a6b2376817f9759b619c4c7ee990c9eae15f5ca862603e54cfdb2140d6cf9b7706a466571356ccfbb31266b9f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671945, "uuid": "2e41517d-cc33-422e-a8f3-bbe29b5eb2d3", "value": "T1B6364C87B8924682C4E4367ABC7D41D473B34EB99B9713666D04FE3C3ABE1A90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671945, "uuid": "f80f95e8-84a1-4f11-92c9-612e048eb2c2", "value": "49152:94hW9DuzBB1Lf5bQN4m9Dk3Lkmopv1ktVI1h:94hW9mB1Lf5T6kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671945, "uuid": "ea6e63fc-dc18-4656-b699-1e96f3ce8c03", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671945, "uuid": "4a5c5a66-a843-4ced-b7bb-8bcdd52c7a9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671945, "uuid": "a8457cab-408a-470d-b0aa-69981ad325bc", "value": "3546bba3b8b9b0b1efde6cfde42c2c3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7defecb7-f65c-11ee-a120-42010a9c002e", "comment": "Malware payload (Latrodectus)", "timestamp": 1712658760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658760, "uuid": "dfc7d2f8-d55e-4075-8701-f36f06b831dd", "comment": "Malware payload (Latrodectus)", "value": "80a0b619884a185d0abdffda3918cb33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658760, "uuid": "f4f55e16-3e9a-421f-80f6-a9bf0582e875", "comment": "Malware payload (Latrodectus)", "value": "9fad77b6c9968ccf160a20fee17c3ea0d944e91eda9a3ea937027618e2f9e54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658760, "uuid": "c6173405-faa2-413a-8c8c-2d66c6ff7d8c", "comment": "Malware payload (Latrodectus)", "value": "b2edde7d7cd7b01d9cec7644e45ec3246afda077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712658760, "uuid": "73fe24b1-60db-40c0-a99b-234872851e79", "comment": "Malware payload (Latrodectus)", "value": "0aacfad02dbfa344c9dd9efd843f930eaea9575cb2ae6ea78d75be4e800eb803e357c3762d4084692a7288280602e332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658760, "uuid": "77b480a7-3e82-4441-bcbe-ae155c96d2a1", "value": "T1A2733D87EBA3A1E8DCFAD17482A2752BF8307C595038BB1A8F519E165F72730E42D744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658760, "uuid": "7a48a1f1-0722-4b9e-8902-1fba50d053c1", "value": "db7aeb75528663639689f852fd366243", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658760, "uuid": "95722b53-5d51-4e6c-98c5-23f72921591c", "value": "768:8xO+qDlWGT9NVu48up+g5KFNhhlJwb9LfpwThs1GSy:8k+qD4Ud/5KFhrmVfOhs1GSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712658760, "uuid": "1e30d764-b016-4bc8-9721-a28b38d8d3fb", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712658760, "uuid": "9e3d8a9f-f7c7-413c-a43e-a13aaf39be1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712658760, "uuid": "89ad8564-b721-4d4e-916e-1919e2cf8c1a", "value": "9fad77b6c9968ccf160a20fee17c3ea0d944e91eda9a3ea937027618e2f9e54e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb98ec7f-f636-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712642623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642623, "uuid": "42106de5-2ae9-4396-b852-5d24aafc0413", "comment": "Malware payload (Formbook)", "value": "950ddb04f3cf629faedd7d02e12d96ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642623, "uuid": "a516442e-297b-4bd9-878c-d12deaf9d08a", "comment": "Malware payload (Formbook)", "value": "a0dc64cbe4595d4d431131e8396b32e42b13446ecf2ea723e50cb26f395b5c16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642623, "uuid": "375c6a48-15e4-403e-92ee-4495fda03422", "comment": "Malware payload (Formbook)", "value": "7e814fd4a31a530fb5c8fd8f5259cc4671591191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712642623, "uuid": "3105ed65-bc95-47f6-a15c-7932ccf48963", "comment": "Malware payload (Formbook)", "value": "b827dcfb9f0cab099c9a02f72d8e9630f8aab6ea8e1b2499176f963db89f781127e861e0cec954287dcc101229c54f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642623, "uuid": "48597eef-62ed-4152-b9ed-a12c88fdf70a", "value": "T1DD05D09B3598BCCEC437CA71AB7A1ED0D728AC66430BC21AA0D71598953C593FE113F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642623, "uuid": "a807923d-f7a2-4b1e-8b50-cc7874038768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642623, "uuid": "aea00507-6555-4221-a3c8-51466be08bce", "value": "12288:ElVP2B1oVeonJhfc5qrdSMJ4adbaVMtnV4U6T4P7tNrrqOz6BHTKSvNE3itVxAom:EbPMo5P/dSMJz7x+0rfqB4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712642623, "uuid": "adef5c37-f2b0-42f3-8f72-978dd2e7e3d9", "value": 849928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712642623, "uuid": "f1b60b7c-02c4-4cee-b04a-47da699f6bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712642623, "uuid": "524cfe3e-19ae-4b3a-8f18-f2a3d23117a0", "value": "Xbkrgp2HX73cvU3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641071f9-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669884, "uuid": "98cfacdb-f74a-487e-9db8-e70deff31b28", "comment": "Malware payload (Mirai)", "value": "fdab94636a032a3c26b8c29fd1dd3e3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669884, "uuid": "88540ccc-d25a-4571-9650-1e564e294339", "comment": "Malware payload (Mirai)", "value": "a13bb1b00b0be14a96b71ca7b2fc86801486ed440465a6403c1b5bc3ed55072a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669884, "uuid": "554fff80-28fc-4621-a6b2-28bc246913c2", "comment": "Malware payload (Mirai)", "value": "f4df87044ee22b1c41860158b667ded285bb6268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669884, "uuid": "a2789b68-3bad-4744-92bb-566f86cf905e", "comment": "Malware payload (Mirai)", "value": "83b7fa5ff3505136326979e27d5615311dffe01b03cf34b6558893e0f8331846f606a15a6420831f0654595457b25e7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669884, "uuid": "b4f23ed7-0e59-4e66-9972-56f571a6cc4f", "value": "T14CB2D1C1A344EC70D1383932DBACCD89A2CB4379B2EE33733D448996668454F86F5697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669884, "uuid": "baf4dae5-bf2e-4afc-92d7-ac86668dd635", "value": "384:qZyxQXm61zKpBGJ0UPBO4EKfIHxhSEhNiSAlLt5mCuDMlhymdGUop5hKJ:gDXNkEJy4EqnpSqs3UozYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669884, "uuid": "34dd5a2f-d4d7-445b-9d99-e5408f86e0a3", "value": 23748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669884, "uuid": "3ae1e6b0-e6b3-46fd-8060-9f98a79810bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669884, "uuid": "bc5925be-af6c-4edb-9cd3-1cd4d14fb6cc", "value": "fdab94636a032a3c26b8c29fd1dd3e3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605bbbe5-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651838, "uuid": "56536230-0232-4dd8-a711-a1fe511520e3", "comment": "Malware payload (Mirai)", "value": "b445eadab416280ba9b7d6733b0f268a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651838, "uuid": "40b4b28b-469e-4233-9f0e-e3afd2b3eff7", "comment": "Malware payload (Mirai)", "value": "a1529a582388d0ae96a8c22a39f0b7e5d8b793a39961f7a13e14de826af6db9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651838, "uuid": "1c57823f-0d99-4688-811f-1210f998f011", "comment": "Malware payload (Mirai)", "value": "ce1715282e099876b658849ad76db209d93f17cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651838, "uuid": "cd73aa6e-994e-478f-bd09-ea66a7d857d3", "comment": "Malware payload (Mirai)", "value": "ab7842aad0d1c1d9ba2960151e52066ae0536059665c1d8427b4d03cf85d19e14da82d605ca03047d39a65e7b2d51a7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651838, "uuid": "a923d19b-cd9b-46ae-92db-9820ced3af59", "value": "T1B9533A55F8819723C5C1127BFA5E028C3B2563E8E2EA7207AD265F2137C692F0D77E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651838, "uuid": "0fa104aa-1b5a-4e2e-9f0a-28a6ceec6018", "value": "768:GTZ0G84O057tZXEQRd1lkcc+8di+G42/N+zm/GMPA3S275d9glys1TXZwBYI1:RGs8tN3Jkcc+QcPICPpqd9gEsZCBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651838, "uuid": "29a58c0a-2392-450c-8bea-545b1db489c0", "value": 63084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651838, "uuid": "6e48429b-06ef-4379-a466-df3b75ce00f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651838, "uuid": "476e961e-db83-4815-a15f-ed65384d645d", "value": "b445eadab416280ba9b7d6733b0f268a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a7fce9-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692920, "uuid": "594ea820-9349-423e-81a2-d4b8a129cbea", "comment": "Malware payload", "value": "eb2fd9dd8d85947b27197462dbab70c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692920, "uuid": "519469ff-ef72-48e9-bdf0-cf4ae31c0aee", "comment": "Malware payload", "value": "a187c86b3ec6f53b07cc029407adec6d5cccd93702a356cfe78b952d3e8b9365", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692920, "uuid": "65da43f6-6e25-48ee-97e4-f9e0be452c6b", "comment": "Malware payload", "value": "8bb6bc3a8feac875f9d16fe532816f9367e4eafa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692920, "uuid": "f03a6338-8f2e-41b7-ac98-5d0aedcb7b97", "comment": "Malware payload", "value": "a972dc22ce632faa23456c5e7cae6cf8dfff99ed8b1aa5fdc5066760774224bcb06d7fc13a22b8f126d297ad7cca1466", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692920, "uuid": "ed9c9e4f-d24a-408e-b8bf-d582c05f6b5a", "value": "T10A84960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692920, "uuid": "9b7ebc8e-5434-48a1-849a-31d92f749f9b", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692920, "uuid": "796a30a5-eafd-4fe8-8735-8643280ef243", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22v:7vqWQub2lrE0B55FpekPdb/22v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692920, "uuid": "6d91c148-2a3d-49f5-a785-90e1fc6f2da4", "value": 406189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692920, "uuid": "f918dc6d-5cff-4e6d-9dc7-cda052e3efaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692920, "uuid": "7f8319d6-9afc-4f22-ab0d-5d4ab57c13c3", "value": "a187c86b3ec6f53b07cc029407adec6d5cccd93702a356cfe78b952d3e8b9365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ec2e4d-f6ae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712693962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712693962, "uuid": "a3881cbc-4a92-4791-baa2-16ed4dcec3e2", "comment": "Malware payload", "value": "d20a2f488e6b5c20cd8ada381358ce55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712693962, "uuid": "b639d2d6-89d2-4ae5-b6f9-cf4be69b9bca", "comment": "Malware payload", "value": "a1b6543b06333e8b8b6a90122c36e069d369a0742f5203e17c4c45fe5353e764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712693962, "uuid": "9fe2b72c-6866-40c7-aaa4-727168622c57", "comment": "Malware payload", "value": "5cced3a6cb0f9938bcfa6fc60e10a926f06c274a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712693962, "uuid": "1262d06c-c5d7-4d2d-9144-aa72405c3fa2", "comment": "Malware payload", "value": "d6da3372c58dd690363648b06f735a860b8596a018f3f327691863c089e954ee725439e4d177346dbcc3b098ea36c173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712693962, "uuid": "93070775-4b0c-47a7-857f-5b424d58417d", "value": "T1D6E2E74A7BF94129C6BC2AFC8CB313114672E3478532EB6F5CDC88CA4B676D04251AE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712693962, "uuid": "dece3937-6905-49ac-ace1-ac40ef5aa53c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712693962, "uuid": "ea8df30e-1bd8-48f2-b20d-b9385f648c44", "value": "384:V0bUe5XB4e0XWOhaixBr/QHWTUtTUFQqzFxObbs:2T9BuFMifrYrHbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712693962, "uuid": "4f136a8d-c84b-4662-a6fd-1788e2ad49c3", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712693962, "uuid": "75f93f0e-0c65-449b-9f63-0fab4391c15f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712693962, "uuid": "3d3f1488-bec7-4d5e-8068-d06b61f6dc9f", "value": "xTSclvuDdpYo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efcbf80-f660-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660372, "uuid": "97ac0a4c-a37c-4e85-933d-32f63df3f66b", "comment": "Malware payload (Mirai)", "value": "2b74836a25a9e7e8ec5ccf5c54749b96", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660372, "uuid": "41ee351f-d4b1-4704-b9a6-061a14e98ea2", "comment": "Malware payload (Mirai)", "value": "a3b5ccd2f9ff8960f8085ab29e4695acb66d65e43d975f9437919b2826630426", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660372, "uuid": "fa35d1db-62ae-49d4-90f2-49161144b72a", "comment": "Malware payload (Mirai)", "value": "67621f806fc7b82049ac1433e408245dcec2b64f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660372, "uuid": "a0a06f5a-c923-4614-b2b6-25e79d6f4749", "comment": "Malware payload (Mirai)", "value": "24b9b10b1cbe760d4d3adcfd596acaad3274912c684ad4b44244b78c982e1c3421210a6a0619bfc1c19b376eb2f8bd15", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660372, "uuid": "b7159bc7-113a-46fc-b190-b6e68bcbb312", "value": "T11CE2E1F4B368674AE3F8D037382ED5B4C4A9588F73AD199E4D54B8CC5AE504D81B28B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660372, "uuid": "e163cc47-9865-4872-833f-6e8acdd9aa49", "value": "768:MZfZ5WgIwPFBiYWq6z8189rzEtcGrSsdA1QOEI7gqYwfmh0sDz:Mx56UFBi06z8i9rCpSsK+Ox7G53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660372, "uuid": "a3a4bfd3-6724-4a4e-a6a0-c4674315fdca", "value": 34052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660372, "uuid": "4ed33fc7-21cc-4612-adee-985d58a26aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660372, "uuid": "f2f13c2b-c2d7-464b-9cf6-c370778ce5a6", "value": "2b74836a25a9e7e8ec5ccf5c54749b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52da23bd-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678445, "uuid": "60db1e48-f307-4526-8d4d-99233456ea56", "comment": "Malware payload (Mirai)", "value": "e89abbe82934daca0a317a548729afc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678445, "uuid": "6d46181b-005b-4367-883d-8e56c01a2c57", "comment": "Malware payload (Mirai)", "value": "a40603cd2201f9e8243af8290bb41d4c161204a2602d3f3b3936a606dd0c9108", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678445, "uuid": "4639304b-8275-44c2-b1ee-1202e85ee53d", "comment": "Malware payload (Mirai)", "value": "37e80a96750923e8f7152131716790f7ffc5be25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678445, "uuid": "229ba666-aea8-48ef-bf4b-5d41cdfda3e1", "comment": "Malware payload (Mirai)", "value": "770530cf9b9477d3f26ed241b098af27f8f0c25463090686298450b4dad5e532e19a6435509f060d1e02ccb60efcfc21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678445, "uuid": "881e5913-1720-4d0c-b4e6-daf76d63b4f2", "value": "T13DF31946B8819B15C5D251BAFF0E528E33231B78E3DE72029D246F347B8A87B0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678445, "uuid": "a7f66c08-9971-485b-82be-87656f0fac40", "value": "3072:QSIa0GYmhBlUqJtFEpxgX2xXloOaOvQ0FqviEXbHd092okpm:DYmTPFEsXAlXaL/viEXZ09hkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678445, "uuid": "636978af-1525-46eb-98e7-e81c26509c9b", "value": 172380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678445, "uuid": "14839c77-f351-4a28-b55b-50a72621fa60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678445, "uuid": "faf5f6a5-6ff9-4b5f-8e5d-5024b4ef2c57", "value": "e89abbe82934daca0a317a548729afc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6704393e-f695-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712683203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683203, "uuid": "6a2da820-7cf1-4de9-9782-8b7aee7a7a9d", "comment": "Malware payload (Rhadamanthys)", "value": "37df2e853b4a195f4c9af1d6f988d7fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683203, "uuid": "c7ba3511-977c-47f3-a7e2-6ebfbc73e9a0", "comment": "Malware payload (Rhadamanthys)", "value": "a443c5aeabce4b1b544473a6016e240fd8572610ad5cea050b1b3cca122241f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683203, "uuid": "30c6a187-d159-48b3-b44a-5cfe13538c85", "comment": "Malware payload (Rhadamanthys)", "value": "74b984017ad6f287aba483f87cc217bc74ea2457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712683203, "uuid": "8c2ca5ce-a170-400a-94c3-97322b71ab61", "comment": "Malware payload (Rhadamanthys)", "value": "e3d8d2f24118aed25d6a1f90b967bf95f6baf89217144934c52a4e4940f7fd9f6204abeefed0d41f66ab8908c2a988b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683203, "uuid": "ba4395bc-c007-498d-bedf-cf0f7090768c", "value": "T18174BF1FE253B0FCC12BC2344BD7667266B2B45A0370BE2F1194DA352F95C946B5EE28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683203, "uuid": "d6a14bf5-f36c-4863-a0ec-6c7ff008955c", "value": "18fd2ce1df00a7be26265a61ffab0f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683203, "uuid": "23fae13a-5bcd-4dca-9c6e-f00cb6adf296", "value": "6144:Ahuyfs/3y6zgkCggeYa+D1kZkRLROvcsyetnpgvX/KE1VisG:A2LgrgM9Zk+RQvciA/KEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712683203, "uuid": "48cf1f50-275b-4f33-9605-461e97dbe066", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712683203, "uuid": "fe7e0101-91d1-4c00-9e23-6a14338c3d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712683203, "uuid": "c1673918-3d57-43ef-9aba-af9b0f8f78d4", "value": "SecuriteInfo.com.Variant.Tedy.568425.31329.990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078de7e5-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692921, "uuid": "8a765810-21ab-412b-81e9-0589e3accb07", "comment": "Malware payload", "value": "fbb055d2923cf67323729c51ec6a2549", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692921, "uuid": "73f4d393-f6e8-4fc4-b6e5-cb169d52ae07", "comment": "Malware payload", "value": "a45adbe8e8e633e4f89311d5d60927edbf6f0afa3135977d1ae9b199c45ad3c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692921, "uuid": "7e59e060-441f-4b23-91b5-4ed5c2843a44", "comment": "Malware payload", "value": "36d800ebc008ac97c41b2a825820e5a7d5ebd047", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692921, "uuid": "51a28911-d245-486d-be31-a4a9a88b8916", "comment": "Malware payload", "value": "17b5b14df5a0807828236850dcf7b63624bb34242bc31d203b8e393e9fc1bfe92638cb8c44089f47940eb57ea2535933", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692921, "uuid": "1430e92a-6bc3-4f0b-9ba4-a9fdaa059934", "value": "T1E77496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692921, "uuid": "796477bd-2369-42c3-b0f2-bd539a13b3fb", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692921, "uuid": "05e4fbea-e016-497e-bc8d-48342121cd25", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxN:IXdaAqvRwWoe2XjSVvUYuyHWPBsxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692921, "uuid": "dba27247-5094-467c-9616-4bb136267cc5", "value": 348104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692921, "uuid": "cba91c40-d07a-40a1-a4a4-e5544fbb3e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692921, "uuid": "3b5655e1-ad09-463f-a067-e85c02c59bc1", "value": "a45adbe8e8e633e4f89311d5d60927edbf6f0afa3135977d1ae9b199c45ad3c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087d957e-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692923, "uuid": "e912919a-2461-44ee-8a97-730186fd280c", "comment": "Malware payload", "value": "f4a0ae16b8a2876444fb0fd184dc5460", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692923, "uuid": "21f61e41-4ec8-4f45-accc-d4eb32bd23b6", "comment": "Malware payload", "value": "a4f48c5ca0aee2ff443b527da0db994e3ad35decb4b8d5ac2c011f2eef3cf109", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692923, "uuid": "b1df4487-49a3-4a96-99b1-9d50f40960a4", "comment": "Malware payload", "value": "a827a3eac6ec7d3e22743e1931b60fc5036fbe1a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692923, "uuid": "c348ae9b-7205-49f4-ba60-9a6f435141a3", "comment": "Malware payload", "value": "800d0fdd43b719c39dab14b4ebf902a3bfeb9e883c7b51208c58286b3e960701c2f7d523a533493a1d7a2da3420d28b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692923, "uuid": "011fca5b-42f1-4abb-a5a6-bef0fa64448b", "value": "T1E294E913B522A895E11457F66BBA473869BC832038B1CE13EFE4DDB1BD715318B4E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692923, "uuid": "65efd267-c568-454d-8960-8fdf8d869c25", "value": "bab84fd0accd31d5fe97afc63a9ebcad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692923, "uuid": "c83b98de-3f8d-478f-bdfb-2a594bea9713", "value": "6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAy:c4Fm3b7yOAHNar4mUf9lJ82scqAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692923, "uuid": "dd987420-a044-4b98-a89a-9770f393e13f", "value": 442587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692923, "uuid": "e6eea4fd-e6fb-494e-8d6f-770f258fe45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692923, "uuid": "c5524749-dd08-413a-a6f3-8fc6d261a710", "value": "a4f48c5ca0aee2ff443b527da0db994e3ad35decb4b8d5ac2c011f2eef3cf109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b8453c-f662-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712661434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661434, "uuid": "70dfe94d-036c-4930-a0bd-efab4599c956", "comment": "Malware payload (AgentTesla)", "value": "44e65ebae10cb1070f6b81378190f94a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661434, "uuid": "e58e9add-1c54-4a0c-aaf9-135a4cad9b6b", "comment": "Malware payload (AgentTesla)", "value": "a5c7bb0b8ec3d82e733f009e9e2d9d4afe294e331802b913a9cf21f74b515f93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661434, "uuid": "bea687dd-bee8-4a3f-b73b-40fffe2d9560", "comment": "Malware payload (AgentTesla)", "value": "57784664b1f8037008f40a84dce7978a1353f8d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712661434, "uuid": "09c04eab-157f-4242-9c60-bd203809fb40", "comment": "Malware payload (AgentTesla)", "value": "f77b4e498e4f978993a844e5534152641f89e7eca6a6495c01e3f96fec9a1edff2482cc33d3561a73c564bff6affd525", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712661434, "uuid": "7f78ca6e-2a43-48ec-8ecb-3dccb35d3421", "value": "T1E8E42373B2BD0761863235B3EBDA8FA7C996E47E1B93408C58312231A50EFC954467F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712661434, "uuid": "8ff73424-4621-417e-8e21-095fc9869d9c", "value": "12288:Ggo+K8/XVV/IDn8agGyIjPBd6NnGG11qaXRCrLg3uRyS+1GY:Ggo+K8n/ujgMesw1qgR0M3kyhgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712661434, "uuid": "5235d462-334e-4f9d-8aaa-0da3e5a941bd", "value": 691882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712661434, "uuid": "ea579841-05ca-4f48-8496-d90309cb8ada", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712661434, "uuid": "73880c47-8b92-443b-a732-7bb713e3aacb", "value": "shipping.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6c264b-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669844, "uuid": "0b148c95-f63a-412f-87fe-1577beb362fd", "comment": "Malware payload (Gafgyt)", "value": "31ad5ca3fe5258efc846b9585f61b092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669844, "uuid": "74365acb-a0a6-4c37-aa67-75bfb9a3a216", "comment": "Malware payload (Gafgyt)", "value": "a5e1f51fea2315fdaf9119c4f8947924b0f7321207df6e223792eb248e2daf4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669844, "uuid": "e9c5d894-9f8a-4360-9de5-36704c5ed78d", "comment": "Malware payload (Gafgyt)", "value": "3db04c78cdce7c5ac9d15f545b9ff5191ebeb446", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669844, "uuid": "8ffd8124-5453-4f49-bc33-470d92b5fa66", "comment": "Malware payload (Gafgyt)", "value": "2f954362b7adfc8df69429ead8bc3f4e9861fc5ce2fa09c1578c39edafb76f2e3219662cdd9ee43c6f41445901e55954", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669844, "uuid": "b1ceeb80-0207-4d6f-a986-72a732b0ac44", "value": "T19AF34B46EB46C5F3C4830FB212A766560633F93A1A2F9E45F32DADB05F054C8B11AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669844, "uuid": "ba70ec21-e3c0-44ee-aab2-dc5fcf281fe5", "value": "3072:AqUufSidPDf1uIgBtOdxKjkeoXz/m5eL4P/wmqyEs/9jXW:AQWtOdxKjkemz/m5eL4P/wmqyEs/9jXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669844, "uuid": "bdfc986d-59f6-4e45-af34-814640ecd0e0", "value": 168067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669844, "uuid": "2bd6e193-0a23-4529-874b-8fab435fc603", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669844, "uuid": "a3b8f738-50b4-4143-bbfc-bb98af3418f9", "value": "31ad5ca3fe5258efc846b9585f61b092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185ac5f8-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712674051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674051, "uuid": "e3f905c2-0cbc-4bee-ac9a-e5c9c95c13cb", "comment": "Malware payload (AgentTesla)", "value": "44bb11aa1fdb16099f2f8d45ade9370a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674051, "uuid": "8fe89543-d314-4e60-9f3f-d0d17ebd26bb", "comment": "Malware payload (AgentTesla)", "value": "a620dbb1909707627ccec47397507cf155e1860b3c781b421776272e3a1575e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674051, "uuid": "f2048b94-7c64-4ae4-a9b3-3afd1dc93a67", "comment": "Malware payload (AgentTesla)", "value": "a154730d6a56b9b77e5b6dbc21779904188b65b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674051, "uuid": "8105f77a-6270-4d07-9907-f9f5247a8d36", "comment": "Malware payload (AgentTesla)", "value": "5bbd2c40a6fbe2c16cc0f64b5ea44a9111523248825a7b40da08036be27ff9d9fe368bba0c7d6cca27838274ff91e275", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674051, "uuid": "09eedd41-9c8f-4431-9a63-dc01f5b6a344", "value": "T1F7E423078A692E1C5BF401775F0DA321ADFB6984C5C1A880AA0699CAE79D5533F0FFE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674051, "uuid": "5185856c-2143-4fc7-925c-8165e8aeafbc", "value": "12288:ykQACXs3bWFxdwY2DSupazZjS6cSY3Qj2JCekeDDZBQys2i3lJNJ:XQ383ewwug/cSYm2lkev9kJNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674051, "uuid": "72bb93d0-9f3e-4d88-849b-2a69575f889e", "value": 719400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674051, "uuid": "8ff71d40-329e-4c43-a406-c136615d9ea6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674051, "uuid": "a063e013-e4a8-46b4-9acd-855640c6636b", "value": "Revised Quotation_4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb30fc1-f691-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1712681390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712681390, "uuid": "c905f180-05fb-45dc-bf9b-75d74cf3af8f", "comment": "Malware payload (QuasarRAT)", "value": "32f3cadcabd40f0b821adba034ac8fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712681390, "uuid": "6691de3b-c0f7-4c99-9a2f-5fae5f7c2b0a", "comment": "Malware payload (QuasarRAT)", "value": "a681774e83e773eff9e6c4070a78b7fdb2839301ce1955cade51bd95af25abd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712681390, "uuid": "fde2c5d7-86da-46d6-beda-f63d3fad5bc5", "comment": "Malware payload (QuasarRAT)", "value": "75ec24a7b088756120b9c380c6a13d88dbab5bd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712681390, "uuid": "8c24f2c0-9a0a-4e8c-becb-4c381b0ffbd6", "comment": "Malware payload (QuasarRAT)", "value": "7694c98bc319cff719ebe78f430254c49e41a63d7e89d5b4163682cb186831f3f86432376e47458a88c1b38819f88aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712681390, "uuid": "3393588b-d601-469c-84fa-69a8678b7ef8", "value": "T10C747D2377B4DA3BD2FD173AB43206154BB0DA837616E38B5A5C56B96C133868D903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712681390, "uuid": "444a76e9-d4cf-4ab0-a29c-0d4de6766733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712681390, "uuid": "93d6f0cd-bbc9-4504-b1fe-82c12331a1df", "value": "6144:TzNHXf500Mb31d61sQqboCixEkZeg5kEvfmG:Hd50vd0IixDp1vfmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712681390, "uuid": "c9335f1f-d735-49b8-bfd5-cbd5a98d7905", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712681390, "uuid": "d79afe21-5bad-4a8b-a76b-75ed6f9e5bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712681390, "uuid": "7ffc08dd-9b15-4011-a4cd-0a3bae76bbde", "value": "xRmat80DlHcR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ad837e-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694557, "uuid": "0222f09b-2ff6-4427-a458-8b2778f8da28", "comment": "Malware payload (Gafgyt)", "value": "62fc1acbf5f4ef3482b81313dca80391", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694557, "uuid": "a4d373d3-08d8-491a-a251-74e39edae9b1", "comment": "Malware payload (Gafgyt)", "value": "a6bca45be28ab4a8dd8cc11081b7daada4772cbde5faf9a22035afda65b19ff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694557, "uuid": "a5904d2c-8bc7-4e54-88e6-dd92aeba5808", "comment": "Malware payload (Gafgyt)", "value": "58506026d38c749023169a8a15a674b339b14efe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694557, "uuid": "66e0d52c-415f-455d-973d-6df9887520b0", "comment": "Malware payload (Gafgyt)", "value": "6f5baee1e7f6a18c6e44960d774618e98b32ba381fc488d021c31ae89b1d6672dd5b0f818f07ba9ce8815be9aee0312f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694557, "uuid": "f35c8404-6fcd-4fb7-bc80-a88454550065", "value": "T1E8B31792F900DFF6F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694557, "uuid": "e98548c0-e740-47d6-ac82-dfa59bfdecfc", "value": "3072:DG+3MNBCpCTyRQpimmrytKHs4OWlKhRm2pgYMx3IPtW:DHCTyRQuytiseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694557, "uuid": "caac4831-e746-43bb-8cca-e962446d536b", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694557, "uuid": "460543cc-e9b4-425c-821a-fd90bc29c2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694557, "uuid": "dba6b394-3028-4b31-a6ce-ccac563081c9", "value": "62fc1acbf5f4ef3482b81313dca80391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac0eee2-f69c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712686055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686055, "uuid": "b77c73fb-33af-48e6-b4eb-8727198197cc", "comment": "Malware payload (Mirai)", "value": "7f04238a063016a546bb8fba8e9c7202", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686055, "uuid": "cf27b0d6-5a1d-43d3-b1d7-918492c8b6d3", "comment": "Malware payload (Mirai)", "value": "a6fa3694cfc453be468b29707f7269e40d64d46c3e6cca0af5c6b717ff5db0b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686055, "uuid": "7f1f0059-fba6-4138-9367-fb0d3fe3a94f", "comment": "Malware payload (Mirai)", "value": "128b2f8c78c2e1d2afcbd6d24fcafb9e5cb176da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686055, "uuid": "df52ed82-4a36-4816-800c-136a4acbc4de", "comment": "Malware payload (Mirai)", "value": "d77f5b09fb15dbb8f81a4e86c82a14cd3c31f941dd1460c14592e8c017604246890e2843c0d563225f77070d9f6b0ace", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686055, "uuid": "ebab8363-4d25-400d-b5c5-84d3511b2ce2", "value": "T15543F25C9A282E8DEFEB9F3068B279E237C93AD5E71186852062B303150E63E750DDC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686055, "uuid": "0a045eec-a969-4c80-95ce-b59adf0e0ed4", "value": "1536:0lrkpyfsAyfKHydRS8cqttV4ZLKXaWiezH/NVMFcw4u+qgw09N:06pesAyVdRS8cqtb4ZMpzHXw4u+qgwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712686055, "uuid": "73cb5d1f-4944-4ec9-9284-c57cb65c7c64", "value": 59888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712686055, "uuid": "74304330-c75a-4396-b277-623a194249d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686055, "uuid": "05c674bd-2052-4dac-8e2a-fe324a06745a", "value": "7f04238a063016a546bb8fba8e9c7202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd1cc52-f654-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712655220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655220, "uuid": "a9328630-c0a8-4b12-a53a-ae6a983a1d6f", "comment": "Malware payload (AgentTesla)", "value": "cf01ce1ff2fb9e63152aa5b29fa4de07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655220, "uuid": "3f7de3e5-e2b0-4a5c-8fb2-047f890368cf", "comment": "Malware payload (AgentTesla)", "value": "a84e1b819b349474639fdedd97713f46afadae4203fb17f98954a1471cccfb74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655220, "uuid": "c40412c4-8dd1-4b0d-ba68-3e50131ab158", "comment": "Malware payload (AgentTesla)", "value": "8c8f3f28043444be20d90a557a5d1946d444b47a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655220, "uuid": "421faffc-4d34-4fb2-911c-6757190b0bfd", "comment": "Malware payload (AgentTesla)", "value": "a5176d9b6691c2620d28ebde3c3bc92286bca42a17c84d3aded00a537a8422ba1cbba744b863a2831edf721f80ab01c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655220, "uuid": "5afafdd3-f2c9-49aa-a33e-6f18edacb7bd", "value": "T123F4231123CC9D3ADABC4372842424681BF2A7E6B9E5EF650EDE20CB2953351CF67167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655220, "uuid": "9d14615a-8b95-43f6-a886-b8b8ed201f92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655220, "uuid": "5c38106e-dae4-421e-b70c-95a404fba1be", "value": "12288:A0yjyUZpkkfMkfWFmHX4zcf7LzvRSOt5ybDl7jWE71vJXzjWvvR:kpvMkbVf3z5SOtKDlvl7/DjWvvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712655220, "uuid": "cbaad293-8138-46b2-af49-b4f8c0ff8118", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712655220, "uuid": "523cb8a9-4a0b-41c1-809c-c6797053c05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655220, "uuid": "b71eb688-c6a7-4041-af27-05b4d48213ea", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095dbabf-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692924, "uuid": "b19190a7-c98e-45b6-a0f3-f4a6e27d93d7", "comment": "Malware payload", "value": "c8dbc5edb975be168eccfa148c702a2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692924, "uuid": "e3a0fcfa-6f82-4397-a097-a0b50a40f306", "comment": "Malware payload", "value": "a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692924, "uuid": "065c67df-f287-4cb9-ae26-f9f8bd1d507a", "comment": "Malware payload", "value": "9b8f83fea5b262b5254b77af4d2031e6ab7cc36c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692924, "uuid": "62859b1c-dc00-420f-a9b1-0e9e0c2eae78", "comment": "Malware payload", "value": "aee8a0c64c778861c81c7f2feb1da194969c3180ddc79deb21860cf8b2a418e45e4c619351751329dd915a3fe76b215d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692924, "uuid": "63ab7719-9ad4-426f-8469-a893715be4a8", "value": "T148749F22F4D0C8F3D26611310DB25B3AE2F5ED3019728A13E7D8FF697E789568A1B146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692924, "uuid": "3748e21b-4df3-4abc-86e5-7a4e6691f495", "value": "80b69be2bc873884492028ff7ce272ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692924, "uuid": "7c9e1d93-ab5f-4026-87fa-452699a97fb4", "value": "3072:JodLe4TZUfOFp17Sm0vizvH1F6HoUjp1vUrqtMluGgcJQDoY8z3YuzNw9U4vE:Jb4S+1MvyrnUkqtOJQDoYgNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692924, "uuid": "75db758d-e18b-4dac-8a12-4872e986a523", "value": 357409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692924, "uuid": "7a1cdc04-6443-4d90-b495-e7e99af90b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692924, "uuid": "cb56bc43-ce48-41a4-9e86-103d9a0c1639", "value": "a8bcfd5e5b43db8214a9ea482b172479415e6a32dc7861087e3dfb15b1e73ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fe4aeb-f6a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712688486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688486, "uuid": "326b41ac-ca53-4b06-9d21-4f52340e9a51", "comment": "Malware payload", "value": "69609842ef39ea0615b42d2b9148d3ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688486, "uuid": "7e08f751-db08-41c4-8a16-c4b925e313de", "comment": "Malware payload", "value": "a975f370529efcd72c1a73539a307460c9085b7f7885332582f41708fdabbe88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688486, "uuid": "3cb11e4a-b58b-434e-823d-f318f8127540", "comment": "Malware payload", "value": "3107f7f209323673042b59637da48b9ce095a164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688486, "uuid": "3e6b1565-92f7-4d09-b2c7-2333397e141b", "comment": "Malware payload", "value": "81239454994935ec6c87671400d96c5213eb823bf65dd259f5693c36446645e97afc74424cd619b5988570ee959ae616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688486, "uuid": "e0056e89-3556-4ba8-bd50-b043a199d300", "value": "T19D7533BEE157516267E5B77E3031BD0A2E133278F2DB42C962F582C8747D2B191886BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688486, "uuid": "d4282446-206a-4c65-954d-d36e1e3c783d", "value": "49152:GtStMEVe1oOzGPAk4swkjsr0+ZUSnTeAp:Gs+orAkrwP0+qAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712688486, "uuid": "df37eb09-fb16-4e53-9f87-b09bdc58749e", "value": 1672240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712688486, "uuid": "cbbfb171-74f5-4a45-a397-be2a50793038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688486, "uuid": "8ff60dc3-f183-4032-8db0-f5783adf63d7", "value": "SecuriteInfo.com.ELF.Agent-CRQ.16198.6901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a945239d-f633-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712641223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641223, "uuid": "c1b57136-df8f-464c-bcf9-e02f0adde7cd", "comment": "Malware payload (GuLoader)", "value": "13f571f49b079dacb9ff45c9cc87dedc", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641223, "uuid": "0db96ed6-6df1-4e95-82f6-d7ef01667166", "comment": "Malware payload (GuLoader)", "value": "a9b0140c718aaa6edae7a55df710303f573f9f0f0efd1fae07a758609a0e418a", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641223, "uuid": "13bdeb15-005e-4a1f-b52b-6bfa7ac4ad63", "comment": "Malware payload (GuLoader)", "value": "6751673e838e97422ca1500a4ea81a956e6fd83f", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712641223, "uuid": "6381d5c1-ac78-422a-a92a-35809f18a6dc", "comment": "Malware payload (GuLoader)", "value": "7edfa555b9f9c8affd907c2899b52557e03c1e1eb51cd809c6bf4ecaf735b06e67fe2b5892047c2a29b38305c0d5d626", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712641223, "uuid": "cc6df850-4eb5-47b2-a3b2-86efc31e0e5d", "value": "T18DB312CBB98C3512597E0497A527F15DECB4D9A6CDC0FA16E1B8104C22179FE7C88A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712641223, "uuid": "cee053f2-0ba3-46c7-b589-7cedaa40c61f", "value": "3072:FanKY3SGFufH3bbFjPaSFnPXsjTbYNg1hbW:FaKMSGFufH3N1PcjXYehbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712641223, "uuid": "29acb2c1-734e-4aa0-b1c5-5f3d1005e3eb", "value": 116306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712641223, "uuid": "1634688a-4222-4da9-842a-b6c5525c8b63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712641223, "uuid": "1caaba89-5463-4195-bf84-e2c6e76f5926", "value": "FACT AZUR TJ.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3245e129-f68b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678819, "uuid": "9320dc84-155f-4dc7-b1b2-849332e05faf", "comment": "Malware payload (Mirai)", "value": "09f64683f1f71d38acf3aad840e5f1c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678819, "uuid": "737c0729-4c0c-4bd6-9642-cc3ad586677c", "comment": "Malware payload (Mirai)", "value": "a9c21da4999b4f327ee1d23852825ba3494a5f25918469e6aaaf9cbb008be233", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678819, "uuid": "0f0d89d9-1d56-4452-b3fd-8098ec5f31da", "comment": "Malware payload (Mirai)", "value": "4cd4cd982797df1f5ab4bf7690f136f4f7a28e68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678819, "uuid": "18ccfc4d-59be-46dd-b16f-d22e06dcf382", "comment": "Malware payload (Mirai)", "value": "28c00c5285e7a70f437c2de850841dc911eaef2b9074c62efc4c3d20046ff48849ef879acb696fe9e5cd7bdcbbf74c06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678819, "uuid": "29587621-b056-419a-8ab5-157be5bbcfba", "value": "T195735B21A97D2F07C0F4E47E22F78765B2E1274E39A4C65E7D620E8EFF2265066531B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678819, "uuid": "f096be1e-9099-4e8e-b5f8-7dac2b169d48", "value": "1536:9q6v0mwflpO7yG5y9pMWSv43Wqz8TOtCm:E12dv4X+0Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678819, "uuid": "ae8704b9-3d08-4b28-be44-7f1186d97b8c", "value": 79432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678819, "uuid": "bd48c737-bd33-47af-a8bc-874afab60fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678819, "uuid": "0490356d-e752-4f5c-ac60-f4616778ed25", "value": "09f64683f1f71d38acf3aad840e5f1c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a0a6fe-f645-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712648712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712648712, "uuid": "b9c0838e-4221-467a-9552-d756e76a2006", "comment": "Malware payload (RemcosRAT)", "value": "4cb03ed07925c43468569974c41b9325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712648712, "uuid": "3e35f89e-109f-44ef-a20b-5f522a68038a", "comment": "Malware payload (RemcosRAT)", "value": "aa29ab3beabcfd1b574182cbcb4d53330ed432fe371a39c38ef59a7b681361d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712648712, "uuid": "2ff8a033-9761-45f9-8024-8aea7542fb87", "comment": "Malware payload (RemcosRAT)", "value": "523e9b075323ae50036bf19b7f2e9615f97100d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712648712, "uuid": "e9699e90-0003-4c4b-8600-318aad115adc", "comment": "Malware payload (RemcosRAT)", "value": "c388028b89681b81a2eb758596425b192ac798e4434884ffe9bd9a81b4f4adc65389df303551ab2c2d45363023f3d732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712648712, "uuid": "8917eb65-79aa-4e40-95b3-19ebc38212c8", "value": "T1CB252312B6F89E56D0FC5EF088351247837272A90236CBBA3EDE34D959C2757A913E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712648712, "uuid": "f9cafd5e-1743-4271-b45d-9608b7f34dcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712648712, "uuid": "4218b394-f235-42f2-ad25-71351c101da3", "value": "24576:0o5K55ee/YuX1Gx7MH7V9mu/0ilqWe7LpjCSAv:V5qauX1s7Mh4u/0ilq7LXAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712648712, "uuid": "25e5a920-4599-407e-abe2-3f5653005f6f", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712648712, "uuid": "312bc9b6-c6ab-4c9f-87d4-e669066a23df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712648712, "uuid": "1b0f111f-eaea-4737-8154-06826a1de9b0", "value": "PO#4600055745.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a600b89-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692926, "uuid": "b722460b-d923-4a42-941b-72dfe42bfa20", "comment": "Malware payload", "value": "d046a42c03cd76fe7ea9552e23a6592e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692926, "uuid": "be8d35c9-47cf-4868-8872-79c3e566e85e", "comment": "Malware payload", "value": "aa7dd8de027bf593b6d5ef48755c9592e8c588dc62a75dd3c8369080aa91cafd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692926, "uuid": "31eccd9f-fa6d-4cf8-b8ae-f96ed8f0f76c", "comment": "Malware payload", "value": "ce90e5e2b5a47b6ea4dae38c248e659498317f1f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692926, "uuid": "2ec3cfdf-00c3-4974-bb55-5d7898f58a64", "comment": "Malware payload", "value": "ad6486fc8c3921a0d6d24a6cd2dc05ca66bb83cf9b4a29bec6ce81eddf65216fa9187466463a1520bb843277c9420f20", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692926, "uuid": "b5202065-ed9b-4718-a5fd-b4d7c420c958", "value": "T1C7B4E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692926, "uuid": "556fbb4e-66d6-4628-b234-859d96ae991f", "value": "6144:6cHpJfHElepVuWwP5YcQfg8J+oj4NJ+S:6ifk0GPacQfxjQJ+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692926, "uuid": "4c06237d-38fb-4526-9dcc-81e12e3d06a6", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692926, "uuid": "a5cd38f5-a5b4-4f2b-8803-ac566e5e85f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692926, "uuid": "e6e0d7af-5d1c-4666-87da-2daed64eadd9", "value": "aa7dd8de027bf593b6d5ef48755c9592e8c588dc62a75dd3c8369080aa91cafd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562230d8-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678021, "uuid": "86d2536d-c74b-4ae7-a027-57a167cf2bde", "comment": "Malware payload (Mirai)", "value": "6eb13a9261f7ce6a404790dac5952601", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678021, "uuid": "bc6ac2ef-4035-4261-a4ee-f1075063cc4a", "comment": "Malware payload (Mirai)", "value": "ac76bd907867f086264cc318e70ae3b450ffe8dc161043bf048b7cf733e133ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678021, "uuid": "d5308c0d-fa53-4840-b071-32bc176fd377", "comment": "Malware payload (Mirai)", "value": "00a72a23f8a27c932eb2f0663a466b1133f16931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678021, "uuid": "448e7b5a-9d73-4ead-9bb7-ed2b80b39d5f", "comment": "Malware payload (Mirai)", "value": "61b311dc27583701edcc25cca5c9a3be5a2ab28febb609ca1c7133d2e2af95e380e8d2e478d4b3c0dc89b7f3a8ff0f7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678021, "uuid": "d8f64dc1-7a4f-44dc-872e-c94bb4426316", "value": "T16E332B42323C0E5FC5B35670253F96E083FBA96534E4BA88255F9B668A35D3B1089FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678021, "uuid": "4746702e-948b-4576-8bcd-3b484d8289d1", "value": "768:lMn8HKGGU7R5Y0SRRf/RH8T1vsmqzmiMRty0sG2usMmdTBof4X4t:L7mjaT1kmoI9pmdTwym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678021, "uuid": "281e1042-4902-47fe-87da-f9fabab681a8", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678021, "uuid": "12e50d9c-aa4d-4631-af44-fde45fd8329b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678021, "uuid": "5ee300d8-e540-4daa-b914-be74faab4c02", "value": "6eb13a9261f7ce6a404790dac5952601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3f022a-f6c0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712701704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701704, "uuid": "ba7d8dd2-ea0c-45a6-a193-d8303429aabc", "comment": "Malware payload", "value": "57fcf21a3be1201c6d7618c98bb10c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701704, "uuid": "b26ece86-eef6-404d-9f09-908940992723", "comment": "Malware payload", "value": "aca0d72c8c514299ad844013ca5874943e29b25e5c53e28f54bb4840bd0bd503", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701704, "uuid": "8550b528-e2fc-4c9a-bd56-dc63cc5a40b5", "comment": "Malware payload", "value": "54dafdaf29b550792daac1538c3e0a1a6d616869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712701704, "uuid": "b2318118-4b81-4687-9f04-13933427ee6c", "comment": "Malware payload", "value": "1e5cee2d5930f8295900da69a4fe0b1829bc40f3b47bb58038a8ea90028a97337e1f6535442d0a4609308c57686434bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712701704, "uuid": "1cfadf9f-eacb-4bfd-9ed6-2abd319953e9", "value": "T1A88533F01A10974839C1E17DEDA21DEADAE9D458FD8A87DF0F900AA2B3395B7CE74011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712701704, "uuid": "06db10e9-6cb5-4345-aee7-2944aa8e62b6", "value": "24576:n9dGzPu4IEQztcuQuDEQtoqnPJ75I5OoJUrN+exj3NHhY0vUEOiPQe1044RQOcc:n9oqZEateABtI1e0s3NB6hU1ttOcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712701704, "uuid": "a70b6b74-4fa5-4191-ba20-34ab3d2d2e3f", "value": 1707116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712701704, "uuid": "a0f75a9c-2aa2-4b86-a647-2de8639ace4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712701704, "uuid": "0a3619d1-6e78-4b0b-80c3-2c230bb13005", "value": "SecuriteInfo.com.Linux.Trojan.Agent.XFO390.18623.32161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252af5a0-f612-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712626828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626828, "uuid": "9a1007c2-e97b-4f91-88a1-c9959f4eb49a", "comment": "Malware payload (njrat)", "value": "79dbdf892cae743dec344055bfde6d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626828, "uuid": "766f129d-0a85-438a-9d7e-3c7caf6b49f2", "comment": "Malware payload (njrat)", "value": "aca777666d3337112af776a4541fa1b8366546e3078f857ffd41e91f40241f7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626828, "uuid": "5adc04cc-4f37-45f9-950f-9c8c4174bd95", "comment": "Malware payload (njrat)", "value": "0cc36ec9d2b26b436ec9fc2245770e7ae575f065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712626828, "uuid": "2d5137f1-41ee-400b-986e-6adba38ccd94", "comment": "Malware payload (njrat)", "value": "69049c4b21466425c633d7efc020a6b03ed2d0be19deea30f6658604236fc436e3150459d5406a585969563f3a2d5c1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626828, "uuid": "08d2099d-3d1d-40a8-9aac-6b6b27a90b24", "value": "T1F9B30D387D952133C67AC1F689E50A8BEB69223F3191E8ED4CA752C418B2F156EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626828, "uuid": "ebb9a583-abc9-49a2-88f3-d3d4f294093d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626828, "uuid": "390d176f-1ef4-4413-ac23-2ce0aa27eefd", "value": "1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMb:P5eznsjsguGDFqGZ2rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712626828, "uuid": "b6697536-04b6-4745-a272-1b2b89ce1510", "value": 115552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712626828, "uuid": "b5c02616-2ed7-4efe-b1cd-e0081c6d1543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712626828, "uuid": "06e8e89a-089c-4ded-b1c8-94ab3877c4d1", "value": "79DBDF892CAE743DEC344055BFDE6D68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc37fd3-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692928, "uuid": "91610352-9d33-404f-ac85-c0cb7e59f6b3", "comment": "Malware payload (Blackmoon)", "value": "271091e0cb49c43702eea7d6bd4f1959", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692928, "uuid": "702b3c65-bb9e-4677-9af6-49a4761cb468", "comment": "Malware payload (Blackmoon)", "value": "acaff25c119866e51849c5acc37e3fdf47a86b96f6ef2b7c53f5445bc7c55f6d", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692928, "uuid": "006746ff-0a2b-4d1e-8bff-a2ad2b8bf0c3", "comment": "Malware payload (Blackmoon)", "value": "e2df9136eafc0c67dfaeac8a1799e9ee92e8878f", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692928, "uuid": "4501ceab-1f99-40a0-a957-312e5f62b777", "comment": "Malware payload (Blackmoon)", "value": "41129e52437b289721a7e6bafaefa6d2152609e4a62b21e416bfaa35f77d352f6019202d21217b88d86bdf783c214c42", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692928, "uuid": "bb63106d-754f-427b-aa1c-4d05a003efe9", "value": "T145455C12F6A48671D073C175C9E2D75AEE7274861B3086CB728DA76C2F737E18636322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692928, "uuid": "b29aed10-e3cb-4959-b7c3-570b5540bd7c", "value": "0ee1aaccebd666cd5f3cceb5c195eece", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692928, "uuid": "bd38f9f9-1bac-4dd8-bb08-6d58e83f5190", "value": "24576:YWw1Z3jc1VCr3t2JKEaB0YZN5jcAkSYqyEXbByW:/wnzcErdabs3ZjpYq3bYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692928, "uuid": "158d24d6-e5d7-48ea-866a-416018d7970d", "value": 1234522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692928, "uuid": "77270551-636f-4535-8a2a-7292447f5cca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692928, "uuid": "1254b5f5-7059-4f8e-ba71-4f6d784f8199", "value": "acaff25c119866e51849c5acc37e3fdf47a86b96f6ef2b7c53f5445bc7c55f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37d2b91-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694552, "uuid": "51560c0f-2b56-4ce9-9bcf-1bce17b9ce3a", "comment": "Malware payload (Gafgyt)", "value": "3c4a18df3637d2d384404070c4775f33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694552, "uuid": "99cd6639-fad0-468d-ac20-4ef7e48feed1", "comment": "Malware payload (Gafgyt)", "value": "acba78cf5c7b138be73100e17b7dcc53eafe6a7e07d6f8194ab6619ce8caf70c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694552, "uuid": "f1856453-cda4-459a-bb59-6caded6ef3cb", "comment": "Malware payload (Gafgyt)", "value": "9c298a87d792f9b9fb2a0ebcdb467175087bfcff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694552, "uuid": "f9ac02cd-d7c2-4e23-96dd-0beffe2ed5b3", "comment": "Malware payload (Gafgyt)", "value": "d4b1095708190be7e5885ed869482e321d4362b8373294b381ca4a853ad7b7e3b67b5f298943116e083d1ec1ab42eb83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694552, "uuid": "aa75e72a-c99d-48c4-ae76-80997d0a93e3", "value": "T112E3A47AA7656EBBD80ECE33059A4911188CD14B92E83F6BB2B4C52CE74F84F59D3D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694552, "uuid": "7de1234c-b195-4201-b7ff-4469ae37e6a0", "value": "1536:wy/01JHeTF9+FSQX5MjUZ+KXsyI8Yh5cDIQ619Yyse6PUmkf0IFv18fUTvEnQ:+Jf5oUdHseGuyBmUmk8IFv18KvEnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694552, "uuid": "7d6a1837-1890-4b92-9a21-21ccfd35a930", "value": 143239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694552, "uuid": "6e5a21af-08c7-4cee-99f9-e666c09c39ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694552, "uuid": "7bb4a4f4-f793-4f10-827f-1b1411ffcc56", "value": "3c4a18df3637d2d384404070c4775f33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4764ed6e-f67b-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712671983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671983, "uuid": "14258c24-8e4a-4ac0-9611-1d35228e08a8", "comment": "Malware payload (Kaiji)", "value": "9418e9cd5ea5ccf1f09ebf7056ae4335", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671983, "uuid": "12ea5cea-943d-4c6c-acb8-e29c2dc61662", "comment": "Malware payload (Kaiji)", "value": "ae74f1aac971b8b8838e50f4066c2bfbb67fa16ffa66d946a71432ee5498f6db", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671983, "uuid": "428bb8f0-299a-485e-92d4-48d600f21cc9", "comment": "Malware payload (Kaiji)", "value": "245b0997fb79f0b76ea979e1bb32c3c7bf66c1db", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712671983, "uuid": "1f72ccd0-5b06-4afd-9619-48fb73961def", "comment": "Malware payload (Kaiji)", "value": "6c1899178f9b53842d04e0d94c54608181fd447b3720ba9858263a1df1198c67e37a186ea4da8527eb5d559feb87575f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671983, "uuid": "27c731b2-9f27-4601-8619-e00487611eab", "value": "T1C6463903F85195E8D1AAD130CA6282A2BB717C895B3023E33F55F7B82F72BD45A79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671983, "uuid": "923e0c89-9ad3-4398-bbf1-f4b28403b014", "value": "49152:36YAazFaGdD95S9rb/T0vO90d7HjmAFd4A64nsfJSNi2nYr3miNAbBlrqlTMcN7U:ldvpJYrjAxENL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712671983, "uuid": "d96dccf6-8fec-495c-8a6b-a46e1578d8dc", "value": 5398528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712671983, "uuid": "4f11e61b-f219-479f-b29a-0fa7e877a710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712671983, "uuid": "b7695830-2869-45e2-906a-ebd2888419a3", "value": "9418e9cd5ea5ccf1f09ebf7056ae4335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1dfeeb-f650-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712653764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653764, "uuid": "cca9ffcb-0141-436d-85e0-5cb2f3e81b85", "comment": "Malware payload (RemcosRAT)", "value": "c5e1a421d9e99c5cae9400b9cd38a06b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653764, "uuid": "d266064f-56d4-45b8-aabb-23dabf5c3de8", "comment": "Malware payload (RemcosRAT)", "value": "aeee6a9e26b4d62ec9258b1b2d30aea108deefc6001c54fbb6704c1d72010eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653764, "uuid": "799c5dc4-0564-4686-90c8-41e3fe2d994a", "comment": "Malware payload (RemcosRAT)", "value": "2c245784d3dee4e5a53432c46ba081e6f88a7b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653764, "uuid": "fd14590c-2908-4ff1-b6d0-0dd015e1452b", "comment": "Malware payload (RemcosRAT)", "value": "8b302d506414a4f5d60c37841e99b41ef5bda4cd2306ac2149096d4662650f49caf1cb14e4a3edb1a260e0048258a349", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653764, "uuid": "ab8a3edf-3273-4d5e-a228-69ef08ffb595", "value": "T12D65CF6AE3E15831F032C279ECDA8B9C591EBD623A15AC0F2FE51D7C1A37382665414F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653764, "uuid": "f4b7cf71-51df-4680-b6d5-463d6b1b291a", "value": "12db9276f755d9008f0f70a1a1e78326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653764, "uuid": "bcc51032-3040-4f9d-a2be-38f52fd79bbf", "value": "24576:H17iEW02Eq8SzySmi5c3QBLeAVvu+lsVGXZuuuwxqEBQ:HJimicARtVvu+GVMZuMxqEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712653764, "uuid": "47e700ab-5925-4fe9-9458-712c4b6d202e", "value": 1479168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712653764, "uuid": "c96f49f9-ec6b-4b52-825c-dcab79b254bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653764, "uuid": "b7ce8921-24ec-4b78-ae2b-f3e426cdd0ee", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce0ea50-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692930, "uuid": "26ec1ca5-c3c6-4a27-b94b-50e23bda6ca5", "comment": "Malware payload", "value": "73a5c1c045e570e353f2931fd330cd7f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692930, "uuid": "2bf8c063-2a96-4316-9aa2-c36b82944ba0", "comment": "Malware payload", "value": "b070a36ee26749889761ff4330c8dbe801c2d6b460a6017dde8a542be478b457", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692930, "uuid": "aabb9b9a-8da4-45a9-80aa-1ff787864343", "comment": "Malware payload", "value": "f4c3b3a20dfc4c4920d39fb9416d63d53f3afe76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692930, "uuid": "7683f901-d1ea-4e70-b4cc-9652613a3e06", "comment": "Malware payload", "value": "96a1f38f34827dd8731c76b7bb0b8442d9d847af9c840fa04e299c08316227001115df858e4c9a7576e513f0cc1759ba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692930, "uuid": "9beb80c3-5ca8-4cff-90e3-cc5a1f2590d8", "value": "T19DB4C813B522E495E11457F66BFA073869B8836438B1CD13EFE4CDB2BDB15318B1A60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692930, "uuid": "301135c9-beb6-4242-b8de-3f194ff180bb", "value": "6144:qwGdR+Yk/N8duBmG6t+UnRsRCQ/OJ//Yr7eC:qwoR+Y4NSG6oUnRsdOJ/Ar7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692930, "uuid": "003832c8-cffa-4830-916d-a9127b2b7f45", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692930, "uuid": "db701ca9-8151-4950-85d0-e22fbe28b437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692930, "uuid": "f5f9230e-ac28-476d-8ae1-33a1dda84c0a", "value": "b070a36ee26749889761ff4330c8dbe801c2d6b460a6017dde8a542be478b457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3799d02-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669560, "uuid": "2f02d196-d7d9-4720-9b64-1d78e1f09cff", "comment": "Malware payload (Gafgyt)", "value": "fe04e9a1b88d698cc7d24557b4bc60f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669560, "uuid": "692662cd-fcbc-41a8-8eb3-5d41438616d1", "comment": "Malware payload (Gafgyt)", "value": "b109828fb611760a98ef832dc29af02a2a0f72c7330d3ead072ba85a4a49b418", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669560, "uuid": "1b505b2a-51b4-4229-b995-977be341d69b", "comment": "Malware payload (Gafgyt)", "value": "21409ce29990a565d71ca0b05fc1b105a0cfc491", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669560, "uuid": "9f6ab8ae-322f-4faa-83c8-1a749aadb9c0", "comment": "Malware payload (Gafgyt)", "value": "6761481ab348965c1089f4e92e0a875ad9cec779d4616c857b66c9592fa1e6afda6330e5c6a5eb0239d5e92faaf667e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669560, "uuid": "8f23e875-942e-4433-aa80-61b86a041e50", "value": "T11AF34A46A652C5F3D1830EB212A75B220633E57A1B5F9E45F33DACB05E544C8F22AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669560, "uuid": "f4ac5fd7-413d-41ad-ba77-54d2f2e2b129", "value": "3072:TEzmiUhUufJz1zdvamnZMkx+ku6qam5eL4P/wmqyEs/9jXW:piAf55ykUZnam5eL4P/wmqyEs/9jXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669560, "uuid": "6f24c5f7-01c9-48c0-9cef-0c48d7d39c9f", "value": 165763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669560, "uuid": "5086f015-73b8-4ecd-b8c2-7215828d2bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669560, "uuid": "2433a0c0-2f61-424f-8f79-7c6cf0cea0d9", "value": "fe04e9a1b88d698cc7d24557b4bc60f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd3107f-f67f-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712673983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712673983, "uuid": "f14db004-1571-4a70-9280-6c3237534067", "comment": "Malware payload (Formbook)", "value": "cdf180d8a6c9ac1ac2d247193eaf0333", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712673983, "uuid": "0dcb3886-21a5-4bf0-acb3-8e93d3846315", "comment": "Malware payload (Formbook)", "value": "b13c8502eaad93a142b184001134c0549d1b024b7bfe70271a53544ff1758041", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712673983, "uuid": "c3ddafef-7509-4553-958c-f6a78941d6c4", "comment": "Malware payload (Formbook)", "value": "6ef6b02bd3d13b7bdde78cb8be41dd7bec4fdd7c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712673983, "uuid": "4fd28cc6-bca7-4112-92de-715124b551fe", "comment": "Malware payload (Formbook)", "value": "d67d055c599c442bd9242262dd049b08419c2eca75695c7bd09994006ada8872e5ce631b82594bf610c8c0081f226cd2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712673983, "uuid": "9e814e80-6cb3-4e28-a777-4c83ca6e6b8c", "value": "T199E433CC5B7567E4A148E896F4B7341C717AC0F6CC438E66382E9B221F2587F6A99307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712673983, "uuid": "5ef02f59-ecac-442d-ba3d-587884766ab7", "value": "12288:35dotgCx/1kvY0APWOkBLNOR+P3GlEzCnEet7aHL4C/UqQbZEdyavG:3ctgCxth0AeZdYR+PGlEzCnEIaL/ibZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712673983, "uuid": "53253949-b9be-4c5e-aea4-8d6a3067c0e5", "value": 697501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712673983, "uuid": "5724b5bf-0afd-4fdb-b8ff-2b2995f87c29", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712673983, "uuid": "f009cb22-87f7-42cf-9db8-60cc314fd2bd", "value": "POVNL-OMAN-2024-8-4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8876600c-f638-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712643316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643316, "uuid": "c429da70-ba0f-4233-90e7-84db15069dc0", "comment": "Malware payload", "value": "959db6fb58d86b24436a5228fdf1cd01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643316, "uuid": "38c15ce6-4270-46b9-bd70-3fcaf0b935e5", "comment": "Malware payload", "value": "b39e67fdff8dad1a8f64c0d2a01e312cdecd3d64bbedd842b01216cb09f22c65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643316, "uuid": "bf620129-9339-4494-a629-fdf7c4d3c6b8", "comment": "Malware payload", "value": "fcbcb37c41b3da1c72959bd5bb234217dbdb33fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643316, "uuid": "a0a69001-50c6-426b-8178-a98b5e5f73e5", "comment": "Malware payload", "value": "783cc991d35f85cea4737984d305907a8406044cd8c1ce9fa2592a8c1686ee9c9505deef9d69d4c1323a15c396a40395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643316, "uuid": "26e9c58b-5224-4aee-999b-4216d8983941", "value": "T12AF30245A7CC2227F9BE0E31BDF78D921473F825AB1AC91E8895403C4E70699E961F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643316, "uuid": "747d305f-1fff-43a0-834d-49a4046fadd5", "value": "eb3adbfdfdb25911eaec8fef643f639b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643316, "uuid": "f9d27700-1c34-4d1a-a20a-e4fdfe640f6a", "value": "3072:UQpsjxl96J7HsLvbh4insM3eR7Tbt1iQriHdvp7tl2kUBpxYgw:UQpsjB6JQLvfsMuhPtW9vpxl2vrxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712643316, "uuid": "d554d3f9-960d-4888-a109-c386e5dbe490", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712643316, "uuid": "95b8dbca-feb7-4b38-bc52-e89086d3eb64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643316, "uuid": "d145377f-80c8-4f12-bd22-fd564f6ba875", "value": "959db6fb58d86b24436a5228fdf1cd01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e820474-f6b7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712697738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697738, "uuid": "6819035f-bd52-4024-8304-d3e1a6a9ceae", "comment": "Malware payload", "value": "294fce8ddb8e0b3e82c4a632458be8e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697738, "uuid": "f85ba63a-5f78-437d-97ac-edfa8f50e14b", "comment": "Malware payload", "value": "b49f2f88286a66cfe96427df8f01777fb3a47bf9a26b02160fb115c9641a75b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697738, "uuid": "d0f8d0ee-7b1f-4ec8-8cbf-fd9f0420d5b9", "comment": "Malware payload", "value": "85d75c2a986c3cb114f0f3469e0393920c9ee22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697738, "uuid": "7e52f03b-3eb3-4992-a048-30084b96eb80", "comment": "Malware payload", "value": "e59fcfec7a830cb62745889df3900a4785daafa222859cd1b0d880c71de6ff6a74e9d0be8319156ef0570eed71417e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697738, "uuid": "702ce216-a196-4a47-ada7-d2f084d8eb6a", "value": "T1EB1723C369DD9698C5870F3455C2A386248A6DFA4DF8490C34CC7C03AA36E9E5DBD3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697738, "uuid": "d2c7fa1e-d859-4e02-a3db-b5bb2201218b", "value": "670c3299dc86b4b6517548dd2835c4a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697738, "uuid": "48e56689-0bfb-49c0-8970-0b61e47b956d", "value": "393216:ifo93Bsur1qnXJ+UxvDVFmK1FrpOkefda:fnNrKXJ+gDmiFrbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712697738, "uuid": "8c6cc276-e651-4a9f-bedc-789cbb0e42b1", "value": 19535360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712697738, "uuid": "d24f9066-6cd5-4cc1-b66f-3072c9c604f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697738, "uuid": "052fdfc1-8a55-4a39-81a5-73d263fbb6c4", "value": "SecuriteInfo.com.Win64.TrojanX-gen.26710.19883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e515a94-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692933, "uuid": "9eec97e3-8258-416d-addd-a80d9c984884", "comment": "Malware payload (Blackmoon)", "value": "443b43b9a9ca4e9c7124d1289a86ec0e", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692933, "uuid": "7ffd2f76-89b1-4345-bb16-8d993e33858c", "comment": "Malware payload (Blackmoon)", "value": "b542d29a0ca9d8d7d147d8b3d8459deefb8d9b8d2f5b4420311b2f00f3b7cb30", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692933, "uuid": "34cb7e01-5df9-404c-815a-f8d4f001e713", "comment": "Malware payload (Blackmoon)", "value": "553145f7c9d6062c6941272743ac506f7071fc61", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692933, "uuid": "54b6930e-f13c-45cb-af6b-5758c5ec8b09", "comment": "Malware payload (Blackmoon)", "value": "0d89b2d0521da23e64e43eab2f9e68620d7c6331119f16b511c6dbac0d2e69dd98e5379dceef89ee2072404a5e6903dc", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692933, "uuid": "6f8c4cd6-2ecd-4445-950f-97c854765747", "value": "T1E584B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692933, "uuid": "225fd39b-1373-453e-b7c6-6387d0f1c600", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692933, "uuid": "dc02d8f1-0648-49f6-9179-e1fe096148a3", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1B:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692933, "uuid": "15db9727-58c1-4c92-9613-242bee3f0571", "value": 375521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692933, "uuid": "935c3a06-d2a7-4716-a56e-763b51aeedbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692933, "uuid": "9424add9-ff54-4846-9642-b0ecf4b6894b", "value": "b542d29a0ca9d8d7d147d8b3d8459deefb8d9b8d2f5b4420311b2f00f3b7cb30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733f138f-f68d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712679787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679787, "uuid": "a6459cb7-011c-4c71-b901-19735416560f", "comment": "Malware payload (Mirai)", "value": "cc86f4a69cc75f077035f09ec24e9809", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679787, "uuid": "adf9ecd2-b608-42e2-b7ed-632773ee4270", "comment": "Malware payload (Mirai)", "value": "b5625823cb05d240daef32d9ffa9a013c331e6e3c1fd9adcd14879ceba676767", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679787, "uuid": "089447eb-0342-40ca-8088-bf0dd802589b", "comment": "Malware payload (Mirai)", "value": "a4c91e5e8458b3b32a1a7e9137722fbbea2e6cdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679787, "uuid": "4b10dce4-5614-4503-8dab-83a0a77892cb", "comment": "Malware payload (Mirai)", "value": "a94a03a99353d23fe83e59bebf1244a763c6b18dc88a183d886bed7e80b5b7a51b48e3cace8ce4b8be23aca5ba66560a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679787, "uuid": "2915fb3e-545e-4adb-bd70-eeaef8138635", "value": "T1EAF32A45FC519F26C6D6227BFB4E428D372A1768D3EE720399256F20378B95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679787, "uuid": "1f7364ee-ed1b-4d66-9f35-49c42fce612b", "value": "3072:jRvHvsdPVVxF0muB4619g3XY4rXhdym4dB5r:lvaVxF5+46/g3I4Dfym4j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712679787, "uuid": "6d2e5d58-2752-458c-92b0-8d0556f05eae", "value": 158368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712679787, "uuid": "16fbf333-fd00-401f-b8b3-3eff16092cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679787, "uuid": "a5d7d5dd-d079-467f-913d-1d2fbb37f889", "value": "cc86f4a69cc75f077035f09ec24e9809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2143674d-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712674066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674066, "uuid": "bf393809-ffda-49ac-8a6a-682c031cb680", "comment": "Malware payload (AgentTesla)", "value": "b97be259966d83c11f4cda24134daa6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674066, "uuid": "db6dede0-ef37-4dcf-a1a1-5f5ace6c655e", "comment": "Malware payload (AgentTesla)", "value": "b56560c2b844ffa7a003165bcc25bdf0882b1f2f19b7765cdd3ed7ea1e10a763", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674066, "uuid": "192afc6b-ecbb-48c2-b602-102803a39204", "comment": "Malware payload (AgentTesla)", "value": "ff6a82c37169820884101a61d498faf4501edfcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674066, "uuid": "359cd39c-2ed6-41c2-af29-6d888dc4a77f", "comment": "Malware payload (AgentTesla)", "value": "a3575540a76ac83fc6636aa9c0b2a96b9fd9ef7574c44de98505c66e346d27f14f26368810dd8765fed97e8d16949b54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674066, "uuid": "73192763-f086-4035-b5c1-2d34b1f6f7d0", "value": "T1F6D423B1D6521B5B1EE9958CDF1D081409ABFEA906C2D1CFCFE6248C91782D868D7B0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674066, "uuid": "158f3c79-05f5-47b4-939f-971dc0ae123c", "value": "12288:RUtLJ0wlKnA6sNsGhyNeUqHlH8lXLlHhGwcy3qdTEkq2RPsNZfSD73+B:RUtLJNRMQNFH8lpceqbxF8COB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674066, "uuid": "7287b7ee-c573-4e74-a4f8-0239651c7819", "value": 603724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674066, "uuid": "88506fba-a4da-4ac1-b1bd-a6345313c31f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674066, "uuid": "6a9409a9-dcb5-4600-a5b4-ec7bcdf8ef30", "value": "BOQ- AE20003 0084 20240408 _1.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3c50d3-f673-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712668825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668825, "uuid": "22e9764a-9adf-4822-86a5-a44ee7ee9ff9", "comment": "Malware payload (AgentTesla)", "value": "6632958e4bc956ba220190e0d3bf3e3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668825, "uuid": "ac20ee75-5374-4979-b94d-2fc6ba78b4f1", "comment": "Malware payload (AgentTesla)", "value": "b57b61ac75ca378686912265b5e1d52a7d41430b4f051d2318ca20414f509cef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668825, "uuid": "8c19cec4-e742-46b4-bf6f-81b9768b55ae", "comment": "Malware payload (AgentTesla)", "value": "1d434d74306daace66d7948696d06d1ec6096651", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668825, "uuid": "6ffee5ec-a28a-4747-a90d-698b94467e68", "comment": "Malware payload (AgentTesla)", "value": "22bfff26aa5a2a8ecb035a3056541b3eb69463610a38a2c8dfefaca213f224d506b40e1d7470a1a3be11e3ad2ccf14c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668825, "uuid": "1533bd85-0c3b-48f4-8cdb-0cf145259072", "value": "T18934FF037E88EB15E1A87E3782EF6C2417B2B0C71633C60B6F49AF9518516529C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668825, "uuid": "c3773b1c-3a36-46b4-ae4f-33ba88fbd795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668825, "uuid": "ee5c3826-ca55-4c97-9036-de170921f1f7", "value": "3072:WNdbbDRZwjKElYK6WVNcbVBjzp++2Efh53INrHVk:ObbDRZwT7QBjV++18Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712668825, "uuid": "00e33c97-0381-4be9-a56b-fc1a526a45b4", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712668825, "uuid": "6a1a0713-7244-42cb-b22f-6585de95a085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668825, "uuid": "b94359be-625c-41e6-b1ca-0650c7ab8c8a", "value": "b57b61ac75ca378686912265b5e1d52a7d41430b4f051d2318ca20414f509cef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72944f53-f685-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712676350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676350, "uuid": "45805988-2e67-4c2e-a74f-ed13a97ab49a", "comment": "Malware payload (Mirai)", "value": "0b5a07ee1aa215fd5e3e51532352def7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676350, "uuid": "2f5d66c9-9030-48fc-9fb7-65f128f4f8e3", "comment": "Malware payload (Mirai)", "value": "b6a3326ccd199b9b29043a40a9268c1faa79f46c8db3af3c4dfdcc27f11403cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676350, "uuid": "201b16b4-4563-481f-951b-a3ebc3503689", "comment": "Malware payload (Mirai)", "value": "58941e4a0b404eb34e865e66c23bb12af91e3dde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712676350, "uuid": "8fda375b-9a8c-401a-a695-4f0cc1610248", "comment": "Malware payload (Mirai)", "value": "1d8c5e02b6957f388ee2a4b191b64af432c924d88d519c2acf526997afb4a5c2f0bd6ce8540b9e54bde2b45ff75b35c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712676350, "uuid": "0dc2589d-6e26-4766-ab49-2dac407832bd", "value": "T1B7E2E141467A7801E2B01435D0168C9B374E4E7AF3F9D03A53964FFBAA66E12A64E3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712676350, "uuid": "c0498a1c-efdf-433c-8c98-5270d3a39de1", "value": "768:n93GjR5EMWYFF/pDTxHKYSLO/R6wd12Xi3+KaR3nIpSWZglNF/9q3UELdP:n93GjIMdT/RRK65X2XQ+1tnjFlmLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712676350, "uuid": "d5f5e3aa-ab9d-450b-8f81-c15c9d0b1b1a", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712676350, "uuid": "880e28a7-c81d-4486-8dcb-f56abf941ee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712676350, "uuid": "f78a1c69-f15a-4a9f-90cc-b940f89a4a8b", "value": "SecuriteInfo.com.Linux.Siggen.9999.3055.3600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263682e7-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712669350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669350, "uuid": "217e7368-5be0-4a3a-92b0-c6207ba9dadf", "comment": "Malware payload (RiseProStealer)", "value": "adbce3c112de908d75a52ef02e3b2304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669350, "uuid": "042b36d9-3804-453f-bec2-e5111c6be752", "comment": "Malware payload (RiseProStealer)", "value": "b7354b843865376332f64f3eb8a448127ee24a13c0a76c5ffcab35d01275d032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669350, "uuid": "3430c6c8-0c93-4efd-9faa-eae12bb1d169", "comment": "Malware payload (RiseProStealer)", "value": "410b57ee43672015e09a3a2aeb5f8282f964f597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669350, "uuid": "1a44c9de-63c8-41fa-bbdc-09149430ec58", "comment": "Malware payload (RiseProStealer)", "value": "f914b23e0f995ecdee4cde78252bef7b3a9a7f9f912f9d71bf0efdc3f440e304c4cbad7e88be0458ba95150b84606bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669350, "uuid": "fd82b44b-327d-4b9a-966c-2f1cd8736437", "value": "T1E59523F832FA8A4CE8D51BF00771E6A952E15DE5CF255EF2D1B31826B3830C06E6A553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669350, "uuid": "68a982b3-230d-4d83-a57f-ac19927a2b2d", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669350, "uuid": "fb31f006-f20f-4690-b4aa-2c9cdc90bcdc", "value": "49152:h1skuVi+eKBe5eXJaJm+1SqCFnzO6typUmH:HRuVskKeXMsBq/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669350, "uuid": "2633e99f-5e73-4864-8d08-bbe67005e090", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669350, "uuid": "d86077f4-f45e-4314-8cc7-bbfc76c84c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669350, "uuid": "6481109c-1716-49d1-ab5b-b4c826fd7522", "value": "b7354b843865376332f64f3eb8a448127ee24a13c0a76c5ffcab35d01275d032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3f3e12-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692934, "uuid": "41df7515-6042-4a10-8c89-7b5dd97d0f59", "comment": "Malware payload (Adware.QQpass)", "value": "0d7d2f23d42946397f611dd41f6aca04", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692934, "uuid": "130a6392-6870-467c-b80d-9376f8164a6d", "comment": "Malware payload (Adware.QQpass)", "value": "b7954d42bcef17cab225b261f982877781aec6d885535fb7d654eb38aa59ccee", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692934, "uuid": "16ab3d79-e333-47d9-9330-ca088faedf66", "comment": "Malware payload (Adware.QQpass)", "value": "b616b9df8fc1a915a8fd7199345ce54826b36b15", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692934, "uuid": "be33232b-8aa5-4715-ab36-c916d75a4783", "comment": "Malware payload (Adware.QQpass)", "value": "fb9fea31e33d95848a7f062883e4642fea81da4eaaed6762b4c48ed14e9c1456daa85e656c6771dc4ab113e63761c6bc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692934, "uuid": "78875337-9571-414c-927e-eaadae849278", "value": "T1B574950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692934, "uuid": "a3c210dc-3422-42e4-8cfe-345509a01ff4", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692934, "uuid": "f2bc4a4b-0d2e-471d-9c43-6b7c45cf162c", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudeK:b5/Q58drihGiLhmGNiZsx0B/zkXoeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692934, "uuid": "66ba5bea-2728-4de1-baae-b8de3ccbff68", "value": 346604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692934, "uuid": "492bb5c2-adf8-4507-885c-d2c83883304d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692934, "uuid": "aadd3b29-a496-47b8-9651-a09308109a5c", "value": "b7954d42bcef17cab225b261f982877781aec6d885535fb7d654eb38aa59ccee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695001ac-f66c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712665597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665597, "uuid": "363c5209-423c-45e6-a3c5-70a9b2b5fe97", "comment": "Malware payload", "value": "405eba582604aa6950ad8c910509eff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665597, "uuid": "e6b030c9-a727-4d7f-89b2-8fe0741585da", "comment": "Malware payload", "value": "b7c152c1ec25e5c2f5e78c6eaf13ffd606a052ce8e856850afb7cc86b5ff561b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665597, "uuid": "7a9e642e-9d21-4035-9eff-cc02531ea6d6", "comment": "Malware payload", "value": "cae1b5bbbbdb997d613c017efa27cd4261eb9444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665597, "uuid": "209153d8-8a27-4f78-99fd-4512c181223d", "comment": "Malware payload", "value": "9ed84051ed100cdc7aeda2783a899df1ed52b8ac355fa440d8258868bf88b587f0b96c0c36bdcfc5101d01b2b8fed707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665597, "uuid": "9c2c7d12-cdb4-46a4-9eca-32dcc85b10c9", "value": "T1CC85234F76E4DB52C2C6A37985E3A077C47E5A804D6E2A0DED31F2F24C4A5886AF31C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665597, "uuid": "ebcf7f4f-f292-4bac-b554-706ad6b0745b", "value": "8763b6a1950338c007a6f25d75afcd8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665597, "uuid": "c39bc070-e766-4d49-909f-33fc49d623af", "value": "24576:6TsoN1wZZs+dSmv14qbYX7//5caQMP/c1+W7gBuddYFrp70HkBGh6ttz3NQbgYT6:6woUqe1YX7ygP/cEW7gOU1DGhS3NQj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712665597, "uuid": "58014a33-7f5e-4cb2-86fb-2c0b28a56427", "value": 1829888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712665597, "uuid": "bab7ab0b-0a9b-44ae-a9fb-55e70af0e1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665597, "uuid": "e6f3e044-4703-439d-a8b9-df7ffd106824", "value": "b7c152c1ec25e5c2f5e78c6eaf13ffd606a052ce8e856850afb7cc86b5ff561b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104b71e1-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692936, "uuid": "6e50d596-750e-45f8-825b-7d122c8557c3", "comment": "Malware payload (Blackmoon)", "value": "49665d2d41515f66b3b8043d4218c94d", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692936, "uuid": "9c80cbb3-e738-4080-bd07-174d6920ca55", "comment": "Malware payload (Blackmoon)", "value": "b818ebec50e611aa06e1aef9a4ebb799559cad64254a9b69cfc3d631def30bd3", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692936, "uuid": "8d9333ac-11d5-4b13-b51c-3fc1ceedf345", "comment": "Malware payload (Blackmoon)", "value": "1a9ff541a0cc6b2591b635e5001efc71bcc64c82", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692936, "uuid": "8ac33de9-43cd-450d-98a0-1ef6f117e85c", "comment": "Malware payload (Blackmoon)", "value": "882c38890d04952a244772e8f3b54ca786f478af5d3fe91f6543cd10426efd8b39800402227ae7e0cae2d42a5cc78181", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692936, "uuid": "c74e7f59-0223-4f43-9e5a-ff7f375c6b84", "value": "T17DA4A60376219491E1595BFBA2AB433879F8976438F1CD23AFE4DD71ACB1121871EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692936, "uuid": "7a91770a-cac2-45d9-9f80-497f8d3a55dc", "value": "391b34fdb03bbbe961a380d74dcff2da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692936, "uuid": "4f1f6f48-cdd7-48af-917a-1d8b23369982", "value": "6144:uvbuWQu/cuaS2l8iE0B55FrJJJekPd4/2+AgerHO:uvqWQub2lrE0B55FpekPd4/27pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692936, "uuid": "cacca36a-02d5-4365-8a32-2e76c04d0d9a", "value": 469766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692936, "uuid": "b268d349-61cd-4e1b-a27b-eef85347fea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692936, "uuid": "24c13bb5-db17-499d-adc1-62738d0e462e", "value": "b818ebec50e611aa06e1aef9a4ebb799559cad64254a9b69cfc3d631def30bd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e16b21-f69b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712685862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685862, "uuid": "aef68452-a2e2-4aff-b2ac-593e804ec513", "comment": "Malware payload", "value": "ab69b70e4baf03e79cdb4b9cf0986f5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685862, "uuid": "922e2614-9217-42c7-b1c8-c92105f7ac64", "comment": "Malware payload", "value": "b888e03d4b4100b022d3350b47ca6b5613bc6d15aa8664ca6b58123682f2dfef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685862, "uuid": "ebea3cbd-797f-4217-9f57-693e0dc666f5", "comment": "Malware payload", "value": "1fd4eac3112192750151ee521bde92e65be74597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712685862, "uuid": "196c43f2-fa79-41e6-987f-12b8425e5886", "comment": "Malware payload", "value": "43d4182a082b2284569e23124e9e2ed6a85eb4c2f1b75612cb9ad52455b9c063345dce10b9486abf676a1c2f3e08daa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685862, "uuid": "efebc04a-d5fa-4c36-b16f-6275047eb112", "value": "T120E2F7067BE98215D6BC1AFC8CB313214772E3838432EB6F5CDC98CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685862, "uuid": "bda7e0b4-1a11-4da6-93fb-513f9b764ff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685862, "uuid": "dbae0d5f-c647-4ef2-a3cb-ebc45b5e9415", "value": "384:I0bUe5XB4e0XGOPnw0Q0mS03VWT8tTUFQqzF7ObbS:9T9BuVI55jdbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712685862, "uuid": "2a7818f7-e53f-4604-93be-627806872ffb", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712685862, "uuid": "b114be56-59c9-499b-b093-1747e000b841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712685862, "uuid": "927909ed-17f0-4b52-a452-9c451ecc28f9", "value": "x7CwEiB9bHEP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db835567-f604-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712621121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712621121, "uuid": "ea9ff3b1-9f58-474b-8d5d-fd17264f42cc", "comment": "Malware payload (Socks5Systemz)", "value": "6017d985cd6c8c46e9b1be21f4e20102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712621121, "uuid": "4f5d5a98-a45d-48d7-90d9-6e9acf411ada", "comment": "Malware payload (Socks5Systemz)", "value": "b98e94a22a206568cc5c44c61382fef4ecfed241fa6f90a1db85e95d15897286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712621121, "uuid": "86e8cab5-17a4-4f84-8d47-0f29bcd1f180", "comment": "Malware payload (Socks5Systemz)", "value": "3cae8c9100d0b6b80ecf999371f01fed59422eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712621121, "uuid": "99026591-8cf2-4699-87e9-d06ddd0c9ab3", "comment": "Malware payload (Socks5Systemz)", "value": "4de3b5bf16b0b67241d2e3ef34b9def90cacb252bb9bdeb8ce46aa826e06ff835fe876d6d6a3c9219332ea5fccb00f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712621121, "uuid": "88b3f721-f926-4c9c-b29b-b49afc1d061e", "value": "T1DC26335493CA89F4E5394DF9CE2E3575F27D24A71E30104D269E708E3AA3F9A390E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712621121, "uuid": "48704fba-e071-45cc-bbf5-dc1a074603c5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712621121, "uuid": "272fbe20-617c-4b4e-aabf-d7d33f67bc41", "value": "98304:CzjQwkkXQtMdeYWvZiaL0JwGZgTDODoPeU0N4VcH5uQxU:EjQsFRWhia8gTDOkPuN4VrQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712621121, "uuid": "0f10f9cd-80d8-4ff2-a0af-fefc0b06f9d5", "value": 4507534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712621121, "uuid": "5867382a-09b2-465b-ad52-5d7842d2f577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712621121, "uuid": "127513d1-5f84-4fde-b398-7631193dd0fb", "value": "6017D985CD6C8C46E9B1BE21F4E20102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3af2ef-f688-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712677526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677526, "uuid": "0e219177-14dc-4341-ac0b-abd9cb226362", "comment": "Malware payload (Mirai)", "value": "e062f8e1d03416ad00756c6d806692a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677526, "uuid": "41613eea-30b1-470c-9f14-b01b6991cbbf", "comment": "Malware payload (Mirai)", "value": "bb26e39c4cfd613d4a2e1b688689e70a1a7cea0763a6eb731f255b6a5964de24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677526, "uuid": "dd1df336-a397-4f74-8997-c6ec8bbcd5b3", "comment": "Malware payload (Mirai)", "value": "8f61b8ae8df5dee08fd0b27b0850dd870a4cc661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677526, "uuid": "7755a2dc-c0d1-48d3-8db6-a891e2de7e9c", "comment": "Malware payload (Mirai)", "value": "d50d20107ddb5bc57d64c524eee9f0baa5f4d41315e9936c8f1f66adc9193aa5ad4aeced2da5327154e823bde2f8070a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677526, "uuid": "9b295701-f1a7-4357-9b59-bdfc91a18dba", "value": "T129734B4232680F4BD1A65BB41D3F17E083FEED9024F4F689164FDB568636E77418AE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677526, "uuid": "582b010d-2ae7-4260-9745-3cb8cdf1c449", "value": "768:oSygL2s//8xic1RZBjN8rDRIaRnqV3a5/WuMhC1LXVU2S4xbqB6UbFDzGJDLwCeA:l/8H9OrDRqVxhC1LXVUSq60zGJDJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677526, "uuid": "ca07877c-917d-4f4d-87ca-90a1057acf11", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677526, "uuid": "196547a1-c6f2-4425-bdea-b207d1330bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677526, "uuid": "9326b707-12ea-4ae8-9b87-4d49cf9407d0", "value": "e062f8e1d03416ad00756c6d806692a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f638e4ed-f638-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712643500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643500, "uuid": "1bc8839f-a3b0-425e-9301-29a0c6611ee5", "comment": "Malware payload", "value": "ddbd9f6858712ac7efb371f21ee24597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643500, "uuid": "c9df8166-710f-4336-9c2c-4d8b45b3e076", "comment": "Malware payload", "value": "bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643500, "uuid": "68ed6faf-6020-4413-b1f1-90454271e259", "comment": "Malware payload", "value": "e402758f4f1a331d9ae4c5b596466e3794188a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643500, "uuid": "4afc3b9c-6122-4a01-9183-bac7ec6b303d", "comment": "Malware payload", "value": "c6cc4704bae354b7877a2af3afa67c6bcc02c27210a590b683b704104635807b0b89757675f508f4f7d149a09a11fe57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643500, "uuid": "1e8a1f42-efbc-4e01-9d05-c7ff17004c88", "value": "T1C9A53391E0986432CCD91035382F6F3B4BFDA750DDA89816376D3A166C95BC3BB0F6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643500, "uuid": "2ee2fab8-4336-47fb-ab9c-c668c0287919", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643500, "uuid": "bcb2bb9d-46a3-4e3d-bafc-71627afbe196", "value": "49152:zqsExYLwL9ybMFR8+Bgk64ypWS7eA/b9AxInqUSIS968+vcQU8Kb:zqy8EIFRdK6+Wm/5TNSIG6hL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712643500, "uuid": "74634a47-6069-4d4e-a13a-4be3cbbccb99", "value": 2099985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712643500, "uuid": "31190b54-dcff-4a91-8eaa-772359588da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643500, "uuid": "75ae4e4d-65e6-4e08-b674-1939c2ea6084", "value": "application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11391c42-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692937, "uuid": "9abe4eea-2a87-481f-b094-8f488b0f2e7a", "comment": "Malware payload", "value": "ded7639442d93d3835c150a1dac7d9ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692937, "uuid": "192efb72-8b41-4cb5-b8ff-37e3d44cf6da", "comment": "Malware payload", "value": "bbebddadf556c91966fa760f21d04d8990481f254e25b2f38de423503d787ab9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692937, "uuid": "26d70427-a1e6-41f6-8cf7-b6803410c1a3", "comment": "Malware payload", "value": "a67b69acf9749adfd677ac43d443265b756f15ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692937, "uuid": "905e2cb7-dd73-4c06-9593-7af9006b1abf", "comment": "Malware payload", "value": "4234fd3c32c1a04fc678e724784f65c4f6b9afb29b3ab1220cce7545a016ae839a92cbafb90f4558ac9c2582be9eb0c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692937, "uuid": "bc4b2364-4f42-4249-86ca-8886c3ba7bdd", "value": "T13974950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692937, "uuid": "28d87fed-c10a-4bc7-8cc8-d1f4407ebae9", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692937, "uuid": "31412097-f6c5-4d5a-80e0-d04f8e7fa2a3", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudes:b5/Q58drihGiLhmGNiZsx0B/zkXoes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692937, "uuid": "8a8f7d63-8fe7-4bf8-a466-9ebe351f4b13", "value": 346580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692937, "uuid": "07101ce7-6ffe-46ab-95c5-b8c8197833ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692937, "uuid": "bad3b989-2b84-4cc8-86b1-56ba195fddfd", "value": "bbebddadf556c91966fa760f21d04d8990481f254e25b2f38de423503d787ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9b8698-f652-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712654434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654434, "uuid": "e6436058-438a-4253-950f-868c268c4643", "comment": "Malware payload", "value": "8bd58a06dd9882ea2113d7338d6cf8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654434, "uuid": "a4695e08-7b46-47c5-9896-19c5a07872e7", "comment": "Malware payload", "value": "bd22050832dbef82d3110c3a0d2370fefad5f69fecd36b9faeb74663babd6b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654434, "uuid": "db94a500-f8c6-4a65-a376-eef5844c919c", "comment": "Malware payload", "value": "6dd1dca81c22a995223ef341d436c991a2f1d9cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654434, "uuid": "208bc7c2-ce48-44b5-9751-6e0d5c0e4505", "comment": "Malware payload", "value": "f3e0a12b72f486f62c60b810fb407b033c7fea07cad71adf9eaa15205a0829f441f2055b58ec97f6e0012cd71cde7a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654434, "uuid": "adf5fb84-b98f-4a2e-9e0c-e2601c64f8c8", "value": "T1AB962282E3B58872D715D77CCE23FC205A52FC57A19878353CB8BA2D3678DB4C825A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654434, "uuid": "399a5566-c1eb-4cca-a255-c97a23c33849", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654434, "uuid": "14ac97a8-5e3d-4c0e-bd03-6c1cc96a27e0", "value": "196608:j4Obg8krVdNtCNbyKlgQJZKNgYR4/ZlCm8Nvb9UFBmd+:v1kpdNt0xZOJiZWjfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654434, "uuid": "ea795da7-9252-4b08-badc-9d576f233118", "value": 8736896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654434, "uuid": "a8e71e3b-4b28-4ca2-85d9-7b1ee01e8f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654434, "uuid": "547ec541-c532-421e-8311-51882e159cf8", "value": "SecuriteInfo.com.Program.Unwanted.4119.28260.25682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614334df-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669879, "uuid": "bf42da5d-c87f-4c8d-a8e9-d8fb880ad0db", "comment": "Malware payload (Mirai)", "value": "15cd733a81bd5dc555fe07879a3f4ef5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669879, "uuid": "7f3497ed-8623-4d20-8812-8a9d95646df0", "comment": "Malware payload (Mirai)", "value": "bd31a365a49ee1811292c68c58173efd6488cf0c0484e4a32aa12366f159d4ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669879, "uuid": "f8ae775e-26c0-4311-99e2-b3bd50851158", "comment": "Malware payload (Mirai)", "value": "be50b17986e31309b50fb7ad46da778fad44cbe1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669879, "uuid": "db6b2689-1466-47dc-af1d-d13f4b15a42a", "comment": "Malware payload (Mirai)", "value": "807018cd188c7d75c7ef6501e5bebc3db6893c8bf596ee44734589c766c79ac7f451ccc476584e13adaa0a96c53841dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669879, "uuid": "a45a30d8-d586-4759-83b0-15d28745591d", "value": "T112D2D0EED5E976C7CB6D0CBD80D52B332B85A080231BEB5857228CC56B0485FA66B07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669879, "uuid": "d2644955-6f84-4c9d-b07b-9818e3c5ecb5", "value": "384:o8pVWtmRsLYEpB6V8S628Ft+ykZw2ZcU1/IIVBBuuC8hJ8TYTap8RY+RfTWVH/UA:9MYHb62I2eU9IITA3c3TM8NRfTWuLZWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669879, "uuid": "25dfb863-081d-474d-902c-bd840359deed", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669879, "uuid": "0926c696-83f9-43cf-920d-59add2fe75ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669879, "uuid": "914ee3ad-e751-4770-bd1b-eb60a3759f86", "value": "15cd733a81bd5dc555fe07879a3f4ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1248afca-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692939, "uuid": "db834de3-db35-48a7-8c49-d430efb85635", "comment": "Malware payload", "value": "f38373a769d5f63cdfb33efa4d98fbfc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692939, "uuid": "81f95445-ed4a-4051-a209-ffff8724c8b5", "comment": "Malware payload", "value": "bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692939, "uuid": "eb4e2cbb-0005-474e-85e6-7322207d69dc", "comment": "Malware payload", "value": "f3cbb39c72505a31f1a0bbfaf06fcb8986c30cc6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692939, "uuid": "e5ccfe74-5304-49fb-a00e-4992516885f2", "comment": "Malware payload", "value": "163108ad032c3c7fef473ae98399941c94edebba43f153671d3e202697d2259a230a13cbd0b49d205a8f60d1e6c07320", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692939, "uuid": "6667520f-c9f0-432d-89b8-2a4005bb049e", "value": "T170B4C713B522E495E11457F66BFA073869B8836438B1CD13EFE4CDB2BDB15318B1A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692939, "uuid": "e2b895e5-ea89-47fe-bbd8-d007c9da0c9a", "value": "da4a387004bf1285d93edaa4d5233098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692939, "uuid": "8d6d2105-5b15-45db-b5d5-7a068ade97fb", "value": "6144:0wGdR+Yk/N8duBmG6t+UnRsRCQ/OJOr7TCYv:0woR+Y4NSG6oUnRsdOJOr7T3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692939, "uuid": "56ce69aa-3aa7-4d36-882c-f201df83754b", "value": 531067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692939, "uuid": "49235dc8-d525-4c6e-b7e5-a2fafe0a0f7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692939, "uuid": "2042a60e-6e29-48bf-b5a6-c303ba112aa8", "value": "bdced8b193bc1fb89478e4857c1a65fdd8fdcaab0dbcf163a2678790855838ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841fbe3a-f676-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712669937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669937, "uuid": "5fb8feb5-0521-4e18-b8c1-a427086103c1", "comment": "Malware payload (CoinMiner)", "value": "5fce7fd36a89236dadcf07e761b4e44d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669937, "uuid": "00b32c43-2967-468f-a749-421267a88963", "comment": "Malware payload (CoinMiner)", "value": "bdd114b5d29c438e41f300c7727620a484aba58b06bc963d49eeffd0401e9b1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669937, "uuid": "86ed4d3a-ddc9-4753-9a53-1a7a512d9310", "comment": "Malware payload (CoinMiner)", "value": "2ab22642fe574d061f085c0db0899b87c18a50d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669937, "uuid": "075ac34e-0d2f-494e-95e2-e5dd1468ecea", "comment": "Malware payload (CoinMiner)", "value": "51c645fc6d86ddf662bd226f4ed274daae1b454d5cf6ac1d7ba120589847a6ebb60c08bc1cc3514e554cd38e97e0eabb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669937, "uuid": "c44a1e95-9454-4247-836b-0fd3d7d4868b", "value": "T131765B05BC846BB6C06C9B7885E6CE9163706E144AF11B366664FEEDB8762347F43C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669937, "uuid": "16967680-9821-4222-af4f-030521261558", "value": "49152:9WllSDFKdASb0a9flibxuK8BgZeV0VF1lmRZeDtPT/Q20tPHL81ZaMsgQ7kuOf2X:oCUWqZOT/Q2wHeWguo25Mjx91ln6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669937, "uuid": "71522d7c-a5cb-43da-afde-d54b5f7ac585", "value": 7162222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669937, "uuid": "011ca306-3ce2-4376-a518-f8539e31fd91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669937, "uuid": "1c19ad45-a821-4685-bff5-b69cc9f15b73", "value": "5fce7fd36a89236dadcf07e761b4e44d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13663dad-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692941, "uuid": "b1402340-7613-49b2-99ef-fd16ad592d40", "comment": "Malware payload", "value": "6ad340be8faf4fc40501852a20fa95fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692941, "uuid": "c0afca64-92b3-4907-939f-46dd8eb9c96d", "comment": "Malware payload", "value": "bea8ef34c1a1d3036ef88af502e41fce04bf4d539fc567194589cb052f7e949e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692941, "uuid": "e23d4a19-8af6-41e5-8996-fd7f014575da", "comment": "Malware payload", "value": "574a10e6710886d6a3e2cf79b1eb0587c950e16b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692941, "uuid": "d829460e-75db-42f0-bd99-52c72641a64c", "comment": "Malware payload", "value": "117807332279d9da0a33f4c8ea107a75f0503ab4f287f2ffd5a535b7a873992671ce01c95fdc7bdcabc407a30d531e6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692941, "uuid": "3f503698-8115-4661-801c-f02e706cbed8", "value": "T15FA4B8137221D491E15957FB62EB433879B8875438F0CE23EBE4DD62ACB11629B1EB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692941, "uuid": "bd6148e1-1810-4db1-be8c-59bab1e40251", "value": "47b8255ad5482cd954f979aad5057652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692941, "uuid": "56b4e069-3bd9-48d7-8f41-5e738ed83bce", "value": "6144:Wvk3Q5ibjnNuuXckaL7pbRBkce97aw6e7L7o3Tvq:WvMQ5ibjnwka3pbRC19Gw6e7o3Tvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692941, "uuid": "331eba25-f306-4e80-8c91-5ec6dbe86b3c", "value": 449181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692941, "uuid": "7d33d49b-a718-4352-9b73-c779c41bd531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692941, "uuid": "0f960c86-4fea-4f00-81cc-10905f4c96b4", "value": "bea8ef34c1a1d3036ef88af502e41fce04bf4d539fc567194589cb052f7e949e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d829d7-f619-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712629833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629833, "uuid": "c80bf500-5bfd-4119-b3d9-a62c0ee1208b", "comment": "Malware payload (Stealc)", "value": "86ba066330abb265fbb634ddacbc532d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629833, "uuid": "fd63cb10-5596-4e3f-ba52-243714476de5", "comment": "Malware payload (Stealc)", "value": "c07032d24032eb1e404dcb5351c634ade7f526f39a78b164c7bad172ec9379dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629833, "uuid": "24087cf4-ee89-4387-ac17-6e0bb489c83a", "comment": "Malware payload (Stealc)", "value": "ae519e3bf9000b12383935d22631899f1e7cca17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629833, "uuid": "738e5fc9-0b38-4d53-adbf-b697c2c91e95", "comment": "Malware payload (Stealc)", "value": "57aa217761443699dc4a3be51842f78565d7d2b9947d6a21991001009cafa02c5754625c69ecff43d2a44d87f5ee3815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629833, "uuid": "82ae8239-463d-4e15-8641-e7dfbea6ef41", "value": "T15E564942BF80FD20D3865933EAE51410D6B5BDD3AB62EEFE6D4377291A323A048456C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629833, "uuid": "9c2ab8eb-5fac-4453-88dd-0542ccc1c8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629833, "uuid": "12b0503d-ec96-487c-bda6-4e8f48edbbeb", "value": "49152:0e9yfSUr0nHJ5T56ZHVOG9ItSmuKxw3aIo9+FlLKWbiVhKHqoZq/:0e9yfSUr0HJ5l8HViTq8OpbvHqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712629833, "uuid": "55f4ff99-4436-4eb9-8cbb-ccf1a2726a93", "value": 6219984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712629833, "uuid": "c1ac6785-1025-4b27-9fba-faf3be359d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629833, "uuid": "eebc43fe-0021-4674-8061-05837f1aa665", "value": "86BA066330ABB265FBB634DDACBC532D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14561623-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692943, "uuid": "04869c59-a4a2-40b1-b3fc-da2da5ff7a42", "comment": "Malware payload", "value": "a8dd3ca6e61ceb18c6e30551c910dd98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692943, "uuid": "68b2c014-c946-455c-9fca-e1a4f016d557", "comment": "Malware payload", "value": "c07a262e77a37b52cc15448da60480d9b9b69373d7a678df762300c9ece55c01", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692943, "uuid": "8c24e2bd-5dea-497e-b811-60beff607576", "comment": "Malware payload", "value": "53e3fd4a3cab2d2ea26174ee34e377f9ce6f305f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692943, "uuid": "ca551ab0-cdc8-475a-9c90-ff0a33792294", "comment": "Malware payload", "value": "aa15dc762810257e692035be903f2d783176d016d50716a056bfd02ef3040a7d459003271a2b1628ce19acf30eb9396c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692943, "uuid": "3ae56be7-9ae6-4a00-ba05-97dbe3b5f762", "value": "T10C74950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692943, "uuid": "dd08cb48-3ace-4b8e-a7e1-c8c7b4fb9836", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692943, "uuid": "285d2fbf-1e82-4dcc-815b-16cb43665df2", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudeD:b5/Q58drihGiLhmGNiZsx0B/zkXoeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692943, "uuid": "7e978542-7761-42e0-adba-e3c3dbca629b", "value": 346604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692943, "uuid": "51956b9b-783e-4067-92b4-abc7ff68eee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692943, "uuid": "6354e57a-2381-4c98-9403-838d36276cfa", "value": "c07a262e77a37b52cc15448da60480d9b9b69373d7a678df762300c9ece55c01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04127472-f661-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660703, "uuid": "6b8f4387-d720-4df3-8047-e296b4650806", "comment": "Malware payload (Mirai)", "value": "b0d2c6f4c1d9c3675dcf54718cbba84b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660703, "uuid": "928b0489-a85c-47d2-b007-a0e904bcd3a8", "comment": "Malware payload (Mirai)", "value": "c07cae9b466f8e7e6c3687f584cd83ffc7740117f899dc1f3ec03fc67c5df072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660703, "uuid": "4f833dea-323b-4415-8b25-376dfde6808f", "comment": "Malware payload (Mirai)", "value": "fd724d5d8a8e04ed3c20da4e3fa9db62aa19f975", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660703, "uuid": "92fe123d-0d11-4ee1-9aaf-feb592240fea", "comment": "Malware payload (Mirai)", "value": "507dcc047d701fd7ebc603e2a38c0dfc5292c56a592e50c18e11fec305c86a0840e877b1016eb5a3a3f371393a59cd94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660703, "uuid": "1c954bc3-fe6f-457d-81dc-400243293fb4", "value": "T1FF732A9AB801DE7CFC4AE77B44234905F671B39146830F3A6397FD63AC721A90D62E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660703, "uuid": "4f51d5ae-f269-4f3d-8144-b398857fc28f", "value": "1536:YyiCZFhocDB3E4Ryoqy8QNy4fxgAGzXv1VuMEDEnSXO8WYkf:YnC9oQEXoqwy4fx/EruvDmOkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660703, "uuid": "88e6dff4-fa80-418d-ad68-e467d25f5916", "value": 73392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660703, "uuid": "e1e68b7a-3856-4dcb-b31b-5d2dd1d01aba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660703, "uuid": "7165a4eb-305b-4d4b-9987-818d7ab210e3", "value": "b0d2c6f4c1d9c3675dcf54718cbba84b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4313d6cc-f65a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712657802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657802, "uuid": "cfeba0af-a6af-4651-be60-81838f576934", "comment": "Malware payload (AgentTesla)", "value": "fee2a733a3990cebfdf5e26150d108e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657802, "uuid": "1541d4a4-ecce-4a95-92fe-b6dc40807394", "comment": "Malware payload (AgentTesla)", "value": "c0bf9cb47e44f8f88727d858d6d9ca381ac2baaeb0c4be3d6423222bbcb8dd49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657802, "uuid": "accf051c-6da0-492f-aa8a-af7f396ce3af", "comment": "Malware payload (AgentTesla)", "value": "2ac6973a39fcecfcc35483ed1ad7c049f1d70c1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712657802, "uuid": "ead8f6db-5d26-4197-9c16-27e3454bbe4f", "comment": "Malware payload (AgentTesla)", "value": "c1409601365f4ab35b287739becd4b6b18a5a1f2f6a12fb1c20a8295848ba97b1c6f304d290e0a47cc903771e0e646af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712657802, "uuid": "7b3af8dd-0096-426c-ab0a-3706dfc6a580", "value": "T19F34E147F76798A1C4099A75C2876B180B719B433257C68B36CA73328D263CB585FE8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712657802, "uuid": "b28ee027-63f2-43f2-8669-d8941db282a6", "value": "3072:a+HjnsZDvtr+1ELKV32KdS/g15pjXOYY4EqfsXamvgb57KOggs7GmCMY7pdkJ:a+HjsZvtry/V32yjAjLXaSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712657802, "uuid": "4c821823-b010-4e95-86dc-88f3a4714d37", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712657802, "uuid": "6f55e1a5-4936-43cc-ac2f-26c29aa3e42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712657802, "uuid": "fe59295b-5fba-4b5a-b26b-6849e0fc41bf", "value": "Order No. 00004959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001d468c-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712674011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674011, "uuid": "443da16d-1d80-4d9c-8584-253035946193", "comment": "Malware payload (Formbook)", "value": "a4849ce0ff7b33fce8a4cf542449eeb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674011, "uuid": "cf9614a1-97ab-4fa3-bd80-2892b80a676a", "comment": "Malware payload (Formbook)", "value": "c10f72e90f08921781cab13aa7d3a9d21c961cf97f46590eed4c1cbc6ebc1d66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674011, "uuid": "2da10f03-c941-48c0-970d-9b34bbd7c94b", "comment": "Malware payload (Formbook)", "value": "a759a180a2edda48c16acf56d41736f59fc4fd4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674011, "uuid": "292e4c9a-afe8-438c-946e-7c0412caa19d", "comment": "Malware payload (Formbook)", "value": "2c50e6e735311bb5115a5796e161f40822b0ceff3ce19e6d2422624bd5083d7049b2ff3acdde3ba9f55044ddb2ba8ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674011, "uuid": "e87d72a8-ccdc-41ac-b154-969f98d5f58d", "value": "T11645C00273C1C022FFAB92334F5AF6515ABD69260123E61F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674011, "uuid": "8d7f9bd2-d137-4e68-9fc9-77a7a95fff3d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674011, "uuid": "6f95a5b8-2b94-45b7-bc0d-217b3de214f5", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8asWc1YFMvmdTOCipU2mcfwBU:WTvC/MTQYxsWR7asWKY0pKcoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674011, "uuid": "ef4db70d-cec6-4306-8259-b48696cf571e", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674011, "uuid": "f11e65cc-6f73-4fa2-97a5-f1981baf49ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674011, "uuid": "2c847d0a-2622-4b81-a188-0f0625353879", "value": "Remittance_90523_03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe14c9a1-f65e-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712659834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659834, "uuid": "f6edaf50-14ed-4ccc-9081-0bdea85f2cb1", "comment": "Malware payload (AgentTesla)", "value": "b2b5ab6a02a2e9a303bdee15d3453372", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659834, "uuid": "7023241b-fdd9-4ea4-83ea-a0b4173c2133", "comment": "Malware payload (AgentTesla)", "value": "c1d6725caaff450afa7f97a5087ddadcc51f58d5c225a3b9699adcce4c8e535a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659834, "uuid": "1ae07057-b1fb-4436-9a0e-96f5bcdbd0f7", "comment": "Malware payload (AgentTesla)", "value": "b8b19cede823c48beb5c30963b2eb8c9b651b44f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712659834, "uuid": "5b10e949-83f7-4393-b708-184fac4cda68", "comment": "Malware payload (AgentTesla)", "value": "70cf18239867883a5d91a5432a16aa0cc520f31efe8e8e138649f85a5ef486c6a46a272a47c82e70d5e0c331df8fa8c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659834, "uuid": "6acd46f5-7941-4103-bfed-0a068c09570c", "value": "T179E4234449FC13E09C05B2E37AB74C3AB4467C928B1BB49DF36A113BB91E94BA34915F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659834, "uuid": "6fa96ff9-7f71-414d-b08c-e694b4a9daf7", "value": "12288:liJCPp+GkW6luydab68xbMi5VzdOMeoTafeQvxN8GQBQFs04OKi:lj0GJqQbZFtOM5TafH/35v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712659834, "uuid": "df0a7aec-e5d3-4c05-b13c-1c0b4f160d16", "value": 691887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712659834, "uuid": "1d1a5e31-6217-4e38-991f-55181a24fdd2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712659834, "uuid": "e1fde654-6371-47a3-ae41-cdebfa41b921", "value": "SCAN_INCORRECT_DETAILS.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154d14f2-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692944, "uuid": "10379bc8-b786-491c-992f-a66cf3fa6475", "comment": "Malware payload (Adware.QQpass)", "value": "843071b56927a297d99bf6f1308437d0", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692944, "uuid": "f72a8112-f5ec-4a39-a6b8-0679ffa686d9", "comment": "Malware payload (Adware.QQpass)", "value": "c22481da9aefaba90d24a37f4d4a948edac1fd00d2da67b76047ba912e0b9174", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692944, "uuid": "6e15de47-d88c-4004-8a58-2d354142cab3", "comment": "Malware payload (Adware.QQpass)", "value": "86ad6ea73062c31cd370dc4f99ec7d23526a2868", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692944, "uuid": "7ed4f7f2-c646-4c7e-8c88-db56f51be1bb", "comment": "Malware payload (Adware.QQpass)", "value": "9b4432e5651d75f8a6eb2a703ccf9c64fd8f8e787d93c8a9fda76d812c16f667daf5a437055a342084a43f65d285d932", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692944, "uuid": "a4d7fab3-62b9-4214-8b28-dd52e2d44257", "value": "T1A9A4A61372319491E1595BFBA7BA433879F8836438B0CD23EBE4DD62BCB5122971A70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692944, "uuid": "ab382f6a-5ef6-48b1-a75c-208fcae7b923", "value": "d070a98a3bb72e151251c216b80dfd90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692944, "uuid": "92110f73-2de7-49ac-845b-344aed1b6ff0", "value": "6144:/vPBvEQR6H3Udg2FuHRfepwqHpA7b2+yO2COKCZT:/vpv/R6H3U25fehHpAW+yOBOKCZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692944, "uuid": "d35234da-0072-49ee-b700-35b43bb40e77", "value": 462902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692944, "uuid": "70ced775-eeb4-4628-9618-7cd325596a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692944, "uuid": "6efc4cda-73bb-45ea-93e2-8f239aeb46d3", "value": "c22481da9aefaba90d24a37f4d4a948edac1fd00d2da67b76047ba912e0b9174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8531db92-f680-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712674234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674234, "uuid": "b0199929-bdeb-4eb6-8447-8362740d13da", "comment": "Malware payload", "value": "27739cdade4ca83469bbc82a04f43489", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674234, "uuid": "1e52efcc-99b6-47e9-8552-f2b7616a96df", "comment": "Malware payload", "value": "c25973b6732f2618bf123dd6c63f6450f533f069a2e971c457943278778dbb10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674234, "uuid": "d75b6767-4a40-4b9d-a297-46f38a5d4594", "comment": "Malware payload", "value": "d2e1474247cbdd8a25d5bde6b2003f9d122f2447", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674234, "uuid": "b1d9b5e0-9d50-4049-a2d1-afbf51206b11", "comment": "Malware payload", "value": "1a6074f3abbd02cdc4a30e7e5256bf5cab8e3bfe83330c7af81b3dab64d75b9b16cc97a560a30b2bb6c8bcf7a35d3e10", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674234, "uuid": "e5556f87-fe5d-4a9f-9b08-c2fc6f03ca28", "value": "T193D26EAEB7A05CE48FE007A9693DE658D62C553276C047E6003C62BB16DF396C5F4E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674234, "uuid": "879c2cd6-d848-4db4-91f8-f44eecaf97fc", "value": "768:eJMK/nR4VcxSMR3DBSK3XmXuGg6gKeetAjqcAX:zVcxnV1xcuGg/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674234, "uuid": "f4ea093a-09fe-43ff-874c-dd4c4dc06ed0", "value": 29571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674234, "uuid": "8c31feba-cc93-4d66-835c-d1cb0f8535fe", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674234, "uuid": "b4d9de36-f1c9-4b3c-af2e-02ad9698521d", "value": "QmRFT7M3Lc8qePup54jaoa5woHXsJZV5fyyjwMqKtWwM8H.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163eb087-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.QQpass)", "timestamp": 1712692946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692946, "uuid": "1ec5c19d-fe86-4c85-aed9-8ab3cf18c055", "comment": "Malware payload (Adware.QQpass)", "value": "5fdcf3f0e6511088c1970859bbf42e2e", "object_relation": "md5", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692946, "uuid": "25e26399-0a94-4820-945a-ac1326bd0bac", "comment": "Malware payload (Adware.QQpass)", "value": "c32debb0f6e917375b8205f3f4bc2aa87b2970c25ff4622aec2d25a1571781fb", "object_relation": "sha256", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692946, "uuid": "aae3b7c9-9266-4a3c-b68a-a28153b5b9ec", "comment": "Malware payload (Adware.QQpass)", "value": "94542522c72d1c2925c99363045552fd94aff8dd", "object_relation": "sha1", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692946, "uuid": "ec96fde1-6625-4311-8426-e73b5cbda53a", "comment": "Malware payload (Adware.QQpass)", "value": "62d0c5a7820bc62cb857b74d93cb8bd53fcd7a0e0b46d90148234510109ed1c079548e0f968f6fe8177c58135f903907", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.QQpass", "colour": "#702EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692946, "uuid": "a42d5f96-b81f-4339-bd5e-56448fe3ef9a", "value": "T13A94E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692946, "uuid": "1a1da354-6703-486f-b45c-a74bd4f0d291", "value": "8c1a89a9ecb1531e781195470aa68b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692946, "uuid": "c237a281-6dcd-4764-bdd6-77a3abd2b2d9", "value": "3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUI:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692946, "uuid": "22ef8ab7-f0e6-459a-bcd7-aefc5211aa78", "value": 442081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692946, "uuid": "cc7bf409-47b9-4129-a35a-5b4003a52aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692946, "uuid": "f03660ab-4772-43b3-8e4f-89d7e377206c", "value": "c32debb0f6e917375b8205f3f4bc2aa87b2970c25ff4622aec2d25a1571781fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da84c6d-f678-11ee-a120-42010a9c002e", "comment": "Malware payload (remc)", "timestamp": 1712670732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670732, "uuid": "c8b1712d-6a0f-4332-b952-a4fc308ead5b", "comment": "Malware payload (remc)", "value": "6b7314e8a04ad8436c3aff06f3918ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remc", "colour": "#0A78DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670732, "uuid": "90c9946b-0bbd-4f06-a586-dc384fd25120", "comment": "Malware payload (remc)", "value": "c392c14304399e9ad13ede370375ecffa47f30245cb91a413a3fd1150721a929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remc", "colour": "#0A78DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670732, "uuid": "ed7f5cea-031c-4629-88db-f7808743c14d", "comment": "Malware payload (remc)", "value": "61c5aca05c76396e70054b732d9afb7d4a5e293d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remc", "colour": "#0A78DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670732, "uuid": "31a276c9-3a1a-4d87-bfcd-782b12a1429b", "comment": "Malware payload (remc)", "value": "d6c6a619ec5ac351f3ada3a0071c84a59873e80930df485e69491ddc2d405ed349573aa2e6bf1930837e989ff903a6cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remc", "colour": "#0A78DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670732, "uuid": "d17accde-7468-4210-8699-9f990e73c6d6", "value": "T1A455BE0273D2D036FFAB92739B6AF64156BD78254133892F13981D79BC701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670732, "uuid": "3fdb51d3-a546-49e2-844e-d9165b5778bf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670732, "uuid": "02bb85e5-6198-4a8f-8cf3-903d8c397648", "value": "24576:LAHnh+eWsN3skA4RV1Hom2KXMmHaUCTOhtduicYukHxavC55:mh+ZkldoPK8YaUC6h/qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712670732, "uuid": "4f1d230f-05ce-4f59-b6b3-a65d0a0f6677", "value": 1339392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712670732, "uuid": "ed7d6071-d513-4270-a045-488b2dc999c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670732, "uuid": "eeede736-cf90-40eb-84b0-1201f72635a9", "value": "wininit (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d549142-f618-11ee-a120-42010a9c002e", "comment": "Malware payload (NanoCore)", "timestamp": 1712629526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629526, "uuid": "53b26fc5-c77b-41f9-b128-23b5ecb077e8", "comment": "Malware payload (NanoCore)", "value": "82cdd037293fbb616b3ba2b7ab0077b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629526, "uuid": "e572061d-aba7-418c-80e9-4c19adef5c98", "comment": "Malware payload (NanoCore)", "value": "c39791b8b7ee23adde3bafbf1e5c6acf5c08f94137e2ef8b59a04b6d8760c79d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629526, "uuid": "66f16e1b-8e4f-45b6-a3e2-2b9f57fa81cd", "comment": "Malware payload (NanoCore)", "value": "dbbf596a74cb397662385267d2b15ca6b703cc85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712629526, "uuid": "370ef9aa-0514-4ddd-9518-4e86dccbbccc", "comment": "Malware payload (NanoCore)", "value": "3414fef9c7898b19f1dd657e52c525015c104a95467c1c4010fa77c2289f255c0eb3d382867286356b18039721ab44b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629526, "uuid": "c7621557-d461-4089-bb9f-f37e2763a50a", "value": "T1DA14CF5677A84A2FE2DE867D611212169379C2E39CC3F3DE28D455B78F267E00A0B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629526, "uuid": "aaa86c2b-24fe-4215-bd50-3062b5f7e044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629526, "uuid": "5b68cb4f-8664-459f-8eb7-84d45ca38619", "value": "6144:MLV6Bta6dtJmakIM5U6V2qhLyNPYTbEjfP92:MLV6BtpmkbM2uL4YTaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712629526, "uuid": "42cbbe16-380b-4c66-8b0b-293fb320cd9c", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712629526, "uuid": "76ecf011-3a43-41e4-be62-35f0b2c18aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712629526, "uuid": "667a5332-a1a6-43f1-a783-23764e752e62", "value": "82CDD037293FBB616B3BA2B7AB0077B3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1730e48d-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692947, "uuid": "8b016b5e-69bb-4905-9df0-d02a84d3208c", "comment": "Malware payload (Blackmoon)", "value": "958b7d91b2f26717432bdb2d9702dd3d", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692947, "uuid": "ca9b1502-7530-46af-962b-67ed2fff4ae0", "comment": "Malware payload (Blackmoon)", "value": "c3f5c40d9425e1325f36f856effb26cb832e09e78df9f689fddbeef0a386569b", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692947, "uuid": "889b6358-aa61-4de3-98aa-e561c5ce204c", "comment": "Malware payload (Blackmoon)", "value": "effe7ae84b9215f95d90c505d20a9e24bd754db5", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692947, "uuid": "b43ce05e-a35e-4469-a014-16aeadfb072e", "comment": "Malware payload (Blackmoon)", "value": "fc37052f7f8ca6f774d8a35249106064234558e27d1819b73d74ea7213756e456a528eaa4f0756d835cffe1e0493c3ca", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692947, "uuid": "82d0d1fa-95e2-4ef4-beb0-464e8468b9dc", "value": "T1CB84960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692947, "uuid": "e9ba5cb0-12e7-4f8a-a2f0-4b36df3e78f7", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692947, "uuid": "eaae161c-2317-4ef7-aca1-f7916602928d", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22N:7vqWQub2lrE0B55FpekPdb/22N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692947, "uuid": "cb5564db-08c1-4fa3-98fa-6cef7a9fdae1", "value": 406128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692947, "uuid": "c7aae55b-7dea-4e51-b860-14c9c28bd712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692947, "uuid": "1d54587b-5e3c-4b27-99d8-d24fe55b7362", "value": "c3f5c40d9425e1325f36f856effb26cb832e09e78df9f689fddbeef0a386569b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180452e2-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692949, "uuid": "3b8d3c13-16fe-4f13-bd53-74eabf849314", "comment": "Malware payload", "value": "9ae94f45ddeb6b91e4d2697a98e74d07", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692949, "uuid": "ccf81ae6-9a06-4bb6-8005-9d15cde8781f", "comment": "Malware payload", "value": "c40c47e6805b82f64cf15b6b90c1d8c9a5137a0a6c28653d9d80d6e52e4eff71", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692949, "uuid": "edeb85cf-2151-4032-8003-899cd73e6f8b", "comment": "Malware payload", "value": "c03dfc105d39b8c03f02f2d09c6fa8c0510dbe3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692949, "uuid": "4d6f4144-5640-4213-a070-21a31901f76d", "comment": "Malware payload", "value": "7faff886c9fad5f2584d26d18614fb934ea2706291daa77cd9c30d9880324f3feeaf781cab34dae9fbc127b835516ff3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692949, "uuid": "e471f7bd-30e0-4d5e-b97b-19173e174acc", "value": "T121E3F822E51388F6E02E05F557F2073C9979876368B24A6FCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692949, "uuid": "0971d179-91ed-47da-8519-ea8f8c2c39b0", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692949, "uuid": "55aeabdc-2118-4956-98a3-897f1019f75a", "value": "1536:rj+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy8R:PqSe5OmiEoAcCbZ6FNoutR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692949, "uuid": "21c47b46-edbd-4890-b437-98ce1a153f08", "value": 156903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692949, "uuid": "78beb3d1-bc92-49b5-9b0b-c5fb9eebc188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692949, "uuid": "9dc1bbb0-31f0-4226-8f0c-fd8962a01ac6", "value": "c40c47e6805b82f64cf15b6b90c1d8c9a5137a0a6c28653d9d80d6e52e4eff71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77183147-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1712651877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651877, "uuid": "bd2b4481-c927-4603-86b7-b6a3da02db80", "comment": "Malware payload (QuasarRAT)", "value": "c228f16074d1919a6bf30642a6e6541e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651877, "uuid": "744d9721-8dd4-48e3-ae46-d8e1204de598", "comment": "Malware payload (QuasarRAT)", "value": "c51d5d9f26091b859c64a0da81fd56382af4edf3137b4683763105f9b8d56cea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651877, "uuid": "d22279f8-b51a-4033-b210-4a23b953b81f", "comment": "Malware payload (QuasarRAT)", "value": "9857bac629403dad58ec15bb426bf5e6f5a006d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651877, "uuid": "87ec7bda-c4b9-4d96-96c5-3f99cfd2c52b", "comment": "Malware payload (QuasarRAT)", "value": "c9f41538ffab2b963b24ead54c2670966666022b873770beba3c7e10a6a6dd59abd1ff49669fb31d6b7796322a67e238", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651877, "uuid": "ced08ce5-ffc7-4298-bfd9-b2d958516b87", "value": "T194867C146BF85E27E47FE3B195B16062A3F0F82EB363EB1A518163793843B509842777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651877, "uuid": "322c182d-e49d-4cf6-961e-bb24291317f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651877, "uuid": "9ef01232-0741-4633-8449-352b834a120f", "value": "49152:FZtYpRqQM9Gdyd1hSparhzALoMwxrh/jjn5VlAOfTHHB72eh2NT:F7YpRXM9Uyd1hS45ALqxrxjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651877, "uuid": "bfc19a64-a051-4867-a0c7-a7e672dbe3e8", "value": 7967740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651877, "uuid": "1755ea04-0531-4cc6-be63-93f5ab077ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651877, "uuid": "be5066c0-6086-468b-94a8-2b2acaafce99", "value": "c228f16074d1919a6bf30642a6e6541e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb136472-f660-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660688, "uuid": "c2dabfb3-7f2c-4429-9e3a-a1356a3eecec", "comment": "Malware payload (Mirai)", "value": "69b35005aba805f8d2d7e7f827c52b8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660688, "uuid": "25e470e5-e275-4894-beba-ee491c13ca0f", "comment": "Malware payload (Mirai)", "value": "c53eb763638b61e01c80804a9741831464b6c1866e2ef2f8a34521c0e91a84e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660688, "uuid": "8b260186-cd28-443f-8aa0-32728a7e5d5f", "comment": "Malware payload (Mirai)", "value": "25a1559b1f8a3e1787e85e4687f7f2d474bd22c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660688, "uuid": "730edf6b-889e-4ac4-8ad0-292f6f55b8ed", "comment": "Malware payload (Mirai)", "value": "ed5a3aedd31c25ad0776d8bb89fe27c24f553c7cfab1581e5b45cdc069fba58fb229363cb0a640a54edf301881836997", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660688, "uuid": "13a1f0d7-335c-40ef-bb6d-f1fdfa8204fb", "value": "T1AA43F140D52C68C09A213964EEA54DE1F8264CDDB1FC7336233608E4BE635EF59AC7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660688, "uuid": "32cebcc3-7f14-4851-9e16-0ff7d1ce202c", "value": "1536:Z34lxVLp5/TgvcVwaGT6WWx4qm0LZ6qDIoRWne:ZoBLpFgvKjm6JeqbLZjDIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660688, "uuid": "205d7498-0f79-4def-9fb0-beed05bdb84e", "value": 57788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660688, "uuid": "7a15893c-4834-497c-b878-4ccdc42ba568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660688, "uuid": "03768df3-b69e-4212-9640-716435c1e0d4", "value": "69b35005aba805f8d2d7e7f827c52b8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2682f907-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712665915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665915, "uuid": "956c599c-4333-4ee6-890c-900088c50e82", "comment": "Malware payload", "value": "9f4e982473c7a2fe05ca9c9ac367d05a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665915, "uuid": "ef42b7d5-66cb-4c3e-b4ae-a3076b14e4b9", "comment": "Malware payload", "value": "c8ae3d07ff9c2446da444d8b15e8ad03a63378b02e73bdf28074add4f1227cd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665915, "uuid": "91d8dcd2-d9a6-4fb7-bead-29360cc773f5", "comment": "Malware payload", "value": "dae88e3ac7d0bbd100b5c2e758fb2a6ead30d309", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665915, "uuid": "d0edb543-6a30-48e7-9853-090519b28415", "comment": "Malware payload", "value": "37ed49d849a7732b18e86c4b33066282248b78ae6b7a14b3c0148bcb1d5ef22f801c9c2b0ac4c954ab704aad43d97d87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665915, "uuid": "53db3451-e5ed-4507-a82c-54e2f4825837", "value": "T168157C50D5D7A13BD4423A37EE9A93613393B6C21721A4FBD529C2E8A7BF6C1F0B1052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665915, "uuid": "690ef183-9254-4fc4-942d-ffe3f6afd320", "value": "12288:UdVnsVGz3I1Bvs17cgVQ6gAUgtbXSzrJG5PVoLugpLSmC2Ba4lOfGl0n:UdVEvs1nQ6FUgtbXSzVyyLuyLxa4OuCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712665915, "uuid": "7f2562eb-af1f-47f7-a363-55046ed3d575", "value": 879352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712665915, "uuid": "57c993fe-02cd-420f-8076-4802edce9dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665915, "uuid": "53dffc49-53d3-4201-8e58-71d7ca30099a", "value": "9f4e982473c7a2fe05ca9c9ac367d05a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85119a1d-f60d-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712624842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624842, "uuid": "0e2c62ab-179c-44ab-adc4-355a63110c04", "comment": "Malware payload (njrat)", "value": "0d4930c83a7b48f8a9885d438db4d62e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624842, "uuid": "f72d0901-9e9e-4d1d-b48a-dd736efd141d", "comment": "Malware payload (njrat)", "value": "c91d7eeea984c25fd82975c24a181e09751c25d3a97a440f15104ba83768c883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624842, "uuid": "ecd0c329-c085-46d9-8796-aef450cd1644", "comment": "Malware payload (njrat)", "value": "20efd02080a14edf16f27a14a6e73e58cd3a17b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712624842, "uuid": "28b60cb9-822a-4729-94bc-1d1d4572089b", "comment": "Malware payload (njrat)", "value": "a9b5e2195c46d1a422bb7ff9a036968064cbbf47f75e0838e04caef5c2475938c7d1dfae90fd1f27218391ee47c9ca6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624842, "uuid": "18b82004-ac95-458d-ae0d-abc560a36b5b", "value": "T18AE218067BE98215D6BC5AFC8CB313214772E3838532EB6F5CDC98CA4B676D00255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624842, "uuid": "b3a7fbf7-5320-4cbf-8815-7acdeb588287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624842, "uuid": "2726bc7a-b7ac-42eb-806b-22c23b87bae0", "value": "384:q0bUe5XB4e0XGOd/w0Q0mS03AWTxtTUFQqzF/ObbZ:zT9BuVi55dVbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712624842, "uuid": "bd294aa2-d5d9-4a26-af99-f19859da3e0f", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712624842, "uuid": "7dc0d62b-af18-4776-9152-8a5d5396fe31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712624842, "uuid": "2050c98e-0658-460d-bcb5-90f006c45814", "value": "bU41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18df3df5-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692950, "uuid": "23ed308e-ff23-4de7-9363-bc24707f5a0e", "comment": "Malware payload (Blackmoon)", "value": "ca51cdf8afc584dbfc9f855acfaacbc4", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692950, "uuid": "ee2edfb7-49e8-40c0-b104-2589e5e01eff", "comment": "Malware payload (Blackmoon)", "value": "c9d16bef43e551a8b97fc1e11990b60f0d3e74a81d48038a2a1455d165c879d2", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692950, "uuid": "3f9eb3f1-f79f-491f-8ad7-4210acca3290", "comment": "Malware payload (Blackmoon)", "value": "77236b5f70ccc7a3ace5fad56fc2ca69f39747af", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692950, "uuid": "5af89506-1f79-4fac-a19b-76241b4ec554", "comment": "Malware payload (Blackmoon)", "value": "d27873875cb3ea919f397395e467db8f91380fc261f7b5c8e751992b42b6a49df60688917abe49168b9884194adaa535", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692950, "uuid": "7003ac6d-1fd3-43a5-8b8a-133095645e23", "value": "T102B3F823DA0289BAE06826B521FB0738FA7193B91C750963EFD5CEB17C52631DB4364D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692950, "uuid": "74dca5a7-68f8-457f-ac5f-88b133621212", "value": "38777b3eb947cc68a2158922f2c92579", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692950, "uuid": "2215afbe-bf30-4a37-82fd-711199b96809", "value": "1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27qnrf:bav9OdPx8wJ4rm7qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692950, "uuid": "cf856530-ab75-465f-9156-ca83429c1646", "value": 116226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692950, "uuid": "2ef8928d-9f38-4c33-8264-2c5b20b74528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692950, "uuid": "8e3eda85-85c4-4bb0-be26-9ba3cc6995a6", "value": "c9d16bef43e551a8b97fc1e11990b60f0d3e74a81d48038a2a1455d165c879d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cec69d-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692952, "uuid": "b462f0b5-80d2-43e4-8235-96fdf7db62e7", "comment": "Malware payload (Blackmoon)", "value": "9f8072d74a8b1ba99b5766c4a1814497", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692952, "uuid": "c123467c-1678-473d-84ab-10d34c23d7ec", "comment": "Malware payload (Blackmoon)", "value": "c9f1a96c57c66cdc37181bcf0ea533d9cb32b96fe00c518c197e93723ed534f8", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692952, "uuid": "42155528-5de7-4c13-97ce-8a3c3d5b1a71", "comment": "Malware payload (Blackmoon)", "value": "4e1c2b0ef96849b01a4d10b50c4067b29fc6b1be", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692952, "uuid": "172ec83c-2de8-4310-b224-1add77e76ccc", "comment": "Malware payload (Blackmoon)", "value": "44a1d820ec8c289653d9e2c3e343f9603668f3d21975210defd98fa568c3a7c0fc9c8cec35717624036795e416d9366d", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692952, "uuid": "5c4e7ca4-170b-44d8-b381-2a1812de4605", "value": "T15D7496037221D891E15857FA63BB433879B8875538F0CE13EFE4DDA2EDB1522971AA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692952, "uuid": "fa7cf9ad-fbd0-4bd0-977d-fe633253c542", "value": "25b49c654871263df1dabac7d500b068", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692952, "uuid": "7f20f885-88eb-4f68-8f1c-7b614edc3139", "value": "6144:IXdaAfyvRwWoe2XlFSFb3bzpYpYFRQnyHWPBsxP:IXdaAqvRwWoe2XjSVvUYuyHWPBsxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692952, "uuid": "955015c6-7460-462a-a71f-2c6daa92588b", "value": 348080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692952, "uuid": "447a22e7-8935-498b-9db4-4b774b5b6808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692952, "uuid": "6deb8f53-c2a4-4aed-a631-a9240a3c53e1", "value": "c9f1a96c57c66cdc37181bcf0ea533d9cb32b96fe00c518c197e93723ed534f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abd2dee-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692953, "uuid": "4c96be1b-fee6-47ae-875c-991a6349b651", "comment": "Malware payload (Blackmoon)", "value": "b5265a21df49e6da5e3e93e92a3cf288", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692953, "uuid": "2b13d5b4-7acd-44c7-937f-0e8b74e00360", "comment": "Malware payload (Blackmoon)", "value": "ca594f5bb896a5277dced48379884891bd878166f4734d6beab4cda12df90299", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692953, "uuid": "6d611830-0609-46e4-8e59-10e8c5b6576c", "comment": "Malware payload (Blackmoon)", "value": "68da81e59064458d8ab381ea157de16a7695795d", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692953, "uuid": "267664d1-a686-4a81-a4eb-19599037fda3", "comment": "Malware payload (Blackmoon)", "value": "d73a6c86e41a12626ba10b7c7b712d8b45cf2975110e1af5667844725557d9b30feb747906bf5f4c812fc2928425f9ed", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692953, "uuid": "e176c4af-3f99-43e7-9481-4421dd964efc", "value": "T19F94E913B522A895E11457F66BBA473869BC832038B1CE13EFE4DDB1BD715318B4E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692953, "uuid": "3d4a4bb5-ec74-4e21-ba8f-9a675d5f4f71", "value": "bab84fd0accd31d5fe97afc63a9ebcad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692953, "uuid": "4146f875-a6cb-423c-a048-755f79c50192", "value": "6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAb:c4Fm3b7yOAHNar4mUf9lJ82scqAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692953, "uuid": "9532c93f-e161-4a03-a244-98072b7abbb4", "value": 442565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692953, "uuid": "77e2e693-12f5-407c-b5bf-0dfb289b5a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692953, "uuid": "368d78a8-e95d-443f-be08-4e0590946c1b", "value": "ca594f5bb896a5277dced48379884891bd878166f4734d6beab4cda12df90299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db25ad67-f614-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712627993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712627993, "uuid": "6112d81a-be05-4565-bbbf-87947bee7897", "comment": "Malware payload", "value": "e7f62d87defae267b5c8ae92c6f39c67", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712627993, "uuid": "15fb3faa-d073-4cf2-b921-9d9163771139", "comment": "Malware payload", "value": "cababb593802aaf73c5cde7b3060d70fd7cbdade15979c370098f128d8202752", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712627993, "uuid": "7ce9f45c-068f-4f06-b023-29f176e8d56c", "comment": "Malware payload", "value": "1f861e33f3877d42a821f5b6b150f7a3150a0f2a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712627993, "uuid": "1e05ae86-0278-4641-b6f4-29bb841e6aee", "comment": "Malware payload", "value": "e47065ccd51e0d27e3e8e383ed371c29f058dd775a745d0e3e68d5b713c737ecbdc33ac2eea29818956889d9bcbec7e2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712627993, "uuid": "0df6f76b-b8c3-452d-8a10-e01cd8c0ce61", "value": "T1B0E51213EA528167D6F9D3331A31266A20364C2587839325391C3BFF66BF9DD0F85AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712627993, "uuid": "aa4ef4ca-1df8-430b-878e-794c84b61b59", "value": "98304:fBAYwrnjBPJM5RuJut9a+/wj5CYs7xGFgQzf:fCnjBRM5RKut9a+4jYYsvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712627993, "uuid": "0d1b429b-aa2c-4d9f-9b72-65158f3fb37b", "value": 3259319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712627993, "uuid": "d5ee3a9f-b523-4ae4-a2a2-a30f0f12bef7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712627993, "uuid": "559afa58-f21c-45ce-a7d7-5e9252a6d222", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc7ceb6-f61c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712631353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712631353, "uuid": "0de1cce8-fe63-489f-adb5-57712b466359", "comment": "Malware payload", "value": "5f13a0a2f3ed349bd3b4f1b7dbfb6ff7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712631353, "uuid": "fd3db118-c7da-4287-a83d-9a689aecc9a4", "comment": "Malware payload", "value": "caf4c7e17a788fbd9f7f408ef818990e6ffffdd801b8168123ca4b330cb72673", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712631353, "uuid": "908df1e1-0f9c-4cb0-973d-c9890b1c0d99", "comment": "Malware payload", "value": "8853ec4dbbe8f2143bd97e7ab86b5fc0f7a4a482", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712631353, "uuid": "7de95979-f3ae-419f-8e93-2e1fe13683ed", "comment": "Malware payload", "value": "6d5422f67a52a0f8b61cd0e709ef516739cd25643cdcece1cda84f607a8012d63263cf8f02dc4b50adcceb9a3008d21d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712631353, "uuid": "fc1b1346-f957-4a33-90e1-dbdb1cef1386", "value": "T1F76423007EBA1635B1860467B27679B89DC444C31A25D33FE5A9F808FE69C7D813CFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712631353, "uuid": "3db576bc-526e-4697-95dc-130f46843c3c", "value": "6144:m2NBDvLWVvOir7cNu/e2VoLZZQq5pzYjFyQdMZGHq40oKdA4rDNV7r173:m2/uBO/NI3VaZaqXzYjAIHqbdXrJhrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712631353, "uuid": "b55c5b31-e44a-4cba-aab0-4c6b8dea6dbf", "value": 311156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712631353, "uuid": "eef1b64c-71fd-4256-8abc-374bbac0db7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712631353, "uuid": "7131252c-a005-4469-9b1d-b62f6cd26bc2", "value": "Incloser58.ttf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed52de1-f63c-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712645125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645125, "uuid": "13516195-e6fe-4c4f-9555-9a335ff47891", "comment": "Malware payload (Socks5Systemz)", "value": "9510123fa675c2b3b61b3e7254244481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645125, "uuid": "e875f770-1e1f-47d1-b28c-2afddb249517", "comment": "Malware payload (Socks5Systemz)", "value": "cb8ad948a9808706d763691a202b5ffe8cb2a3d4188b0782a0605fb85956a0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645125, "uuid": "a3fde5cc-7d8d-4762-81e2-0837e080036f", "comment": "Malware payload (Socks5Systemz)", "value": "2202a2dc2d061f025146b982f521449a3e2352de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645125, "uuid": "aed9cca5-4529-4133-92ed-8d846e7082d8", "comment": "Malware payload (Socks5Systemz)", "value": "45bcab57a8180ffe1fe12a315c92e0701a601e3792edd1ae712d6b632da86f06047d6d0734e1223361241b49a071f135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645125, "uuid": "a4ed03be-a832-4f1b-a1d3-892ef063e74c", "value": "T1B716338822B836F0E21585745D26F09DE36A7E608C61CDBAEE3CDFD96DCF584521BB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645125, "uuid": "f6b7be55-5329-4b13-af8e-73c2dcbd2791", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645125, "uuid": "c5a7dadd-51b6-4071-8116-7dfbee94cf80", "value": "98304:C1yVmO1OQxFcRxqzOX3BfWNWqd3GJclUd1b0hPG+KTJ8YqKiByy63CQ:m7O17xFcRxqalWN3t6n14hu+KGq3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712645125, "uuid": "b208f416-4b6a-474d-a84b-f773b5cee352", "value": 4073689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712645125, "uuid": "cdb0dbf3-8c06-4fc8-a1ae-f18653ddc963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645125, "uuid": "bea4e48e-590c-454b-99e5-6187b4957f23", "value": "9510123fa675c2b3b61b3e7254244481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6745d613-f652-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712654427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654427, "uuid": "e7c0f63f-a679-43b0-aab3-07def13cda63", "comment": "Malware payload (Adware.Generic)", "value": "74573c8933b08627d0d371fdee7158b7", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654427, "uuid": "7f3d395a-36f8-45e5-b63e-99223010f67f", "comment": "Malware payload (Adware.Generic)", "value": "cd0d808884277912318eb238f85bf3c5ab2ff5e8a00d643823b6f2287569f862", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654427, "uuid": "38d63233-e6ea-4825-9bea-3a897752ed82", "comment": "Malware payload (Adware.Generic)", "value": "69e15b0b3c58f18921748d23667a1dcbba89076f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654427, "uuid": "6b48771e-26eb-4fba-9ea1-1b3285b6315a", "comment": "Malware payload (Adware.Generic)", "value": "b6dff03148638a6b1e0a9f905090bbf0db818dc009b9ee37d2a2856e63b07757b4ba82537ab8e87d45f6937c98dc4a4d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654427, "uuid": "ab9bf678-bbd0-44ad-9989-45a08e532994", "value": "T1180723B7A3B8A42EC76AC73D4A73EE204633FD53A50D6C3A12E4191DDB35C305D26A94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654427, "uuid": "8af546df-6dcf-4660-8c11-99ab673b72c7", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654427, "uuid": "b32640b3-3fef-4183-b0de-9e8ed1762b96", "value": "393216:Rsl4CUbMF6JLPErjWGRGqCxuxX35OC4UPzxRw4gp:aUvLPEeGRGXuF5OC4otgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654427, "uuid": "bd36abde-19c4-41cc-b8ec-d842864a2d44", "value": 16990608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654427, "uuid": "0f191e98-4af6-4e4c-8f2f-7158150dbc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654427, "uuid": "dbb11943-0e01-4882-966f-cb5d0f027fda", "value": "SecuriteInfo.com.Program.Unwanted.2855.30449.17763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bd52d2-f63e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712645989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645989, "uuid": "aa5e8f34-d214-4dcf-9c00-7058a608e51f", "comment": "Malware payload", "value": "7aca152e7040f43dae201cfe01ce37b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645989, "uuid": "6731b0eb-bfae-4277-b69c-d14c06300896", "comment": "Malware payload", "value": "ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645989, "uuid": "ea66875f-4023-4391-b5f7-bf36ac7eb9dc", "comment": "Malware payload", "value": "83eb2fa2d400f96b241e61f81e4d80317eea0200", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712645989, "uuid": "b36a0c7d-44ef-488e-82e9-ce44e7515dc5", "comment": "Malware payload", "value": "7de035fb721609e71da16974aea819268a426b72b1459f0c392643050836b2522d251632f764993936c662c652982c16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645989, "uuid": "a4794547-b12f-4796-a04f-e2d8185273f6", "value": "T10B86335223E05691DA8478FFC9F12089934D860F4E1E1B799F295866F87EC1FD3BB0A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645989, "uuid": "e618b28b-4932-4208-bef1-ba446c8f1130", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645989, "uuid": "63fd3e25-081d-4466-891c-d0ceda95bcb4", "value": "196608:36daVHmaaDRVjdpOEMIUfEB92uOnffW1zPkHS3:KMHmauRNdUvIUfEun3ws+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712645989, "uuid": "9c6a5e4c-f66e-4494-ae03-4b2824fbd876", "value": 8073947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712645989, "uuid": "5d759974-0983-4359-8e41-f99f26ab2f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712645989, "uuid": "300ed4b2-fcd7-41a5-8efd-91ec70f7a53f", "value": "7aca152e7040f43dae201cfe01ce37b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbff744-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692955, "uuid": "b4dd6357-6e9c-4ab0-988c-7f81ce97d84a", "comment": "Malware payload (Blackmoon)", "value": "00066211a7e11d7f125763e6d63408dd", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692955, "uuid": "52ac38df-4e28-474e-a126-7a72be22e4da", "comment": "Malware payload (Blackmoon)", "value": "ce6162bbba91e70c1ce42992018a2806d6cef74cf8759dd8dbbf25373f079daf", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692955, "uuid": "c4fcd343-5a23-415c-b0a2-16309087e190", "comment": "Malware payload (Blackmoon)", "value": "3eb40873d149b8a0b1f0138db9c306ca2587b9a3", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692955, "uuid": "d2ddcafc-af3d-42fa-bc64-ba9a616a80bb", "comment": "Malware payload (Blackmoon)", "value": "dfb9b5e75cc9b91a8c37f67a6d620814b213439d279ae6a62ede0a05a51630cf81fa4c7b9f95066723bc5b73e43a2508", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692955, "uuid": "f9226b9d-b9d7-4f2a-abf6-4282da69d94f", "value": "T184A4B60372319495E1585BFBA6AA433479B8876438B0CE23EFE4DD61ACF5122971FB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692955, "uuid": "a4080e6c-765b-4079-9e64-5b608cdc7a35", "value": "adf05bf9eeae8fe5d0c65794156dc1c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692955, "uuid": "be807efd-d7ea-4ffc-a652-69e015a02da2", "value": "6144:sZrK+r+l0eNPBJrOxQD90saoTXWIg7mljhubb:sZ++qlRBBOxQDU2XWIg6Bib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692955, "uuid": "1bbc3e8c-3921-4ac4-b873-5eb563a1ae28", "value": 458372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692955, "uuid": "b84b5288-efab-430e-a842-cd71282aa598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692955, "uuid": "0749b540-3745-4872-a945-8122c3363dc8", "value": "ce6162bbba91e70c1ce42992018a2806d6cef74cf8759dd8dbbf25373f079daf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcee20f-f68a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678463, "uuid": "a3ab4463-67aa-4c00-8796-50137c356e0d", "comment": "Malware payload (Mirai)", "value": "f63c6f307b41ce26b8083f9b9444156a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678463, "uuid": "61867208-2915-4c53-8de7-8047c4ed6b58", "comment": "Malware payload (Mirai)", "value": "cec8fa5aa532c966d4d1569268e50bc9d3f96e0e60f2c52325345542285606be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678463, "uuid": "642d9e6d-8923-4ce6-8528-8a5c6b9dfdcc", "comment": "Malware payload (Mirai)", "value": "08a290aea626ebf91d27823bec73ac6b22c90ca1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678463, "uuid": "7c92b66c-ab27-45d6-9249-23c96b8865a4", "comment": "Malware payload (Mirai)", "value": "8a29fde3aa99285b8e5370b98d795799d7371cc9f59071b657b08163ae31f92a8589410341980fea0616f83019ff4946", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678463, "uuid": "af8360c3-f731-46bf-a787-815992396b13", "value": "T13B33C5A178916A2BC2E0137FF9AE618D336067A8D1CF322BC9111F15B7C562F0DA7B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678463, "uuid": "b8cdb94e-fecd-4d73-ad79-54d7c547ef9c", "value": "1536:9I6mvHvT8kHTwOIjMxA0ouH/zYoXsAlDFZ:q6oHvT8kAMz0qDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678463, "uuid": "a66d27dc-de47-433a-9f82-4d9110909229", "value": 50540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678463, "uuid": "56abd2ec-aee4-4fc5-84f0-ea6595f1667c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678463, "uuid": "0fe2c4d1-37d7-4702-8eed-05d7764b37d0", "value": "f63c6f307b41ce26b8083f9b9444156a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cc142a-f628-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712636270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636270, "uuid": "275c139b-b93e-464c-9bbf-99f62fe215b6", "comment": "Malware payload", "value": "89d94a847f5e5116ad9963a213106243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636270, "uuid": "bac2a450-c9be-4260-a723-808af8258cdf", "comment": "Malware payload", "value": "cf5ab3f891577e3d99fc814942651aaf93aa19a2914dabd350e5df3a8fba3246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636270, "uuid": "949a3b59-b2da-40a7-b0f2-e9bce7178325", "comment": "Malware payload", "value": "7b386456875b1c9ab06438b255aab3a23f45e607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636270, "uuid": "f509d421-aa7a-4b1e-86d8-5b941e344664", "comment": "Malware payload", "value": "84c5c2d305720641c58e19b527e7e61653cad6c27e7cbc2ecd72dd7fc30d8bfd0d1c187f839db435f857b8b133df8376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636270, "uuid": "70dc8743-e3cb-433c-8132-b2871ca34758", "value": "T1C2F49E1275D1C072C2732130AAB9EB7156BDFC324A354687B3883A696B742F26E34777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636270, "uuid": "9e896bcf-1d55-4a7e-ba51-99818f980572", "value": "213e0a4928f644955b6c40c3acf835d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636270, "uuid": "c91b5fb7-ae78-4f53-aaa8-71c99c6fe36c", "value": "12288:QNp51L0Z775xs2qnf8PtVXJSLKlK4pKJe5d0nocsxa3k48118t/HY4EErtkTd2h9:WJL0Z/mnet60yocssl8gY4hkTd2hCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712636270, "uuid": "69ad497a-560b-4db2-9ea6-de3f672b8f51", "value": 790064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712636270, "uuid": "abf11c04-3956-4cca-b648-1f9adc4ef725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636270, "uuid": "adeffc0a-edfa-46e8-a485-ee0801c9fa62", "value": "SecuriteInfo.com.Trojan.Siggen21.62767.22002.3882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb07109-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692957, "uuid": "29d4154d-9da9-45db-9f5c-5ee6d46f78f9", "comment": "Malware payload", "value": "ec221c0b18e1e431bda3c714a45db18f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692957, "uuid": "d0c4b7f4-d7fa-4fa4-99ee-2e79b203be43", "comment": "Malware payload", "value": "d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692957, "uuid": "b4f2444b-11f0-4458-ba28-53342773c711", "comment": "Malware payload", "value": "96b694c61f696110bdf5441ca63a0456382505ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692957, "uuid": "e4962ea1-cb37-46f2-88a9-b0e22d6077f0", "comment": "Malware payload", "value": "3d57310c260b1517e98092d7aa27fdd03906ce8780327ec0fdc17ca17362a6f0e793d7a5d5a46411afa5ac717297d992", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692957, "uuid": "1df11d4c-8758-4320-902a-45382a1500db", "value": "T1DF84960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692957, "uuid": "74e45254-9d62-43f6-a3f8-5bc50eda8e5b", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692957, "uuid": "f8aa1e4e-c3c7-4e86-be61-66c0833d1b68", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22u:7vqWQub2lrE0B55FpekPdb/22u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692957, "uuid": "75bba712-ebc4-4c21-9272-7134e7e6f32b", "value": 406196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692957, "uuid": "239eced0-e3c9-45a4-9e8f-9198fe22c1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692957, "uuid": "2a07b6b7-09f0-441f-aede-7d62c41f4b01", "value": "d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d92ebae-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692958, "uuid": "99301149-0679-44f2-9e82-1a4dc09382d3", "comment": "Malware payload", "value": "85856b48053a80d114d82e8fd378121d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692958, "uuid": "199d8b27-99d9-4f25-8221-6dada26d614a", "comment": "Malware payload", "value": "d05730ee2b3d890a67fe00d4b0b2e248a1a2606a1f6a2ecc8ab6a8850d0613c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692958, "uuid": "1e857a54-2c99-4936-8227-b9d421395f15", "comment": "Malware payload", "value": "7d2463cf431f00fa4418f0bc2b9c616af0a8bcb0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692958, "uuid": "7f71f75b-a814-4705-96bc-ce14d4008db3", "comment": "Malware payload", "value": "91a800aa439ec8289c258fb522fc1abc29c0ba07466ac8ca1fde8002cfb5e13b21d7596963a4d15a7980c6125273c268", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692958, "uuid": "0313435d-5187-4f07-a35b-da6b6bfde9a1", "value": "T1F484B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692958, "uuid": "787bf6ae-7b5a-4392-b834-e1139523d920", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692958, "uuid": "200fbcbc-4b9d-491f-9be6-7cb7e8cf528a", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1n:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692958, "uuid": "3507d0f1-1bd3-4aa4-9acf-97c8f121d3a3", "value": 375202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692958, "uuid": "97e8f10e-ecd5-45da-a495-2c3dc5e4a01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692958, "uuid": "c78842af-a492-4aa7-9755-cfa99eb12c1c", "value": "d05730ee2b3d890a67fe00d4b0b2e248a1a2606a1f6a2ecc8ab6a8850d0613c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679805f1-f689-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712678050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678050, "uuid": "f1be3cc5-e2da-4351-8f14-b4b62f43e177", "comment": "Malware payload (Mirai)", "value": "601eb78929ca61b3d904d9a1abb1286e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678050, "uuid": "55f65a0b-25b7-4b14-a866-720a26325339", "comment": "Malware payload (Mirai)", "value": "d0dd2529cfffe02a70e0fa8bb29ba856fa355abf495fa6a86a43f1a570c2096f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678050, "uuid": "33a5d08d-708b-45dd-a8f0-c3a8654daaaf", "comment": "Malware payload (Mirai)", "value": "eb14abe46552cd8a61deefadb1fa1883a9d9db8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712678050, "uuid": "4898995c-8bec-426b-ba94-1026ee3c5f4d", "comment": "Malware payload (Mirai)", "value": "a6eba0cc04c0aae093119bdb0b516b22c0cac409ade585a154a7bb11f2a762caa998f2025a9ffb29a15d625f79bf3aad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678050, "uuid": "1591f196-8c12-4f37-9753-39cae8503284", "value": "T168734DC9B4008D7CF94BEABE94624A09F932270076930F1B76A7FD936D631A57D02D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678050, "uuid": "dfe442db-40d6-4cc7-8161-139670ec34fa", "value": "1536:MHWVv05YzwIfa/kAqcaqSVnTkGqWlmA7vvPEm8l1QoH3GgvYj:MHFrunAVWZ8fQ/ggj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712678050, "uuid": "8188ca62-a509-4091-b173-e2c6e5f1ad10", "value": 75528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712678050, "uuid": "b2a6a5a5-12f8-4628-8501-552b8de28300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712678050, "uuid": "233cef68-20ab-425b-a8ba-1edf5b1a6a80", "value": "601eb78929ca61b3d904d9a1abb1286e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e75549a-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692960, "uuid": "daf1f889-e307-4412-9548-31e5fc9b34e8", "comment": "Malware payload", "value": "67fe18213d79fd77698b300eb47ca826", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692960, "uuid": "b4965245-11fb-4187-ae49-c5c18132cecc", "comment": "Malware payload", "value": "d1600eaff3288d71dd02b2c7bd2b827eb29087eec59f537a6d3084fda79e1d0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692960, "uuid": "3de910c1-3240-4326-9c88-0e54154b0395", "comment": "Malware payload", "value": "b9a09938d030058c1c6b65cd2d6e8362321a723b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692960, "uuid": "4515ef2a-4997-408a-aeae-6177e230ad59", "comment": "Malware payload", "value": "e560c77a52bdc867624c8de4d91fbe538fa8d88597c2f0368e0a668f9b57064fb26505ddac91aed0ccd2cae7ca1cd212", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692960, "uuid": "fc163e0c-511d-4476-a531-a95b93eff608", "value": "T1CA74950373219892E15957FAA3BA433879B8875068F1CD23FFE4DDB1AC71562871BA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692960, "uuid": "f838eb4f-9b4d-4133-afdf-9054b7824cc4", "value": "151644003187a0ea274c4b808e0d9681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692960, "uuid": "6ef1ad8c-a8c6-492e-856a-c2cf957f5605", "value": "6144:b5/YZ58drqrhGcbLhmvjSN6jZhixVK/B/zkXudep:b5/Q58drihGiLhmGNiZsx0B/zkXoep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692960, "uuid": "e4ea73ca-7f76-48cd-8769-6c85b0ca41b3", "value": 346616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692960, "uuid": "bfb59966-d405-42eb-ad2d-508a41c8ee2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692960, "uuid": "180d2c9e-6c39-401b-a426-d15aa2f17597", "value": "d1600eaff3288d71dd02b2c7bd2b827eb29087eec59f537a6d3084fda79e1d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76d181a-f674-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712669245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669245, "uuid": "d81ebcc2-5408-42f6-8fb4-52b7a8ff4f3b", "comment": "Malware payload (CoinMiner)", "value": "7cab469550467b3b5c7cf5e57d422ed6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669245, "uuid": "a6778836-75b6-4406-960b-015e60277147", "comment": "Malware payload (CoinMiner)", "value": "d1aa1b73204b7758385ebe0a12a31a259a65b8cdd9e8c6d036d8f09ecfaa4d35", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669245, "uuid": "b9eaafa9-2085-4b5d-a617-83f3920eff77", "comment": "Malware payload (CoinMiner)", "value": "6e7a20130c394e1474cb342bfcb5dfc2aa42dc3c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669245, "uuid": "b3d9507a-5862-4f09-89b9-a54c08423ae9", "comment": "Malware payload (CoinMiner)", "value": "8d692a8ef8afb064a5702a7cc34470ce0646d26bc3f58a6e0f8c00aaee28e9976882949f8ab44834e3cf3fb048745934", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669245, "uuid": "65d2b711-dd25-4740-b0b7-64ce8d51d3ac", "value": "T180667C03F85091A9C1EED13086669293BA717C585B3023D32F60F7B92F76BD86E7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669245, "uuid": "62d3ca6f-074a-4ac7-8cb6-ece46972d377", "value": "98304:5BbS3HOXEwI5c4707nxa3x0W8+mDTKpRz:5Q3dWnxaq+iORz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669245, "uuid": "0f35bf16-bd6a-4572-ac1e-099009a18830", "value": 6880252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669245, "uuid": "6a416d66-d38b-4eb1-aa1d-d2dcd64e5519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669245, "uuid": "7f8f4361-af36-4e14-a6bb-98d13be09606", "value": "7cab469550467b3b5c7cf5e57d422ed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9786b164-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712669540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669540, "uuid": "56d2dfaf-e956-444d-af59-07f661d5adb7", "comment": "Malware payload (Kaiji)", "value": "0829d5779a62ae9e503ea25e1ccf7f66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669540, "uuid": "e1147e3b-3a5f-40f9-9d21-1551873400a3", "comment": "Malware payload (Kaiji)", "value": "d1ac1fd68314fef52ef46db10f8623e7e166349de7c2a8267853e416680cbd33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669540, "uuid": "aeff2267-685c-48d8-94fa-432507328541", "comment": "Malware payload (Kaiji)", "value": "4f756dcb26af7a42ad85a031f0f9cc5c359c8e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669540, "uuid": "6f8fbd88-1982-4fef-9cfd-bee58ad33051", "comment": "Malware payload (Kaiji)", "value": "b824333b5ec793fe072326dcc702fb9bb572a0436e49e4c858f3fce6740daf65144399d56b7d7c5640f903c0bc22f85e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669540, "uuid": "ad439e4f-6551-4cba-a66d-dcd7a3cd86e7", "value": "T13C560912BF48DE0BE29431359AE7C23833D57D0986E021379652F71D2EBA2B49D1BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669540, "uuid": "2983f152-335d-431b-a107-76b29413f6ab", "value": "49152:hf0hwH+TnnP46/u4iUTLWbqtSWQ1wRp7:hfzqFZ0Wuwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669540, "uuid": "2b36de23-aa2b-46b9-9476-3e308bc84b67", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669540, "uuid": "50949183-10c0-4990-9f69-0d7a2a06172c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669540, "uuid": "2fe4cb67-47b3-41e6-b543-7a58705c6f8a", "value": "0829d5779a62ae9e503ea25e1ccf7f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97585b80-f66e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666534, "uuid": "68f4d7e2-c3d4-43fe-8c45-a694f37e0394", "comment": "Malware payload (Mirai)", "value": "f9a797b65032ed6617a18a1ac3b2fb7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666534, "uuid": "eb6d07a6-a73e-4dc9-bb15-565c7b57dbb5", "comment": "Malware payload (Mirai)", "value": "d4134a251eb02fc8057862afe1034607bd03a86b6ad15edc1360d5e705b3b3ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666534, "uuid": "ee84e5dd-76bd-413f-8a91-7625ba5b4d99", "comment": "Malware payload (Mirai)", "value": "fdb687174adb8d474bbdf654b2b73d35faa3b240", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666534, "uuid": "dabc35c0-c72a-4c7b-bc88-80e11a008465", "comment": "Malware payload (Mirai)", "value": "71159bafef1103ce2f3ad02efa19194c8919775c9631df8667f1d0d0ebc72d08f8b48875aedf66996cc965d955d157e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666534, "uuid": "b21efb07-d78e-4a75-8640-5904aee2d199", "value": "T1C1F2F695B8828A2AC2D462BAFB2F419D336273ECD1DF7353CC140B14A79B51F4E63A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666534, "uuid": "497d6dd3-8f13-4362-b843-6d27a71f8120", "value": "768:2/x8FuCeOMweMm3fiAlwaKdEGoCysTcSPlDt5Dr/N:258/eRfit7EXsTcaBt5Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666534, "uuid": "b5a3e905-0d5e-4154-8a66-c6967d78fb8e", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666534, "uuid": "ac9fc93e-f516-4166-a0b5-c3cd5f4faead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666534, "uuid": "f69555b3-9997-4510-8fb7-be78458021af", "value": "f9a797b65032ed6617a18a1ac3b2fb7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba950cb-f64a-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712650837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650837, "uuid": "cb212bbf-cd2c-471e-906f-483fea7aaf91", "comment": "Malware payload (RedLineStealer)", "value": "3d54324259c4957c2e24b7193feca396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650837, "uuid": "bdadacbb-4130-4995-863e-eb0145c9163e", "comment": "Malware payload (RedLineStealer)", "value": "d44a2e9c7678f4bcac865a90001c2dab150987dd61b343a1f18f84aa35e2ad78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650837, "uuid": "b978d732-f766-4ff2-a64a-166a331f39ac", "comment": "Malware payload (RedLineStealer)", "value": "3acd50f8dffd6fad410e686c3bb4c3f5f8a2945a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650837, "uuid": "a3a0114d-5912-48ab-b2f0-3d9423ae78a9", "comment": "Malware payload (RedLineStealer)", "value": "df96722a92d1175dd34c10e72b9f8a09c2ba31c114641a22fe28f1a6488e66bae44162932012d71b796c663a082ca4cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650837, "uuid": "27145527-3344-44f8-bf0e-4043738873cb", "value": "T175C48E81B709BD62D67B03F9948518600F71EDB9E806D316ADDB7FBE3E72361420252B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650837, "uuid": "e99f6de9-2207-4ef1-a5c0-e7cd2839feee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650837, "uuid": "3a9d2eda-a3bd-4a9a-b756-faa392bd1968", "value": "6144:zW9o2ayPpG1slY0tqJDRpcN3p0NIb88WsNMPaKFP3b2V122J0sL:zCayPpG1H0QJDcN3CNIb88WsNMP5F1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712650837, "uuid": "a42044e7-251e-4668-b4cd-a13641602d7a", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712650837, "uuid": "fbd4cc2b-1985-4d51-9b24-6f947dffe1bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650837, "uuid": "b19a476f-7b78-4667-8151-49dc7c74c05e", "value": "3d54324259c4957c2e24b7193feca396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a0b6ad-f639-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712643603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643603, "uuid": "ba9e4d09-5672-4dc7-9172-43406a317e59", "comment": "Malware payload", "value": "f24255fff0c4c402fd8c8df5a863125b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643603, "uuid": "1450b549-7152-4b38-9d09-348ffce0e921", "comment": "Malware payload", "value": "d4d555eee4c6132edb6e06e3f8df3a47221048901cc6f3d1722035965090f307", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643603, "uuid": "7d002277-2cc2-4d36-b89f-3f55b47c160d", "comment": "Malware payload", "value": "9db685265fba0c20aac7ff946931bae956c7c71b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712643603, "uuid": "95da5497-6b67-4f65-8d57-eee8a3a9a5e4", "comment": "Malware payload", "value": "4dfda025529a001eff442609dca3d3717b919a8db105b6c9347eaa60efb27edb342df4d2e5dabeb4ed1000c0c2c5ebc8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643603, "uuid": "77abe8ac-61ce-4fa9-8a16-9ccfc693cd90", "value": "T108B60115E7D806D8E4B7C334CA6AA723F6B1B85B4332D24F1626134D2F77A914F6B212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643603, "uuid": "361e3d17-4d2c-4d76-9b35-705f3afcad57", "value": "0e9dc1b983880b10378bec9074da3f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643603, "uuid": "233ac46c-3871-4605-90c7-15a0171d55c9", "value": "196608:gja58//oCBjL3XVbSTpc4LuCiunomIhdY9++PYu/+NU13gVA03:Ov/o2jLHlM642uzCy1PYmg603", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712643603, "uuid": "d2026b9b-39fa-4881-97a7-e4c4deadd876", "value": 11260866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712643603, "uuid": "e089ed5f-96f6-4b14-adab-830714df830e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712643603, "uuid": "77cee5f6-77fe-4c7c-ab78-e8d2b8df8a53", "value": "f24255fff0c4c402fd8c8df5a863125b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065ba936-f68c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712679175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679175, "uuid": "39ace9d4-6a19-4393-8ae7-c0627c291fce", "comment": "Malware payload (Mirai)", "value": "56e4c9749cd4cb106278557cc4763c0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679175, "uuid": "1f229d92-8029-4b69-9168-434dca6aa167", "comment": "Malware payload (Mirai)", "value": "d4d5ff38d0192de8e3bb5d7299b72f7224c5b010a7ec5beb591f24654a3704d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679175, "uuid": "16b8782f-efb2-4511-8978-a0fea8a6aed5", "comment": "Malware payload (Mirai)", "value": "a947382b58437cdd4001d7dae6dfe731a1dbd34b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679175, "uuid": "b9bb5ffe-8082-46e4-b1d3-ebe47cff63ac", "comment": "Malware payload (Mirai)", "value": "109a6ca0ef155bd2ceccaa45425897749e794afce2bdf997c11da6c1c9e490e287216f0b9ac9501f28aa1dd8043aeb8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679175, "uuid": "11c07216-772c-4dfb-b997-68a65d3a9cb8", "value": "T134D32B46FA814F17C4D5177ABAAF42493322E75593DB330689146FB43F82B6F0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679175, "uuid": "8c3f76f4-83f3-4c4a-9fc1-fb21799ab936", "value": "3072:H5BGWCtX4gAJFOszUfulHkJJaB+RM/9pVDA:H5EWCtXyJFOszGuiaBsM/9TDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712679175, "uuid": "685b2cb7-6392-4cb5-82eb-c310714d6aeb", "value": 130534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712679175, "uuid": "79a4d660-7a0a-4a8d-aa0a-2385837a291e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679175, "uuid": "26e56817-f2d3-4027-b7df-41a66c9a8216", "value": "56e4c9749cd4cb106278557cc4763c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d1c704-f670-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712667504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667504, "uuid": "2e721bde-a4e5-46cf-8af3-971243bd1857", "comment": "Malware payload (Rhadamanthys)", "value": "d4f6f26074165eea938a42d277dcfaa5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667504, "uuid": "d446ce6d-04d3-4cb2-a69c-05bb09d120fd", "comment": "Malware payload (Rhadamanthys)", "value": "d4fcc5c3329bc3d88b73fbb83fd5de22900553769eeb918460c3434efda2e076", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667504, "uuid": "3de44555-7564-4f35-8c77-50e4f23d8adf", "comment": "Malware payload (Rhadamanthys)", "value": "55845f215a8135f67e934c8ab44f03cbe4c3f33b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712667504, "uuid": "8ae516c2-b1cc-4929-b0d3-f8d58951ca09", "comment": "Malware payload (Rhadamanthys)", "value": "8cbaeb23745bed2427f71e28ed263f1efd868cf6afa7668d7dc2c3cad7ab07944dcc1f2f0817b6beec25096ac4bda32b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667504, "uuid": "181e99e0-e8a7-4841-b5c3-572ce70c6c09", "value": "T152C3129264E1AA6CD7662476E72F0D7DE083066008F20BBF01D283D94DDD9D3EEA5739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667504, "uuid": "390668dd-af71-46cd-88d5-e5eeb91fb25d", "value": "3072:c9IniV6jWHg/kN3ZJREGt2AIYXNbVNRdu64AXlIGiYQ0C:c9IcA/kNHG82AIYdbVNRo64AXFjTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712667504, "uuid": "9f1b361f-109e-46d5-8dcd-b0a8f2f148ef", "value": 124903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712667504, "uuid": "44a9a331-add3-4360-a6f8-834acc419104", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712667504, "uuid": "983f0aee-b68b-42b6-838c-0a46afbde7a1", "value": "DRBS9035.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372c0469-f677-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712670238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670238, "uuid": "b3878903-4090-45b6-88ce-9ba9bee36190", "comment": "Malware payload (Mirai)", "value": "33a8e76a76fd3d1e4832c487b3d29668", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670238, "uuid": "81ff94e5-c2df-4623-b103-b3e8918c89bc", "comment": "Malware payload (Mirai)", "value": "d5b0210a381652123b5e573483246fba02ca0e4a7a3e5dc65a7d3559be158153", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670238, "uuid": "55e93272-48fb-4a9b-9b6d-b41abfb35cac", "comment": "Malware payload (Mirai)", "value": "77ef74395084d983c7ec716df29f91f6b96d6346", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712670238, "uuid": "394eb387-6370-40e9-8b75-6c9b12b800a7", "comment": "Malware payload (Mirai)", "value": "6c6511a1312925db36eb72982d8047ba1f4cfeccd37f35f4edd815d61e31b0235bc7af0c735ed0729aa735a57770106d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670238, "uuid": "d19b06a3-464a-4e32-a9de-f91287d79165", "value": "T188C2D037A9C69CB5C7B16839B2A9C6CA1B5A2270D3F87235147816EC709F81A52F4387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670238, "uuid": "2a235071-cc31-49c0-80ab-9267618a1605", "value": "768:E1qDK6vmLcPO7mxn5y3N0Ae7Jg3/qrs3UozH:1JFxry+AOECWzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712670238, "uuid": "5a560845-baf9-4922-8dbd-ab56f5595356", "value": 27328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712670238, "uuid": "3ea25fea-bf5d-4165-8a59-c0f8b6d15ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712670238, "uuid": "9558d7fe-2eb5-4272-bd29-d0b5cebf3c01", "value": "33a8e76a76fd3d1e4832c487b3d29668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b8628c-f67d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712672806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672806, "uuid": "bb888314-e3a8-4e95-aa01-87db0d3ef5fc", "comment": "Malware payload (AgentTesla)", "value": "414cff73affaae2b4cd7aa145a32eca6", "object_relation": "md5", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672806, "uuid": "15025f0a-c8d7-47ea-a756-82a9c80203d6", "comment": "Malware payload (AgentTesla)", "value": "d5c04783b0c510586c3b48dd806bbad89771378054e6e7004fecb7c1c6f255ac", "object_relation": "sha256", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672806, "uuid": "fa19ccf9-4978-4664-b1eb-92c009b771b7", "comment": "Malware payload (AgentTesla)", "value": "fa4e06a3831139af1f82ba1eab0a07962e36562d", "object_relation": "sha1", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712672806, "uuid": "9c3f982f-d1a0-484b-8efa-48c0e0795189", "comment": "Malware payload (AgentTesla)", "value": "74f7233adfa487b9a452ec75e74725fcf0cee8f0dd431efde0a087851a35e03a75eeaaffb92dae3c324d657f02ee2b35", "object_relation": "sha3-384", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672806, "uuid": "66f61fb9-3312-4068-8ac6-7cfc2cff4db3", "value": "T187443B0B3698CB12D5E81EF980DF582063F2B68B9333D7892EC015E819613F65D9D69F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672806, "uuid": "ab570c39-cddf-42ee-9d9f-ebc2903661f4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672806, "uuid": "70fb35c6-dff1-4e9b-b42e-63dae45e3b6a", "value": "3072:pmj00QHO/LszB3BoyVZL6QZhp3MMREZI/Iqvm45Zac4L0xbgUNZssCLrZmrDy/zQ:P0CUwzBWcZWQZhpcz67gUNWLrMuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712672806, "uuid": "16a39574-469a-42bb-823b-2e500d863e1c", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712672806, "uuid": "49c2910a-8316-444a-82fb-903cddd1f001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712672806, "uuid": "55f555a0-a6cf-4275-8ff4-9a3d25fb0792", "value": "pinchs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62024d23-f652-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712654418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654418, "uuid": "01bf561a-4f2e-4ff1-974e-9288df39e9ea", "comment": "Malware payload (Adware.Generic)", "value": "bd1a384554fb3b134fece6afe295a257", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654418, "uuid": "803acaa9-7125-482a-9e03-3e8852a443a6", "comment": "Malware payload (Adware.Generic)", "value": "d7ae284a4d9e4412cdfac514b495351794372e509a308a3c800bb4d9450bd418", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654418, "uuid": "f29d1172-e571-4ea6-ae16-c75a61624493", "comment": "Malware payload (Adware.Generic)", "value": "aae2720d4b1f6c40185d2f668030d6ebbbb0202c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654418, "uuid": "59e9c658-8c17-4a3f-af6f-844bbe5e6cdf", "comment": "Malware payload (Adware.Generic)", "value": "e1dbe7fe1ebc410044c6a619aaffb1f6fea91c5c701d53950fef7a5cd9997f9ff7a60401617203d3248b47f595de107c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654418, "uuid": "9b07b45a-d291-487b-b9cb-fc09834c35f8", "value": "T1DB0723B7A3B8A42EC75AC73D8A73EE204633FD53A50D6C3A12E4191DDB35C305D26A94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654418, "uuid": "6e20eba8-a644-4570-aa9a-1ff1a40a1662", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654418, "uuid": "2863b836-a9b9-471b-866c-2b6fbeb5fad0", "value": "393216:Qsl4CUbMF6JLPErjWGRGqCxuxX35OC4UPzxRwDg2:7UvLPEeGRGXuF5OC4o4g2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654418, "uuid": "a3cbc63c-72e1-4e98-8487-80b4042792c9", "value": 16990488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654418, "uuid": "156c7d53-f3e2-4608-ad29-688b1e668a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654418, "uuid": "b328f4c5-fc6e-432d-8d01-ad49368603b5", "value": "SecuriteInfo.com.Program.Unwanted.2855.26168.2025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b07f680-f656-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712655990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655990, "uuid": "e9d78213-3b1a-486f-9c23-43ccb84be11f", "comment": "Malware payload (RemcosRAT)", "value": "e4a0aded4ee2d714f18285560eb1650d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655990, "uuid": "c1c7c116-12e5-4fe3-8201-a6853b779531", "comment": "Malware payload (RemcosRAT)", "value": "d7ff15f4c3137fdb8494be2d0322730ab174608dedb72d0c63c3d34eaac3c889", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655990, "uuid": "8cad2983-ed73-4845-be25-91201346faa0", "comment": "Malware payload (RemcosRAT)", "value": "8b7b46b3668eacfbb02a5ee5837c483d191aeeb2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655990, "uuid": "5a3d3644-c730-420e-99d3-ca8dea109121", "comment": "Malware payload (RemcosRAT)", "value": "61b7f521f45ffd2ada8652649af80153ff300904b66cb0e7f0046d684059546ddfada4aa4c46706ebe22efc326c92d57", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655990, "uuid": "5108c236-4d4f-4c83-9c9a-0d04bdb1ca48", "value": "T14E835B2DD34B02598F620377AB5B1E5442BDBA7EF38552B1306C437933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655990, "uuid": "cb444788-64c1-410a-ba47-2219e9394fc1", "value": "768:AdwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjjSAa9sdSBSOhlru44m:AdwAlRkwAlRkwAlR0SAWsxOsxf1Vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712655990, "uuid": "aaef0e93-9562-4e4c-a128-591a0ceb258b", "value": 86114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712655990, "uuid": "eccb682e-772d-47c7-bc7d-ad27535bdd71", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655990, "uuid": "4df465fb-69a1-4c66-9949-ecd57de85aca", "value": "PO173998191-2024.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6cc461-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692961, "uuid": "d6173eec-f8e9-49c9-90a0-d16e97e8e4c6", "comment": "Malware payload (Blackmoon)", "value": "1571f884d94db7f07543e38dbc02444b", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692961, "uuid": "77740d69-df7b-46e6-9df6-ab696168b8cf", "comment": "Malware payload (Blackmoon)", "value": "d80456fb7c7a5e59f4ac96cb980e42cfae2fa85ceea57ddde075e09929d427b4", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692961, "uuid": "fcb09ba9-4f2a-47e2-a7ee-34adef2eee00", "comment": "Malware payload (Blackmoon)", "value": "3d00ed31f7612e41c1dec06c8afb7f42663d4d06", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692961, "uuid": "fea51e19-0ce5-4873-9900-30d668f6361f", "comment": "Malware payload (Blackmoon)", "value": "ed7e5bc60bc928923c3e6064b9e5b8aa9ac36ed3cf4a8386d2c3187534aaa241e1f3be9cf53c09406d46fc3bc878103a", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692961, "uuid": "29cdf74c-b0c9-439d-b0f3-24db91c9d426", "value": "T19AB4EA13B6229495E1145BF66BBA073869B8836038B1CD13EFF0CEB2BD71531975E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692961, "uuid": "e80a8a6a-33c4-4ead-81a2-e156ce4c22f0", "value": "3bb3093a5eeb1047bbdd41c02a894dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692961, "uuid": "27443af8-4180-4b92-8519-9f0857587bda", "value": "6144:n0m2FqgDAuSbAXKfz0c0sUIJHtH/yWyCq:nZ2FBqA0z0cIeHtH/yWyCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692961, "uuid": "c9754903-f946-40a2-923d-08dc553d365f", "value": 531208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692961, "uuid": "0a182863-cbd3-4c9e-b2e8-9da92679d100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692961, "uuid": "e3bd379e-8d6e-4c5f-8ce2-553828617adb", "value": "d80456fb7c7a5e59f4ac96cb980e42cfae2fa85ceea57ddde075e09929d427b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ead393-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651855, "uuid": "9aac6637-13a3-4cb7-94ab-5caec0fb66f6", "comment": "Malware payload (Mirai)", "value": "a411917728a5a83a42f00c9f1aaab1e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651855, "uuid": "fb7ca35d-fb57-4cfe-8197-657cdc508360", "comment": "Malware payload (Mirai)", "value": "d81879d14f3bc04319bc95b976414e418fe4303ae2df257da99914be3de1ef37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651855, "uuid": "cfb009a7-28eb-4329-8505-efa31e66ea26", "comment": "Malware payload (Mirai)", "value": "d68e426346945a4e5f2e49d012c62b1e01a90967", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651855, "uuid": "c482775a-dffa-4ac9-ab3e-9c1e5f73d4be", "comment": "Malware payload (Mirai)", "value": "c474f77f4e3f63c1e37436966c535bec86c34bd32cbefc4d2258d75bc1b3534e177c070a657f2b530c0b33debe8a83c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651855, "uuid": "344435d4-8952-4daa-9e5b-cd32a558bc05", "value": "T1D9633B9AF401DD7DF84BE67B4457490AFA30E3D112830F3727A7B963BC721A51922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651855, "uuid": "949fc00c-94a4-4a70-b2fe-b74290ffd941", "value": "1536:y33sU9fjqxrHbk98QntZtZk0tNPfSE2nKX4EW97JfLg:yHskbqrbktsiP6E2KGdLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651855, "uuid": "ee7dc4e7-be8b-4077-920c-17b58e9b11aa", "value": 67032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651855, "uuid": "f3170bab-b382-4718-a75a-172c4417c165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651855, "uuid": "4dc91253-f364-43b5-ae16-8fad5d671a03", "value": "a411917728a5a83a42f00c9f1aaab1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2068db46-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692963, "uuid": "60a7f24e-d4a0-4868-b4cf-eab462c8170f", "comment": "Malware payload", "value": "cc8f938541333e0fed0acd7fe6483d1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692963, "uuid": "b1a415c8-9ca3-4a3b-abdb-c10e6539d85c", "comment": "Malware payload", "value": "d8d447ad44f1544f279f7732275d3310e84720a3540dd515d46f8b3b7460ce23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692963, "uuid": "27307e5d-4c86-42d2-a4ca-a770eeec50dd", "comment": "Malware payload", "value": "5881c25d8a9985d206d39272502e332201f39e38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692963, "uuid": "24b4a87c-89b0-4258-adbf-80f06a9807e4", "comment": "Malware payload", "value": "317c42532df5624f2ae30f8ccd011ee424990d0b08c78c42c66409611ae67f04b9646a5a30b24bb300d4a6c76cd615a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692963, "uuid": "37a779e9-9c07-4573-a7a3-479dcd13420a", "value": "T14194B5037221D891E15857FA63FA433879B8975438F0CD23EBE4DD62ADB1522971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692963, "uuid": "bd6cb17d-97b7-4124-af2c-bfd7325c41eb", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692963, "uuid": "caa79172-9416-476b-948b-279291fc8ed5", "value": "6144:5fweR7gpANB0sv2YYuwfDoOPV1x0GwYpk09RhyQ3ZmC:J1R7gpAwsuvDNP/xyqk09TyCcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692963, "uuid": "65b6b2aa-0820-431e-a7b1-13ce2df6e6f0", "value": 448412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692963, "uuid": "0ff7dcc4-6001-4540-86a9-276511641218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692963, "uuid": "a51df436-ca83-450d-a392-1b279ddf38e4", "value": "d8d447ad44f1544f279f7732275d3310e84720a3540dd515d46f8b3b7460ce23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc179cd-f630-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712640021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640021, "uuid": "1ff228c3-ef37-4fd2-bff7-b5048f1a3480", "comment": "Malware payload (Socks5Systemz)", "value": "dbe938c4fef8fcae971266c23d42a2fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640021, "uuid": "3dd40deb-f2e6-45a3-83e5-396b0676d2f1", "comment": "Malware payload (Socks5Systemz)", "value": "d9550d4c11681861c7596334d1c63398826b790751aede4f68edb3f605f627a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640021, "uuid": "70e0c881-c761-44d3-9176-65ad16d54916", "comment": "Malware payload (Socks5Systemz)", "value": "a53ad1315357a46aa2f00dbedf94290e57eef552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640021, "uuid": "c581894b-0f7b-4500-88df-3df907201ad1", "comment": "Malware payload (Socks5Systemz)", "value": "41520ad6a5aa395cbff7f54722e393f2483473ac1e93ae699a1da57f6a1861656262f18f3873d1761938f3213f5c2a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712640021, "uuid": "ee68d9b8-c980-4a65-858a-b4c0ca20b3a7", "value": "T1D7163321FE850C3DD361B576EC5F86394262B722092C62EC1FC803AF9B263554F5DA9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712640021, "uuid": "52dbc90e-0daa-4637-9fc8-f1e21b604035", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712640021, "uuid": "e8c60839-e712-4c56-927f-ee2d9c09d22a", "value": "98304:yiibCndb76PZdLIC5z6rMEkqhlzFwp4VLQZoPabJml8eNnik0kn:3i2ndbq3L7dulhlzCOVUUiOvNik0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712640021, "uuid": "da71ae01-3346-42da-b49b-29329f2b2dea", "value": 4410664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712640021, "uuid": "105d8cff-0d6e-4da5-8cee-f56233a5d94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712640021, "uuid": "0ab262a2-0b5c-4ff1-a4b2-3f40f825cd46", "value": "dbe938c4fef8fcae971266c23d42a2fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517677b3-f649-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712650525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650525, "uuid": "a5cace55-c296-438d-b18d-7b6fb83ce896", "comment": "Malware payload (Socks5Systemz)", "value": "c0a2945c0c4201f833bcc98bec1b9537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650525, "uuid": "c62fe7de-8ebb-459b-99de-12b733ead9b0", "comment": "Malware payload (Socks5Systemz)", "value": "d9ac901dadadb7225d28417085e5dc0ece5242bd974269ed82c0cebef9779dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650525, "uuid": "47f07d34-b6a4-4f14-8567-ba95e43a38ad", "comment": "Malware payload (Socks5Systemz)", "value": "58fb1e7294df0f280ee3a0e950a10446bfe37173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712650525, "uuid": "9aff671d-5b35-494c-a324-2837d383f190", "comment": "Malware payload (Socks5Systemz)", "value": "f47d25375fabb813a55b553e80adecd30e6f78e00e489af395e9b77f7c032d174940f185bf045ac86100da86fa839cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650525, "uuid": "92bd5254-dfcf-4349-abfb-7e9c700b8b1b", "value": "T12D2633236FA38C34D919C7BCD9270847F177F4A029F6A75E76C89A890B58361196E333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650525, "uuid": "4292c739-2dc0-463d-bdd6-161856db6115", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650525, "uuid": "1705ce0e-f4a7-4380-ac1d-e8aa95d75837", "value": "98304:Ig8kugmoJfJrVSMX+Jb1a1eEucTa+uLnclcSpF90ULt0bxpXEIRl:z8kugmWhAMX+J0yjWcKFDLGbL02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712650525, "uuid": "eb90a94c-6817-4778-a5ff-67be0b45cedf", "value": 4538032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712650525, "uuid": "a59756e0-2337-48a3-ad67-d64e90ab483e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712650525, "uuid": "b4b4af9b-d741-4491-a5bd-ca4fd6c59528", "value": "c0a2945c0c4201f833bcc98bec1b9537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217c5294-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692965, "uuid": "728b3177-a6f7-407a-93cd-408977bd59a3", "comment": "Malware payload", "value": "184a2b6302dbf4c535de9028e8b1a0df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692965, "uuid": "955ebe21-361a-4bed-8618-0ef008e45ddb", "comment": "Malware payload", "value": "da0bb5f11227cab027e66a6dc2abfbe01f9bbcbc3f3908e2ad2f49b20fa525a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692965, "uuid": "752108e1-ba27-42dc-8450-2df5c6a3b1d6", "comment": "Malware payload", "value": "d58d5df05240e5c5a1d1e125b12ad9ac3a587f57", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692965, "uuid": "aa4e20a8-ba41-4a25-a7ae-e925ee0dd621", "comment": "Malware payload", "value": "c525e2bcb04144d86f44fe58a0538da2a825f79e285ec9822c626041dd24960dbbd0384427705de3e527d03cff3bb8f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692965, "uuid": "442e2b52-784c-4f36-aa35-76347c645a39", "value": "T170B4C813B522E495E11457F66BFA073869B8836438B1CD13EFE4CDB2BDB15318B1A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692965, "uuid": "d88a2aa5-8f87-47f7-8326-99cc59663e74", "value": "da4a387004bf1285d93edaa4d5233098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692965, "uuid": "e482b36a-1911-4b03-9488-a7fed8795d10", "value": "6144:0wGdR+Yk/N8duBmG6t+UnRsRCQ/OJBr7CCnv:0woR+Y4NSG6oUnRsdOJBr7CMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692965, "uuid": "19a83e12-f00c-45d1-b29e-aa870ea248a4", "value": 531067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692965, "uuid": "2332d110-394a-45e9-8b73-5ccd94176b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692965, "uuid": "419180eb-d876-4a83-862e-4818482e515c", "value": "da0bb5f11227cab027e66a6dc2abfbe01f9bbcbc3f3908e2ad2f49b20fa525a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b00387-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669556, "uuid": "0df8c3c1-18aa-41c0-9441-7502931bc559", "comment": "Malware payload (Gafgyt)", "value": "d657384df7acba4761ae120e1272cda7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669556, "uuid": "763045c2-e33c-42bd-a4cd-7ebe9c416693", "comment": "Malware payload (Gafgyt)", "value": "da0d8bc60db366b1924d7033d176921f74e6ec6eeb2c53e200be8858fd53cb75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669556, "uuid": "af210da3-6efc-4683-803f-85f5d35de8b6", "comment": "Malware payload (Gafgyt)", "value": "52784dcb3fc57e59294ff5fe4b2e4b712f1c3048", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669556, "uuid": "15ba203f-f4c7-42ec-b960-9abe6824f467", "comment": "Malware payload (Gafgyt)", "value": "3f58066e3e1f179dd87b0d0dc82564c2e794b0271e4edc4c773a6fce6dce567601f195f1b2a1056f3de33dc3784e01e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669556, "uuid": "5c46ac55-458b-43cd-a69c-b578d9349925", "value": "T13214F8627706896FEC6957320AE7CFB8A394E5F321A0464BF62D7B1C1F611C94E48EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669556, "uuid": "ef928df9-e443-4b50-9d1b-222f8d6a897e", "value": "3072:yXW8rggc4WKkt7s24kvWZRmIzjD9gZIKCwF4kVmM6YebH7CP:Qc4WKkCivKRvSmM6YkbCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669556, "uuid": "2c240b1f-7e85-44e3-ba2e-bb697e788dfd", "value": 204844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669556, "uuid": "8232a7a7-d095-4c2e-9952-b7c6a4b79280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669556, "uuid": "30453feb-285d-4b33-9752-2e2d3499931a", "value": "d657384df7acba4761ae120e1272cda7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22770b09-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692966, "uuid": "b658b670-64d5-44bd-8cea-c9d80d149728", "comment": "Malware payload", "value": "83100d87225713218ccfdf8bf824e811", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692966, "uuid": "84a0ee1c-b606-4030-a070-a71770919b7d", "comment": "Malware payload", "value": "db7b4cc021cf533b96f8e7375ac0becc4d25217e68a2e874a3a54d6dd8d92b91", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692966, "uuid": "65ac27ca-3d1b-44a3-82c2-60702e5adf94", "comment": "Malware payload", "value": "724dfdc25f99e736bdb70cef6c3888b51a9de921", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692966, "uuid": "ee9b6c47-c408-4577-8f4f-1c7229a1b5c9", "comment": "Malware payload", "value": "a2261a9fa09f0af27d309b510f88ee568934e4a041f195340a598bf8f3329a78c82f840bcd225dc9dc19393acc6a41fe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692966, "uuid": "b781b6cb-23c5-4438-a177-206e9ca1ccaf", "value": "T1F384960376219491E1595BFBA2AB433879F8976438F1CD23EFE4DD71ACB1121871EA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692966, "uuid": "b7259d0e-302a-4b2a-900b-54364beee346", "value": "28823d9b8ba3cf79ab18aa635deb1031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692966, "uuid": "72906010-e83a-4569-a729-c482b57901d9", "value": "6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22s:7vqWQub2lrE0B55FpekPdb/22s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692966, "uuid": "c38d0225-496b-41c9-8764-3a2a9763b1e6", "value": 406142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692966, "uuid": "ef0bab91-d772-4d1c-9747-db50391560e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692966, "uuid": "979f8d91-23bb-445b-bd67-952c31f139bb", "value": "db7b4cc021cf533b96f8e7375ac0becc4d25217e68a2e874a3a54d6dd8d92b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eec3316-f66f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712666949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666949, "uuid": "732643c9-418b-4f81-93b6-eb98d6ae6cc8", "comment": "Malware payload (AgentTesla)", "value": "5356bf5341a1e2507f0c5442b9fb8880", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666949, "uuid": "91423bd7-9f42-4323-b244-4ea3ebfdfcbb", "comment": "Malware payload (AgentTesla)", "value": "dc9592af2ffbbfcf84b85b78b82608017b1fa5c5f406ba9ecb6c03d4a50b9697", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666949, "uuid": "02aa964c-8328-49c7-bfff-9b11ec7675e0", "comment": "Malware payload (AgentTesla)", "value": "c5195a71c60290a4383e2269b796694d383e56fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666949, "uuid": "8a43589e-96bd-41bc-840c-b14dfb036af7", "comment": "Malware payload (AgentTesla)", "value": "f5f57b3cfee3d09b71790367b7250a2be88c11807374f950c421f2eceb03c75c7b2dbb2b04ad969fb124ff5bc943a9fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666949, "uuid": "0a374a84-702e-4552-bbe6-c651745823e7", "value": "T108340D037E88EB15E5A87E3782EF6C2413B2B0C70633C60B6F49AFA518516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666949, "uuid": "03b7538c-34f8-4404-bac3-4d801b675e1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666949, "uuid": "45ae0427-d3e9-4dfb-81b3-884c19870f4c", "value": "3072:lgQRfeCmyQG4Ovza7bErD7Hp8TXUItgsT5US2I8R0:lgQRfeCmy14Ovza7bEn7kRgsCI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666949, "uuid": "f3191c7b-6b53-4fe4-a05f-1fba9b102479", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666949, "uuid": "47b85643-25a0-4a44-b440-e90d3d210dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666949, "uuid": "015ba727-67ee-4061-97dc-ca4e4bf8d9d7", "value": "dc9592af2ffbbfcf84b85b78b82608017b1fa5c5f406ba9ecb6c03d4a50b9697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398175b9-f674-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1712668953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668953, "uuid": "caea9438-0bc1-4ddc-9757-e616e212fbcf", "comment": "Malware payload (Kaiji)", "value": "bf8a7e195f5f26bd8f408c19271db170", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668953, "uuid": "83814df6-f93b-42f7-9d42-ee66860e1675", "comment": "Malware payload (Kaiji)", "value": "dd87ef996f3aec3765b427b016e51c662cd83dc367891ce1e534d174bfe579c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668953, "uuid": "a9ad4c72-df17-438c-8681-a9c0f2731eab", "comment": "Malware payload (Kaiji)", "value": "7e7e5524ed6cb542aad38eb3757a445dff745aff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668953, "uuid": "f9357f72-9b0c-45c1-b286-fb0018901a1b", "comment": "Malware payload (Kaiji)", "value": "4f8c720869051cf2cb34ca5fa1a8d549c51381aec12158bb68bec3e6d0b784712541622cb1404073f39c25c0790ed742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668953, "uuid": "a82cd135-f199-4fa7-8eac-ac6c4e53335d", "value": "T1EE56F805ACC82BA6C06D5B7485EACE6163B41D085AF14B362654FFD8BC762B4BF07C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668953, "uuid": "096e0a11-3417-4e48-8548-de5c1084000b", "value": "24576:avocWXZYzv15eZ6kh9wZhZkvhKRuZBAPZJqh9xZH5xJloaRgkZzILs/1ppAp8epy:KtztascbyLs+4wpZcG00mWU1I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712668953, "uuid": "0c16c0e1-d5ff-4260-98bb-c749c1f8b5da", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712668953, "uuid": "2b889888-600e-4246-b869-f7cbf189af1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668953, "uuid": "2a8749ba-1bd3-4a86-a21d-dd6d021d8bab", "value": "bf8a7e195f5f26bd8f408c19271db170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233f6490-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692968, "uuid": "53bcd956-66f3-4a98-be18-f70114013513", "comment": "Malware payload", "value": "ac7f0bcf8d1cf567f3c7bd02b962777f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692968, "uuid": "f88e21ad-48ad-4f72-bb7e-2f09c922dc15", "comment": "Malware payload", "value": "de3d0dbbf22c024c84d7fef06c77652c5ee5dd2e7cbc7c8d9835effce04e346f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692968, "uuid": "d6e248f0-365f-42a8-9da8-7e14afd35c0f", "comment": "Malware payload", "value": "e9ddc4b25b3bec304b8d9b234a7c6a7a456e77f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692968, "uuid": "90c84ee5-7e56-4fec-bcfa-e40840badc7b", "comment": "Malware payload", "value": "ea49abfbeb7bd681ebe31a0c2f44fc3b0308c98c06d77d313f03aa107ebd6eb3740eb7e591a7d19746d60989cbab651d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692968, "uuid": "71926d67-df74-467f-8fee-9dc968a87394", "value": "T16923AE03ADC249F1D825027639BA073DFF38C1856D31865BCBB1EEB02D73226752658E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692968, "uuid": "c2471649-e07b-4cc7-98d6-c040e759082a", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692968, "uuid": "ac5ea3d3-e850-402a-bf76-56bb4811c1c6", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSyDt+4JL:w0hAW1iqdWNzI5Pd4CSyDt+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692968, "uuid": "9ed0f11c-43fc-4b4a-9b98-264c24fe7852", "value": 49574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692968, "uuid": "a7e16433-be31-4fa7-bed3-5cfe95d9636b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692968, "uuid": "d5b8dcb6-4fa1-43fc-911f-cfe7a02d60e4", "value": "de3d0dbbf22c024c84d7fef06c77652c5ee5dd2e7cbc7c8d9835effce04e346f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a08689-f69c-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712686444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686444, "uuid": "0ca2276e-d7e8-4bd3-ac9b-465a6fc12eba", "comment": "Malware payload (PureLogStealer)", "value": "e93bd9e06b8b09c7f697bff19e1da942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686444, "uuid": "547483e5-02d8-4812-b712-9f9858b9d877", "comment": "Malware payload (PureLogStealer)", "value": "de74d9f4418390f531456319015719dbcee1d5692b4b19800e7a492218d0badc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686444, "uuid": "660acde8-1a05-484e-8477-3487f3ac2da6", "comment": "Malware payload (PureLogStealer)", "value": "a5efe9e9115a9d7ca92c3169af71546e254d062e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712686444, "uuid": "8a3cd4b7-fad7-480b-8333-90a91894084f", "comment": "Malware payload (PureLogStealer)", "value": "32eb041f8791c03e6315b9e30703dd1c2124487eee075460b1abaad4aa70b28f1ae4923349a63e9f50d3b82926e817e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686444, "uuid": "67224758-85a3-4068-a232-5b9ff957a0b6", "value": "T1CF23C0521BE88722D973AF716CB95A106B76FB26FAF2CF0E0425010F5972F444BA1F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686444, "uuid": "94bba11f-fd3b-47b5-9d91-d889ce379dd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686444, "uuid": "bb0080e4-ec46-4585-8140-1d1f9d91f37b", "value": "768:vgldQdGQgrLcynjI9+cgA3YyuUYDnom96d+AH1FxotCJbadWONHmTIJSeK:vCdQdGbrLcEGIA3Yyu7Dnom96NHfutg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712686444, "uuid": "6b06e29b-dabb-449e-bd17-2cee7f96706e", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712686444, "uuid": "29b846a0-562f-4d37-a7d1-292ecd65a25d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712686444, "uuid": "fc9fc71a-070c-4885-b6f6-f724d32d6273", "value": "e93bd9e06b8b09c7f697bff19e1da942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21125e73-f688-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712677502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677502, "uuid": "efc82ee7-8f35-4fe4-890f-b9e030bf4646", "comment": "Malware payload (Mirai)", "value": "f99e94b680b2368bcc6a393aac5d2644", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677502, "uuid": "2bf12639-206e-4f07-9435-04912d6ff64a", "comment": "Malware payload (Mirai)", "value": "de88e29d0b14eb903d947330ac0777eb7155724a2bd166775733b48531d2662b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677502, "uuid": "c7e8bc88-bed7-4302-b98b-9bd9db8d761a", "comment": "Malware payload (Mirai)", "value": "ca194633013718d532ac055b039b779968532cad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712677502, "uuid": "a154da60-2a27-47a4-9205-74059caa4f08", "comment": "Malware payload (Mirai)", "value": "995020cf9fd4cd57af92c5be72bed97f707aeab43b8673655c5004c4d7d4f7255143e2277f724322291bd800b0599571", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677502, "uuid": "7ea3ad9f-a2c7-449e-a890-d5970d1a0205", "value": "T16263C81E6E168FECF79AD73547B7CB25964837862AA2C5C1E05DDA011E7024E340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677502, "uuid": "6d09e02c-6b90-4c06-abe5-8dd174090d1b", "value": "768:YGOe6SGZITX7DmBfpz/1CaFvwulyitTkdtTIlvxvGXDCPP7CTVVm6z4UaqAbH5MS:ifpzVFvw0ylkvzCTVVv675MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712677502, "uuid": "f7ea1a64-d965-4dc2-ba54-65f8b1c0acc8", "value": 68908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712677502, "uuid": "cd1ce725-b159-4735-a6a4-b1003ee32db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712677502, "uuid": "c07b36a5-e4fc-4bb1-85f8-160073fb3a68", "value": "f99e94b680b2368bcc6a393aac5d2644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3b1090-f652-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712654432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654432, "uuid": "8276427f-c5ef-469f-b53b-a2c962a5d686", "comment": "Malware payload (Adware.Generic)", "value": "60096e4d31e47d6eda29c6a784acc69f", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654432, "uuid": "2003832d-2dcc-4880-b9f6-c61277c1f396", "comment": "Malware payload (Adware.Generic)", "value": "e09e207da7d917442a893efa1d798d2cec4ce960f189638f7a92ef35169f56a4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654432, "uuid": "05da1595-490d-4e8b-81bb-3913a091839d", "comment": "Malware payload (Adware.Generic)", "value": "021eb62bfccf0e2f6852f0b44da196cd0fbca6a5", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654432, "uuid": "903f4c22-57be-4ce2-a43d-4e0cc1e031d7", "comment": "Malware payload (Adware.Generic)", "value": "2a8a5e2633fe5bd090e2e3612be14b8cb452da66be60baf6fbc7f5fb604026ee724380472a979019ded2d6245d836325", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654432, "uuid": "6730d480-1b03-4b1b-9d91-b87fb58c3db4", "value": "T16467337BF124B92EC8284A324076E12044FB6F1965560C4E67F83E0DFBBE1517EBAE45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654432, "uuid": "c9b2d224-c3dc-469d-871d-6aae04f8e65a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654432, "uuid": "44ef6c84-27e0-4c11-8532-f670cd7f2196", "value": "786432:LFnShjsZHgskk7aj2xAgODhYc7lCUt9ROXBF3a:xnShCHg87aj2+gMjMiOXBha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654432, "uuid": "65a083e0-a806-424a-a695-0aaf88fc77b2", "value": 32379408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654432, "uuid": "7520429b-b77e-4e2f-9912-5ef0e955751d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654432, "uuid": "edb9750b-68b2-4101-9bc2-65941a041c4f", "value": "SecuriteInfo.com.Program.Unwanted.5387.28487.7038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf74365a-f675-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712669607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "0b06bb8c-336e-4d2a-8def-2cd72f04f25d", "comment": "Malware payload", "value": "bd3ba7c4d050f0d9df3406b494c9b2f7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "0d01f7ba-0d72-4620-afcd-0aa502f727eb", "comment": "Malware payload", "value": "e0b7e6e6ab305fc27a4ad3b64c67187c69df7adad99311f249c73c3349cf92c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "a889b2db-061b-41f6-9ed4-e1ba3260da03", "comment": "Malware payload", "value": "3ec2185e1432be59d91d851942401d64f7aeb7b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669607, "uuid": "09a3f4ae-579d-4153-b02a-29fc40206096", "comment": "Malware payload", "value": "4a8531adfa7d416b7f7a1bdf8caef26a774fb938761d464aa1164d5deab17e5f022deab1567e55a026729391d68a505d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669607, "uuid": "2bba7616-ad2c-4546-812f-34a024784db6", "value": "T1E685E111B682C062C0652630DC5FF7B6AB65BD308D68765BF584FB3F7970182DB1AA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669607, "uuid": "a7c21df8-9a86-4add-848c-e37a4bc9fa44", "value": "a5ee92095edb5993095c9c7315eaded3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669607, "uuid": "4dda4355-2d99-43cb-9000-531a93b54f97", "value": "49152:qSRWYL/eXV1i/kmeE91qj4iZ6YaycLzTF:xRWYL/eXV1i/kmeM1qj4iwiAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669607, "uuid": "d20cbd0a-7300-495e-affa-088e071d59c9", "value": 1758772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669607, "uuid": "f7f42583-2475-4861-b121-a1200e501dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669607, "uuid": "3402ae4f-ba61-4111-bd03-b70064560c17", "value": "SecuriteInfo.com.Worm.Lodbak.6664.8684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242e5ecd-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692969, "uuid": "19ffe865-d7b3-4f54-ae90-7bfdd67e2210", "comment": "Malware payload", "value": "c3e7b837336b115136a609292d8e1cca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692969, "uuid": "e81235ad-b57a-4f45-839d-06cbc842f62f", "comment": "Malware payload", "value": "e0fa7c96caa8b6f8b485a91a6177fd1ea72b5caf22d68da383649ba6496940a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692969, "uuid": "daaea62e-228a-4143-92ee-9a066fc4ede2", "comment": "Malware payload", "value": "6dcc0717721ce9bee63b0bc81b597abae3723e67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692969, "uuid": "6a6834ac-a8c4-41d8-b14d-e0caa18de4e2", "comment": "Malware payload", "value": "a62a6cbe3c39c26718024f45c231488961cc663ebd32edc5579f30e4128bee3a3a8f9ebc5ac3378f9627c37309fe8238", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692969, "uuid": "9c66c8e0-8134-4da4-af48-514386d174db", "value": "T18994E813B522A895E11417F66BFA473869BC832038B5CE13EFE4DD71BDB15318B4A60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692969, "uuid": "3a032903-9925-47d5-bb71-4b6fc69d7bdf", "value": "8c1a89a9ecb1531e781195470aa68b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692969, "uuid": "839110dc-19d2-4bdd-924e-2ab065c931dd", "value": "3072:TVmHpJqu0Vh6jw/fmZmRMpVuWwP5tOcQfgdVqYHKjoS1HwZCFjTPG1UFNE2XCKUw:TcHpJfHElepVuWwP5YcQfg8J+ojCKC+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692969, "uuid": "e65ed9ce-13c2-437c-941c-d6ea5e62714b", "value": 442092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692969, "uuid": "ef456c42-ce19-48fb-845e-0d05b448044f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692969, "uuid": "5cda503e-11ce-4e4e-9b8c-5ac87d6f227f", "value": "e0fa7c96caa8b6f8b485a91a6177fd1ea72b5caf22d68da383649ba6496940a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413c2eed-f674-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712668966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668966, "uuid": "edac8a33-9978-4755-9ca9-6591eeb1d7d7", "comment": "Malware payload (Gafgyt)", "value": "a94bba58f5cde30656070453cbed03e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668966, "uuid": "0116ad49-8874-4ff6-ba83-6437273668d5", "comment": "Malware payload (Gafgyt)", "value": "e1e8b113fd8705cee5015ab4ef4e8bd659f61594ecd88594412c51625df0258d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668966, "uuid": "854d5440-85c3-465f-a3f2-bb34847ba6f9", "comment": "Malware payload (Gafgyt)", "value": "9bd409c4afc764134c20e22aeafe927e62eed918", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668966, "uuid": "eef2e591-4ffc-444f-82c5-9e90ca12eda7", "comment": "Malware payload (Gafgyt)", "value": "1d5e38b376ee40660d2e2540a828b39a50cf1752a76c6de1426e7fd23e7d2ec638e84f5db872adb5a6070d71e9a09a65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668966, "uuid": "3849780b-c886-4375-b996-a94229d95e2d", "value": "T100140A02E8044F97C2C31BB7B78F46897B336B6957DB3301AA386DB42F867991E39550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668966, "uuid": "8c64d764-b7f5-48ee-b167-fcdfcf3ed182", "value": "6144:TUbT6R4svVRmdtv5X9mjgLzQoZtcYLmAefNGo:wiR4WREbmjgLzQoDcYLmAefNGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712668966, "uuid": "bde12ada-49d1-4639-a997-2f6cc1f4ceb2", "value": 197477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712668966, "uuid": "29724e1b-146f-4c0c-863b-4caf08417c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668966, "uuid": "b10f4cb3-0e69-4a89-9560-1be37b320e32", "value": "a94bba58f5cde30656070453cbed03e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09149598-f66f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712666724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666724, "uuid": "2f6cafa2-38c7-4b52-9b05-b2b7f0339bd8", "comment": "Malware payload (AgentTesla)", "value": "d9a32cfa1ed7d8722f32edf0fff5969b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666724, "uuid": "69b26287-5fe1-4694-9351-fdeae238e5f7", "comment": "Malware payload (AgentTesla)", "value": "e20da8c954999d1e01040867dcb3b6660d13126973d5a78a67cfc20093fa8128", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666724, "uuid": "21b26138-ba72-438b-b109-63cc58b859a6", "comment": "Malware payload (AgentTesla)", "value": "de3734539ddb0a58821d2317867a606ca3319e3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666724, "uuid": "730bf515-c99a-4e35-8277-f83b42651d98", "comment": "Malware payload (AgentTesla)", "value": "a979b807c809253425f9c7f7fb5360f37aa5ced4f4334219376a4efa47152174bed2044dfc4b1dc675cba263e5e00f4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666724, "uuid": "dfc8baa3-1993-4524-a20a-36260a210ec8", "value": "T1A534EF037E44EB11D66C3A3B82DF6C2453F2B0C70A73964BAF48AE6529552536C6E37C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666724, "uuid": "52a471e6-dabc-4966-a18a-c89af88f68ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666724, "uuid": "3364f6fc-f244-4285-90d9-797ef997e4b2", "value": "3072:P66TkFSvgYwybccb+aVeiuZYijX5Tig16DHxO2r:y6TsSIYwybccbhSl5iQ6DHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666724, "uuid": "c854099e-9be8-4a6e-b104-06adf1fd6f88", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666724, "uuid": "195d30d6-5299-4096-850a-516d7776100f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666724, "uuid": "dacdcc3f-8092-454c-9a9f-e78dc5a894eb", "value": "e20da8c954999d1e01040867dcb3b6660d13126973d5a78a67cfc20093fa8128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5aebd22-f675-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712669618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669618, "uuid": "7e05c83f-740e-4ead-8b9a-02f226feea3e", "comment": "Malware payload", "value": "0dd6eb9a668d69c22df4424214bd18b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669618, "uuid": "64980bd5-3d30-4f0f-bad2-76646f1f564a", "comment": "Malware payload", "value": "e2202a6555acff891796e298a6efd47ce3e88f460e5cadd903b3b981caccb300", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669618, "uuid": "c526fe77-eea4-4665-b7a6-a5f3ba8347de", "comment": "Malware payload", "value": "904420a784ea4ef277ce36bdf49c86d1030dc34c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669618, "uuid": "41c9a5f4-8c3f-4675-9823-122e301e5c88", "comment": "Malware payload", "value": "85fbcc4ee9fd69379e125dad1826cd02d1d72ac864ff3bf0c501a08b6a1ce2a0638e282d6e00167be7b1e0e091909979", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669618, "uuid": "965a4bd6-98ca-49ba-bba2-481267335a9d", "value": "T165C50211B282C162C0652630DC5FF7B66B65BD318D287A5BF584FB3F7970182DB1AA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669618, "uuid": "1d6ba4cb-d4a5-4b30-98b6-cbd60b56c25f", "value": "a5ee92095edb5993095c9c7315eaded3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669618, "uuid": "ffa787d6-8607-4261-9ca8-5b988a1727cc", "value": "49152:qSRWYL/eXV1i/kmeE91qj4iZ6YaycLzTTFHO8SolM/CAT2JiyuKQ:xRWYL/eXV1i/kmeM1qj4iwiANvSo2/Ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669618, "uuid": "21cd0c98-55c6-4633-a9bf-39d2595755e9", "value": 2526641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669618, "uuid": "bc538b8d-86f6-4400-8d00-919228b40cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669618, "uuid": "82d98be8-2ee3-4813-b9e6-72ed9464ee42", "value": "SecuriteInfo.com.Worm.Lodbak.16564.25232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250366b3-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692971, "uuid": "73f08552-f999-412a-8abb-03ad92479cd7", "comment": "Malware payload", "value": "faadf89935bddf67507ac4fd5b37d631", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692971, "uuid": "2d269541-3c72-41cf-9aea-5529208ed25c", "comment": "Malware payload", "value": "e2409b19955e5f861e776af6fd365a0f7019311ce4cd7e339a5914a6043d068d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692971, "uuid": "f8302078-5ef9-4df4-85ad-24ee700d9c5f", "comment": "Malware payload", "value": "d2e839225ed52255e7cac21971cfdfcef9b671ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692971, "uuid": "341246a4-1262-4fbd-bd87-507ad7228c63", "comment": "Malware payload", "value": "826b6f8d2349d691bef3963c138c2209e6c083d33b7d127a31bf9f7cf910153a4573be2909ddd758be49256c95ccdc1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692971, "uuid": "c59c34fc-6a0a-46e0-b820-c07d9ad55568", "value": "T1FCF3F822E51388F6E02E05F557F2073C9979876368B24A6FCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692971, "uuid": "60f45a63-cf4c-4e36-b96d-0b833dc2ed9a", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692971, "uuid": "4731fb8c-ca03-42f6-910b-ae72e073fc5a", "value": "1536:rj+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy89:PqSe5OmiEoAcCbZ6FNout9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692971, "uuid": "36311edd-c0e0-4802-80c2-4bb8930d4203", "value": 157322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692971, "uuid": "c5f06298-284c-4ea7-a9ca-55e10f6ab31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692971, "uuid": "5dbb8a29-9365-42aa-a9e9-8efbd0438c16", "value": "e2409b19955e5f861e776af6fd365a0f7019311ce4cd7e339a5914a6043d068d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f84a5d-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694531, "uuid": "99073c4e-dd1b-44aa-9c0f-e87525a69c63", "comment": "Malware payload (Gafgyt)", "value": "9d6972e63cf34fe517e0cb712f719f37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694531, "uuid": "efb99fb6-2464-47a7-bd10-e4de45612f7e", "comment": "Malware payload (Gafgyt)", "value": "e28b1020ab6689da99e3f0cc744b8c3a028a8ba49070226f72b5697cd8b8c6d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694531, "uuid": "aff4f566-31ce-443f-a2e9-10b034b2e7e1", "comment": "Malware payload (Gafgyt)", "value": "781fa5c69c50ec6cdd7495d2b6bbaf1034603bb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694531, "uuid": "c0100f23-918d-42fa-9ed8-133f65d989cd", "comment": "Malware payload (Gafgyt)", "value": "de917cbc0e198acad23cdc01f227322d2d7f7990879b0a5e998408693e092c1c47b75fe36161cbb078a6937b4fd3b23a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694531, "uuid": "f0494ac3-0371-4376-a2d7-42cdd4b3da53", "value": "T153933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694531, "uuid": "02c0242b-388d-4d01-b7a6-44294a256004", "value": "1536:mlqmFTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emMGMUNLe5um7WAgcVjmZIcBI:ml72UVUtBUI8GwPfHkk8reeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694531, "uuid": "45e49bbf-ed19-485e-874b-8293056efd40", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694531, "uuid": "18f2ce1f-f221-4c61-9270-f1aef2207019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694531, "uuid": "a4d1ab18-0792-4a7c-a052-068ce1593e36", "value": "9d6972e63cf34fe517e0cb712f719f37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c53e1c-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692972, "uuid": "971846d5-ff2e-4752-b2a2-eb400fc635d8", "comment": "Malware payload (Blackmoon)", "value": "a59b505d070f515b300af2345fc1fe09", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692972, "uuid": "0122784c-2170-4c9b-86be-422e10b8be83", "comment": "Malware payload (Blackmoon)", "value": "e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692972, "uuid": "e4564bd0-a84e-40cf-9493-644abd466f13", "comment": "Malware payload (Blackmoon)", "value": "09409004113ae2915b013736a70dc06f3951f924", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692972, "uuid": "b5a2c091-ca4a-4552-87bd-5138b857a457", "comment": "Malware payload (Blackmoon)", "value": "36fd65ec2368286652e4b1bc39ef2a3d283c0d9b2a81af3ccd3559b55e8d43a64707c092bdde310fff229c7fb128f145", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692972, "uuid": "0c541347-591b-47a0-a2c9-02b4f857e96c", "value": "T18323AF03ADC249F1E829437539BA077DFF7881806D31865BCBB1DEB12D73229B51A58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692972, "uuid": "87ddf74c-a04f-4f91-9f37-71fdb767ec01", "value": "3692d664d063c430bc70000eda71cfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692972, "uuid": "78c9ebbf-3d0d-4fb4-ba99-044c7e63e704", "value": "768:w0VhtAfwHimao51vD6VHypXI0LdWfQqzNWNLP9T0BBAlLlSya2ZNwm:w0hAW1iqdWNzI5Pd4CSya8wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692972, "uuid": "ba462dc5-5c5e-4a6b-87f2-5a07cefccdb0", "value": 48385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692972, "uuid": "cd1a6956-65ec-4872-9d75-3b356d0379a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692972, "uuid": "364c932e-4fe0-4b16-941c-6896dc3b1098", "value": "e2de4d0b43ec8692886f780bbfab4386350402c05b04fcc2ef5240a1aed7ba56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccadbded-f6af-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694540, "uuid": "b2a569f3-f58e-43aa-8a59-1092cae34d70", "comment": "Malware payload (Gafgyt)", "value": "9451aa877fdecf9e033cc2387b750c3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694540, "uuid": "b67ac285-3151-4e30-90de-677f80e04c1f", "comment": "Malware payload (Gafgyt)", "value": "e361c233585f024655b32469ce94b2d48fb349846df7756c02760b9401957ea8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694540, "uuid": "5fcbe6ab-39ef-4e0e-b561-a61520c598d7", "comment": "Malware payload (Gafgyt)", "value": "5b834e856268f87fc2959f9fe4ed9623341c2d5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694540, "uuid": "a3d124f6-328a-43c2-aa90-8c64115bf46e", "comment": "Malware payload (Gafgyt)", "value": "94c621ea4ccbc8de9068a576d062e84b1a894a2f7034f80f8824d7e5d54a94b5844ed2e6d0ff75865c229e3ab23cf9c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694540, "uuid": "889a589f-2dd3-4f17-ba6b-1203f3865f07", "value": "T1DCC3FB90E848671FC2D327B6E68F0BAC3F391659D3E737115A28A9B81BC97847F65120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694540, "uuid": "7a44fcaf-15d4-46e9-ba34-e26da9b6e96e", "value": "3072:BpQ491D36ZCKS5s1c7k5izImeRrQ0hIeUXv8Q:BwZC/s1c7q1meRrQ0hIeUXv8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694540, "uuid": "c4c21bd6-fc1f-4f7d-abf2-2567c09c9f1c", "value": 121350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694540, "uuid": "f11502bd-02f9-45a7-bae6-38d013b91db0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694540, "uuid": "e423314a-2095-43d7-8ee2-37e440a74e01", "value": "9451aa877fdecf9e033cc2387b750c3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94051ed7-f66e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "e23b4382-db7d-4090-bf0c-0dac0bbbc54d", "comment": "Malware payload (Mirai)", "value": "cf4ed6e8269ed7b102f369fa521703f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "d65ac4b7-e52f-4888-9f86-4501ba81dc59", "comment": "Malware payload (Mirai)", "value": "e4b0516561c9fa750736bd7c3b3839212195aa0f1ae63444f685d815d31b1ccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "5e1a1b2e-aa7d-40c9-9229-b610b953cd89", "comment": "Malware payload (Mirai)", "value": "0d3720f1743c9986cbda4363edfbef7aa61018da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666528, "uuid": "b1cfd0a5-3fa3-4feb-9b94-041c376c92c8", "comment": "Malware payload (Mirai)", "value": "9401b340d072c71266eee9e3031b0f04e3e93756411931cbfee4d54e56d4f9d69d6af2bb0f041d62033e19b4033b7bcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666528, "uuid": "2ac0621c-c566-4e17-9a94-30d995f3119b", "value": "T1B513189AF805AD3DF94BE7BE8807490AB2B0375541930B277367FDE36D322941C26E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666528, "uuid": "f7f69c24-534e-4079-9002-4dc88d32fd65", "value": "768:h+ePeCiNKjsCXvLraTZn2MEZx9L9Ou3fnn0+QOUv6NolZ86ep:IiiNZSvLraTdc9n3f0+QOM6NU8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666528, "uuid": "9880c530-8880-4b0d-b7af-b95067567750", "value": 43244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666528, "uuid": "593ef805-e0e9-421f-a16f-22a1a5ff4ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666528, "uuid": "c58ff681-3350-45e9-88c7-4299b14dbc30", "value": "cf4ed6e8269ed7b102f369fa521703f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faed7280-f68b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712679156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679156, "uuid": "e560826c-adf2-408d-9311-c67d5aab6a33", "comment": "Malware payload (Mirai)", "value": "89be6bfb0308592500f7694a0451c29a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679156, "uuid": "46e352e0-bb52-49a2-ad78-71db4d414064", "comment": "Malware payload (Mirai)", "value": "e525192a1e5e69359edf310e609679652737a3899f804b575b9b7aa0e4863026", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679156, "uuid": "1e257cef-7edc-4c7b-b0d5-d41bb1cbb809", "comment": "Malware payload (Mirai)", "value": "064591e3d5289d801b5c32583f6894fcaa0d8e49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712679156, "uuid": "608e03a2-3bdf-4316-a4db-08a8a825a814", "comment": "Malware payload (Mirai)", "value": "ba158598b15f919f1c341b62e40bddf34bd9332ce7ad6e45981f4c057985967e8669fc867bd1cce844b50f53dfa3f1c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679156, "uuid": "ff6c36fd-5541-4114-8e93-5c7b825c6cc8", "value": "T17AA3B90E3E318F7CFFE9823547B79916964C379A36D1C585D09CE6012EB024A742FB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679156, "uuid": "7272a51c-0be8-429a-8f15-ebebd5855061", "value": "1536:chefMQGyOjAbK9c+WkdR+MHDF4djWe9K+er0FS9llkRevVrARINSNEc68k2t:1jOjd9cUHRwWEK+ZAdvVrARASecFkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712679156, "uuid": "fc6dc6df-8caf-4700-b65d-1f4284e5ba16", "value": 101792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712679156, "uuid": "08b2c262-163d-4afe-8a89-b9c739afd729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712679156, "uuid": "d63b21d5-578e-4a90-b742-e3f3bdca6202", "value": "89be6bfb0308592500f7694a0451c29a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a867aec-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651829, "uuid": "9ea7054e-0feb-4e86-a47e-cb5a11b58d11", "comment": "Malware payload (Mirai)", "value": "6c3d89c5812fef4dc1398a9af6a87767", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651829, "uuid": "de08b9f4-01d1-4b56-9b61-c8b1b2df673e", "comment": "Malware payload (Mirai)", "value": "e691ceb9f14b8a1be89fad6ef7145fa15bcaf3a4d742475de94398fa933fc7a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651829, "uuid": "d6b5643d-75cd-48a1-85b7-d448f8d11bb7", "comment": "Malware payload (Mirai)", "value": "6ac717a761853d3ac95e47cee73d3bcb834e371f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651829, "uuid": "a33bd756-c4bf-4edc-a17f-15c0e463e1cb", "comment": "Malware payload (Mirai)", "value": "68a7f951a86917eaf713dba5bdc361aa70c1aedff9e2a28da069e475e9626aa6b6137b33d8c8492a306a8cca078dc403", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651829, "uuid": "f7999f26-1dbc-4c5f-93c7-45d37e382c5f", "value": "T12A83D7597E228FBCF7AD823147B74E25A75833C527E1D681E29CD6002E6034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651829, "uuid": "8a289d3f-0eda-4992-a8ff-cf6ea9b90694", "value": "768:HRpExqQYV74mGTGpm/02swrU35PPrdGkYjYudIaoOHC50Uhy0uleCOiK8wB2IB:PKqzGTGpmTmPrdGXjR6afirueCLKdB2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651829, "uuid": "4241458a-eb99-495d-b777-61a0320b3580", "value": 80900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651829, "uuid": "ca4dca61-e92a-44ac-a59a-5b2719c2bd17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651829, "uuid": "7e389700-d224-4f50-accf-ca63ba396aff", "value": "6c3d89c5812fef4dc1398a9af6a87767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b35024-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692973, "uuid": "a12f86c7-f3a4-4cc5-9b70-51b8582c8549", "comment": "Malware payload", "value": "a0307df6eb0b3cce819ad6a5894c08ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692973, "uuid": "1b995b32-2db6-4d7c-b689-e405c39f71af", "comment": "Malware payload", "value": "e76f9b6958fca510d682943b4234893a0e4a8d81d75c8c30aac38e5a916f1428", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692973, "uuid": "204ae414-d058-43ab-85a0-d569f17eb670", "comment": "Malware payload", "value": "13725598a9d292256bc6321bf8abeb2220e479c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692973, "uuid": "3906c8e4-33b1-49ce-a9c3-b214d996c923", "comment": "Malware payload", "value": "7bd07c60e230cfbe753854f695d633e72b75004b4b3f911730866e4989d2abf9ba3b0b9a5e691bc33407181f1b28771c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692973, "uuid": "d66029bc-6301-44e9-b9d2-c94cbf6aa60a", "value": "T10584B80372219491E15857FAA3FA433879B8976438F0CD23EBE4DD72ADB1521971EB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692973, "uuid": "c83cc594-d5d1-4888-aba5-77a3e0d6fd66", "value": "218116afeb0ce1cf6949047ca65d1337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692973, "uuid": "82996875-4990-412b-8634-0c80eab90b29", "value": "6144:BSfSHl+gv5gY1F53Aul/Egv4+E6qnwEGvIkJ7G9P1p:B2SHl+gv5gY1b5Eo4+EsEEIkJ7G9P1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692973, "uuid": "16393b00-0060-4083-92dc-376fae06ec46", "value": 375521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692973, "uuid": "0e28f141-1ef9-4eb5-b606-8b15bcbb0a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692973, "uuid": "edd19680-dbbd-4d44-8eed-456baa11e896", "value": "e76f9b6958fca510d682943b4234893a0e4a8d81d75c8c30aac38e5a916f1428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f277575-f656-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712655997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655997, "uuid": "bbcf31d4-1f0c-4be5-9ae7-e9cd8b44102a", "comment": "Malware payload (RemcosRAT)", "value": "389fc0f3b5f8a868c2c23cd21ec99957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655997, "uuid": "f63f20f5-3eb0-40f2-98e9-6f39f787cfc3", "comment": "Malware payload (RemcosRAT)", "value": "e9572c9f7e9e395025837bce834ffa5694f39e7c7646b7a309bad4efe31aedaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655997, "uuid": "b1b2d588-cd7f-421f-b510-cd9d31eda495", "comment": "Malware payload (RemcosRAT)", "value": "234c87b08a7f340950d4067141bfd10ba696e297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712655997, "uuid": "49b0ae87-87c1-463a-8cf1-c6e95a8914d6", "comment": "Malware payload (RemcosRAT)", "value": "afe5d869f6d06f74af12c055d37f2aef27fb4ef54a0c62d6b32905998afa58c9ebf1710d1468785dcb1122c6f2b0cea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655997, "uuid": "19d42568-7f5d-443c-9f05-a3e489e4bd15", "value": "T1E105E14423FD6B2FE5BB17B7D57811104776B60A393EE60C09921AED0436B41C7A37AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655997, "uuid": "37444b25-b5c3-41c7-b439-8d59bd991314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655997, "uuid": "c94eb95a-fc29-46c7-9655-b160c259e9af", "value": "24576:tgCFGJAW8VOFylQyVfQKzbN8rYgrv9PlcjBZB:tgCFVW8VYyKyVYKfSFr4VZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712655997, "uuid": "3643ac64-87a9-4888-820f-c8b061f741f3", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712655997, "uuid": "4702e10f-e983-4d15-bb9a-9dbe9dbadd66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712655997, "uuid": "c53fec29-87e1-47ba-adc6-1d87891115fa", "value": "tdpzx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff4340e-f622-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712633879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633879, "uuid": "0a0ac2ee-2831-42cc-a06e-e685aa789570", "comment": "Malware payload", "value": "001d7b4dda995df833a503bea023d8cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633879, "uuid": "622bc375-1d66-4869-8602-a317f719973d", "comment": "Malware payload", "value": "e9c65fa8a1b315f495a7bf35a1b6780fe099aa5d6e4cfa4ca51bb631d485bfa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633879, "uuid": "d0c9201f-b7c9-41a6-bf7d-61c147b75d57", "comment": "Malware payload", "value": "b5015d6c0c3bc55314a64f0b8bd655eadaee1a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712633879, "uuid": "3057585e-577b-4e0a-bafa-a5e6fd5af440", "comment": "Malware payload", "value": "3ab3f926fdb3cb8f31b5754fc8c839d11c7181faa0ff15bfb0be10edd6ea6bea42211bb14a4be7468ce41d1c674ba7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633879, "uuid": "f4322afa-ffdc-4b2e-9377-8caf516819bf", "value": "T10391B783A7A5D791C42106B4B01169B7CE7904350A7FB87B339C2E7D7BE635296023E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633879, "uuid": "8fdb3d2f-0023-4318-be1b-2e52539d5486", "value": "5b1efff93dc78408e7adceb2ef973a74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633879, "uuid": "a92e1a18-e501-47ab-8c5a-f45c46c76683", "value": "96:RiMI7nY7n2nTXEs5RTD5DwvlLlClUPoj:9I7nY7nCb/RTlD2BeUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712633879, "uuid": "0e4d7eb7-1f59-4876-950b-37752aa79367", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712633879, "uuid": "c3f22c07-bce8-4e4b-bbbd-566f495bebfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712633879, "uuid": "4e7164fd-ac32-43e6-a244-ce435c01630f", "value": "payload-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418c4699-f660-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712660377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660377, "uuid": "be3b88c6-ac8d-439c-bee8-8eb2c7d3af40", "comment": "Malware payload (Mirai)", "value": "b61bd609199f42cd0132cc0544140275", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660377, "uuid": "5dc0431f-552f-4eb1-b279-bb92b58e9f0d", "comment": "Malware payload (Mirai)", "value": "e9ee92cf1a8d4f1f19ded294f797831bc4de76b48258ab90f802284dd6a2c071", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660377, "uuid": "bf2b1838-01a6-4135-81f0-a49750d544ce", "comment": "Malware payload (Mirai)", "value": "5dd8c6ff0f1e67e884de4b9ebfb787fed876ee61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712660377, "uuid": "0a35cb82-fd46-4893-8f97-126c84fdfc65", "comment": "Malware payload (Mirai)", "value": "74168be53ff9ab6a9bc87f24055259d3135296616bb6f03130e6f2e9f80dfd9cda4f94b9d0bc4670ab925c919f295091", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660377, "uuid": "5c4b9283-5350-47ab-8202-ad166983eb18", "value": "T1C2D2E1BB558D2C66C44592B3C17A8B86C2B3EE745F22F5451B909CD45ADB0FC022CEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660377, "uuid": "41f13114-aaf0-4eaa-9825-438a713c30c9", "value": "384:Mcj0WRZ/JIIvXjoU0PI47G+Y/+WOOgkZ9/UGfzRKFrVaQIgW9d/3UjNF2OEGDGeB:Fv9obvPY/+SjirVNHIXmA0IMKWRZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712660377, "uuid": "8a4e9732-097c-4a55-b80c-e1871688fa9d", "value": 30228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712660377, "uuid": "79bae176-ad05-4a15-b568-7a0b74f2e753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712660377, "uuid": "15457e9f-50d6-4db6-8517-2a183ec4ef0d", "value": "b61bd609199f42cd0132cc0544140275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df34d2b3-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712666225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666225, "uuid": "46a682e1-25c5-408b-a1b3-7fc5fe5414d8", "comment": "Malware payload", "value": "ac7cbd47c811bab61a2bf6344b6f6692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666225, "uuid": "7bd71c8f-23ae-4394-8336-939088d818c4", "comment": "Malware payload", "value": "ea0d3d26968d03d831e8d87c9a078540cdd56784492e4871fc0550e681319c1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666225, "uuid": "3b34ab1e-2a60-477f-a6f9-7e89fd3a2ed0", "comment": "Malware payload", "value": "ac41e31cd41ee5aaa45a98e9ec11ad1d41c1e1cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666225, "uuid": "e81688fe-abdd-4dff-b755-c1e0368257b1", "comment": "Malware payload", "value": "0ad8650d45e5e86c6a3e272e639a9e77246111035a14a57d1b83e4904f8faa4e3996932c2f4d3f909fafaa04dc7b48f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666225, "uuid": "3e61a797-5dab-4720-9584-a301448cd7d4", "value": "T122155AB1DF302B16D3B882B346B26A9C98731B059BC154C7B168C1985AE86FCCD7EDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666225, "uuid": "46eff08d-8cdc-4f86-a1bf-9aa744867aff", "value": "24576:T8InNGiNY4kl6dP2w6U/G+3xnNzIMk2lcigFaj:v04a6dew6U/R3xVLk2WLFaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666225, "uuid": "d404e7c9-eb0d-4520-8e11-74ab495c4cb9", "value": 935404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666225, "uuid": "8143ba11-73af-47a4-b28e-8a618c2d32f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666225, "uuid": "defaf406-5555-4cb3-8a90-07bd014c08a2", "value": "ac7cbd47c811bab61a2bf6344b6f6692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d7c9b0-f652-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712654443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654443, "uuid": "edc2ddad-f6de-4eb5-836b-a6d2e669bb31", "comment": "Malware payload (Adware.Generic)", "value": "0fc25756ff2f2b778c1cea32098f7082", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654443, "uuid": "5ca03ff8-414f-4eac-96be-6e0a4260ee01", "comment": "Malware payload (Adware.Generic)", "value": "eaf37dfeba5a96ed595eb7aa96c2fa3e1cd8eaf062fb47f39306d2049bbb8a2b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654443, "uuid": "d2ae2208-503a-4257-9a82-a2465a65dc52", "comment": "Malware payload (Adware.Generic)", "value": "918d12a2846446077b58632f66584de22c67e109", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654443, "uuid": "851fdeb1-2c09-40cf-b05d-3107b2a64e0d", "comment": "Malware payload (Adware.Generic)", "value": "d13d817722ff2706bcaee60e3f867463f9056bbb61a69fec4f42e8e0826feff14e0b33d28a70d4de42ff1d4575876173", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654443, "uuid": "7a4ad338-a910-484a-8713-a95e022da9f1", "value": "T1CC67337BF124B92EC8284A314076E12048FB6F1965560C4E67F43E0DFBBE4517EBAE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654443, "uuid": "7e7ce5b1-2dd8-4b01-8839-acf4bcebcdef", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654443, "uuid": "cf45f5af-befa-4971-a1f5-1852d6738fd6", "value": "786432:NFnShjsZHgskk7aj2xAgODhYc7lCUt9ROXB7:rnShCHg87aj2+gMjMiOXB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654443, "uuid": "b5faad33-a54a-4282-9e88-2e19dd3650a6", "value": 32379360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654443, "uuid": "c4326679-f256-4c6b-8959-ade6f7d6d7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654443, "uuid": "8cff3de5-5272-401f-85d6-ccfb11ebc438", "value": "SecuriteInfo.com.Program.Unwanted.5387.30001.15344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ab372b-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692975, "uuid": "8cebe658-262f-4dc5-a7f7-d89aaa742d80", "comment": "Malware payload (Blackmoon)", "value": "74375f8d962590ab5592decf4cbc51a1", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692975, "uuid": "ddabcd98-80a2-4976-a8e2-c4ce3631f3ad", "comment": "Malware payload (Blackmoon)", "value": "eba976d0be8c9bafe206236e8189f6286c20be1a0f9988762c5dfa2eb54d5035", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692975, "uuid": "460b9938-f3b1-47d4-b987-0222ec7d9bdd", "comment": "Malware payload (Blackmoon)", "value": "a89c2c30965a1e1b008261f28ff50ca6b095a37b", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692975, "uuid": "07988ba1-07ee-461a-9a49-1378c6bbd2ec", "comment": "Malware payload (Blackmoon)", "value": "4d2ba886db468bc157ffb56c3405af93a335f991f90fd6598b5cfa77cc09df9711e928d4646863eb52abf8364077da27", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692975, "uuid": "0533555a-9726-4dc3-a3b1-b6af368d4d32", "value": "T15E94E913B522A895E11457F66BBA473869BC832038B1CE13EFE4DDB1BD715318B4E60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692975, "uuid": "34cb5bf8-4f99-430a-a803-89309f7ae22b", "value": "bab84fd0accd31d5fe97afc63a9ebcad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692975, "uuid": "f2d33c33-a160-41ab-b43a-89545db2fec2", "value": "6144:cT5J63Fm3b7yOE7Hvpu5CaGi4mUf95TtC4uP2scqAB:c4Fm3b7yOAHNar4mUf9lJ82scqAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692975, "uuid": "4805d467-cc29-455e-a564-1c05bd302955", "value": 442598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692975, "uuid": "8cbff45d-bf1c-4950-a8d3-4780cc6d0eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692975, "uuid": "07f91cd2-30d7-4ed6-b83f-688fb07c0750", "value": "eba976d0be8c9bafe206236e8189f6286c20be1a0f9988762c5dfa2eb54d5035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cda1ba4-f680-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1712674059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674059, "uuid": "88910624-ddb2-4c01-80db-68713afde5cc", "comment": "Malware payload (XWorm)", "value": "77b777edf4825780644dceaf1dce5770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674059, "uuid": "cca49539-bc21-4714-a8e2-30bd72126d86", "comment": "Malware payload (XWorm)", "value": "ebbad62782726c546f1749521fb7f988bdc5782c5cd84e208450d00eab4ad3ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674059, "uuid": "f730be74-21a2-4be7-93ec-657e8d0e729f", "comment": "Malware payload (XWorm)", "value": "04c276b822c0fcfa8d97806b80743f623322da27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712674059, "uuid": "c3ffc38d-8451-4e2f-8613-7fc9d50b00aa", "comment": "Malware payload (XWorm)", "value": "58d33d10aef01aabc76d87734a34977cd56adf3510dcc9be976a20507cf222621fd8a7cfc7b5cb68f32313f035496bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674059, "uuid": "f2aff249-74bc-492d-8ca1-54e20a77ec4e", "value": "T1E4D32A0EFFA1E547CB8C1A3784C77108A27586476616F77B29CC1DA94EA2B9CC1CE0D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674059, "uuid": "7eaa775e-1f3b-46d7-88df-e874cefbcb25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674059, "uuid": "2138aa51-1195-40a4-81cd-82d5789ea181", "value": "3072:lo5VdHd0nbKmypJ0Bns6fxO7lyszAjIUZbUWPkHD:Ot2o+BFcyIGbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712674059, "uuid": "e1ea57da-3245-4b84-88be-3a500023344b", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712674059, "uuid": "b9dcf6b9-49c8-4ce6-8c22-bdd52bee84be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712674059, "uuid": "c84c94f7-4f4d-4e42-af54-ab6f1cc850c1", "value": "nigalmuchmuchi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c986dbe-f64f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712653228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653228, "uuid": "c3c7c869-1ee1-4c52-9410-863ade2ba876", "comment": "Malware payload (Socks5Systemz)", "value": "412b93a1f6f91b331774d5f3a5e04722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653228, "uuid": "c5396ed2-cb0a-488f-8784-28072d360b7f", "comment": "Malware payload (Socks5Systemz)", "value": "ed707049234c4794563e0232662dfa73978a532cdaf08beb3b6fc0db0e1b2b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653228, "uuid": "2429d4ad-3392-4425-bae6-2c8cd4dfbe66", "comment": "Malware payload (Socks5Systemz)", "value": "4af3037ed7bedc7c07d75fa93d5fb9369351466e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712653228, "uuid": "8c7517e2-5134-4ffe-8e3d-71469e053e85", "comment": "Malware payload (Socks5Systemz)", "value": "298475968356259cb67b4e1ef671b7976a177f6d6f08e6c999b8eb3f587bfc30a00c111891e8bba1e66220be5d9e2bf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653228, "uuid": "e4b183ed-9a95-405d-95fe-58d0ea07aeed", "value": "T14A163359C26909F7E937AD70C92AC417A03E2D9B44B05793378E2A8EDF3FE918CD5412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653228, "uuid": "f03a35e6-16e0-408f-af93-17adfa4057a3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653228, "uuid": "077bc42d-c245-4d54-bec5-1891aab90fd1", "value": "98304:ChZhES6/LCPctbw2sStNDyRCtNaxqDZxjXD8m6K8:eES6DJtb3tcKJDbjT8m6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712653228, "uuid": "b156456b-129b-4e21-ad0f-ea01d50dc64b", "value": 4066963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712653228, "uuid": "5875f463-3429-4295-98b6-3c4e7389d462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712653228, "uuid": "f47a82a5-c884-4ad0-a1c3-8476f0303ae5", "value": "412b93a1f6f91b331774d5f3a5e04722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ba4435-f682-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712675008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675008, "uuid": "d7d3ec78-8290-43ac-9063-8eab86a3e32e", "comment": "Malware payload (CoinMiner)", "value": "7a71a972bf09369bf4536ce6042fc859", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675008, "uuid": "fdc4f3fa-fdb1-4c54-8654-551e0d5db698", "comment": "Malware payload (CoinMiner)", "value": "edcd1a4741748df1187d91084c77cebd0efad7f933a40dac4536f4146160106f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675008, "uuid": "4500c9c4-3c43-467c-91fd-2479b2ee97b8", "comment": "Malware payload (CoinMiner)", "value": "1d6046f08a214c8bc489d1ba2693256c33572a74", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712675008, "uuid": "9d60ca75-ff83-443f-995e-f59ec2ef0105", "comment": "Malware payload (CoinMiner)", "value": "2f63e2b9a6635ffea7bb48ea16ad46e0fe6a23918315f717f4ecda833ac3a9ad299921304572b5e5db62c2ce8344b524", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675008, "uuid": "04298d92-5ac1-4cee-80f7-89ec665a06dd", "value": "T17E669E66BD1EE563E7C823706B7582D8323EBC449F819327A614FB6E59F235C8F12211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675008, "uuid": "cd634244-2102-4dad-be0f-ba5a8dc2b3da", "value": "49152:qs73S8XfHlVT9R6oydh6OFg5EbdeISakB15HU4ZARWJbZi+lH+Nwipcw2f9nX/9V:d73SefHXT9R6oydhEE+HU1R4brgf2C7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712675008, "uuid": "c89ab77d-ed39-476d-a422-c3c32007db2b", "value": 6552513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712675008, "uuid": "1ca6c23c-fa5c-4285-97c5-e17bc80f2b89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712675008, "uuid": "146435ff-8c59-4905-a61f-1953d0c666b7", "value": "7a71a972bf09369bf4536ce6042fc859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287f0b44-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692976, "uuid": "4006eb4a-c3f6-4c7b-9448-fcb931ee549b", "comment": "Malware payload", "value": "f06f68a35f261309fc95ea2be360d8b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692976, "uuid": "cadf2ad7-cfe5-442c-bffa-b174433f2d19", "comment": "Malware payload", "value": "ef8efe664a4368b56c046457b167e3952f06be1c391caafbca5794926e81d161", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692976, "uuid": "732c66af-24b2-42f7-b199-4b1ac32e692b", "comment": "Malware payload", "value": "a14ee9821c742150e07e4ed769d5022580280a9c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692976, "uuid": "aeb0968d-2018-4fa0-a9e2-209286dc72cd", "comment": "Malware payload", "value": "0f0ada61453e4263bbc9a1f31596bb7ccef417a604ce7b69b97f8ba1100b22d623cf358b6a26524f8831aa1c12ca0c97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692976, "uuid": "346aa1f6-d85e-4a3c-8176-a0d1eb035e5d", "value": "T12BD3E722E51288F6F02D06F557F2073C9978876368B25A6FCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692976, "uuid": "3428e7af-bcb2-479f-83d1-96799e694674", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692976, "uuid": "1d9af2f1-8832-4503-816b-2f67b405b478", "value": "1536:Md+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkCb:OqSe5OmiEoAcCbZ6/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692976, "uuid": "17761e0c-42b1-432d-818d-66227e444a19", "value": 139747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692976, "uuid": "f9dfdcfc-8704-4c4d-abf1-e8c799ff51b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692976, "uuid": "dd50a40e-2ed4-4086-be38-ee48b7fc69a4", "value": "ef8efe664a4368b56c046457b167e3952f06be1c391caafbca5794926e81d161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b550babc-f66b-11ee-a120-42010a9c002e", "comment": "Malware payload (AmosStealer)", "timestamp": 1712665295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665295, "uuid": "53517edc-b8b7-4700-b19f-d9973a47a134", "comment": "Malware payload (AmosStealer)", "value": "34cbc3a11ec7d60d331e4ea8304a5687", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665295, "uuid": "b822df7f-f300-4363-aec6-5b4eba4bb14d", "comment": "Malware payload (AmosStealer)", "value": "efa9a62650f5bfeb8d1eae3b15953cd804b83ca81335a34464d4d18673594f49", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665295, "uuid": "a66ca8af-b454-430e-b016-1ecdd073bb4f", "comment": "Malware payload (AmosStealer)", "value": "84710eb61d7c2783be227af470e38afc86c06ed7", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712665295, "uuid": "7937dae6-eb02-4fce-8407-b2e01fbf089a", "comment": "Malware payload (AmosStealer)", "value": "1f7a4d06404d07eb3e893b3c5c6025d30f48dcd42affb9c1ddc62c93f4f5e6a747748cc20485e05dabcf7bee28e80268", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665295, "uuid": "ac743e64-85b2-4da0-aec4-dab7cd090272", "value": "T1CCB4233A665EBC5DDD6135B2CEA040390CDD3EDF06623566EC4508AB24E2A73B7F809D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665295, "uuid": "826fe260-338a-4d49-8690-60cea6ce46a4", "value": "12288:z2ktDnWrmDc6Aerv2T2aSD7C8PN/e+PjCyJhq42seUT:z28Em4qnr1ZemJhqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712665295, "uuid": "14aa04b0-869c-4df5-a696-1498c0e4344a", "value": 532639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712665295, "uuid": "b486af94-5383-46a7-9784-7a6839962a43", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712665295, "uuid": "3fc08b2c-6182-43d2-90f2-796096b319ce", "value": "efa9a62650f5bfeb8d1eae3b15953cd804b83ca81335a34464d4d18673594f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1579c7-f6b7-11ee-a120-42010a9c002e", "comment": "Malware payload (MarsStealer)", "timestamp": 1712697730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697730, "uuid": "9fcc3fdc-c71f-4e79-9f32-e9cb5e956da2", "comment": "Malware payload (MarsStealer)", "value": "0e7c195251b4cabf82abe93032b5e1c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697730, "uuid": "a6dd6a59-6891-42d2-ad25-4eb54ab72234", "comment": "Malware payload (MarsStealer)", "value": "f035dc281159dc360bec14d6096bc7098c5600b2e3ad4df5e30e0cb8cbfef53f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697730, "uuid": "3c8e0d7b-89e7-43a9-8cb8-74c4bcac54b5", "comment": "Malware payload (MarsStealer)", "value": "b75a58ebb91c1374f678d015c3c789e62b957700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712697730, "uuid": "8e93f7fb-199b-4ec9-96e7-562061839c51", "comment": "Malware payload (MarsStealer)", "value": "5420e6ed324c5f383a05c343bda9376cdfb187d03067bc10033091ab1d85190d2b7c30d39273f6bd3dbf8c89e794b366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697730, "uuid": "e2de33fb-f3e4-4645-b80e-ddb805eaf10c", "value": "T138F4BE24EA415C2FD45345B8909D67B8F02C6E351BF12A8FFBC63B492AB13C2D525E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697730, "uuid": "cfe0c6fd-c2c6-4ef6-89e0-0ddf7e2b7a2b", "value": "4b9c1a733f5a89601fd7da1a1dda0bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697730, "uuid": "db185fee-0ce4-4cbd-8528-42a9ed80e90f", "value": "12288:5a8+vGMMS1zyUhUl8UXY8+uRKtk9GWJt8cZX1er:BUGMMQz3U8FTK0k91tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712697730, "uuid": "b4ea8fa8-1347-415f-ba62-61072d9ea0d9", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712697730, "uuid": "da1667f9-e37c-448d-bc59-b4a2d638cd6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712697730, "uuid": "bf13c1a9-ff46-4bdf-85cf-9006556286c2", "value": "SecuriteInfo.com.Trojan.Heur2.JP.TOW@a8o8ENoi.25697.32337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eea55e1-f6a6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712690410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690410, "uuid": "3f38e2d2-2e0a-42b0-80ff-8648a59d2381", "comment": "Malware payload", "value": "fc7c4e0afdc1d479811b125bd5c79df3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690410, "uuid": "02f2fb95-eaab-451e-8238-1754ca9997ea", "comment": "Malware payload", "value": "f21b1934d8d1a2f7c39aa47d47c9f4f3963eb7b33966fa8b15af9abdf7400842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690410, "uuid": "9fc69397-15cc-4234-8fc9-8c7c789b5eeb", "comment": "Malware payload", "value": "4e7225aa2c25d3a9b24927e9ca808a60c8f6f5f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690410, "uuid": "74ea6cd8-215b-48f1-9fe7-8eba5db8fcf7", "comment": "Malware payload", "value": "759998cc0839b0f1a3e7044231a76b061b097b06aa1ccfe64e5c1947a3f62440270312a00be7e96e4d6f9a0785eb8a66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712690410, "uuid": "b3fb89ef-2101-4cd0-8162-141e5867739b", "value": "T1CA8533989312ECEDA0E99764F5BE39758980B627632458CE6F7280D0007BFD14FFD266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712690410, "uuid": "095b2038-19f9-46ef-b1e7-e5367807e2f7", "value": "49152:j0g9bLzCaBjjLx1qpqrdhfUYUq8WC4Ok4caOTl8O/Rq50A:1bL+afopqxh828WCnkb8OZi0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712690410, "uuid": "81b515bd-0103-4674-9632-dd3b86b7e312", "value": 1714296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712690410, "uuid": "dd8f73d2-2cca-4155-b31a-36f8896ff36c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712690410, "uuid": "faec42d3-b1f6-4644-8e28-233b11bb4744", "value": "SecuriteInfo.com.Other.Malware-gen.27075.31587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cae4bb-f673-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712668813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668813, "uuid": "f0aec236-abea-49dc-b3f4-50af95ea4492", "comment": "Malware payload (RemcosRAT)", "value": "c1473cd953814f9ccc4c1e4ce1d00ccc", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668813, "uuid": "94b47390-57cf-4fd9-99aa-65d5f6783387", "comment": "Malware payload (RemcosRAT)", "value": "f332542ff7f6b793d37e4857357fa324a308864bb446cf7ed50e69cdcde0122c", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668813, "uuid": "853fdd16-2f79-4ed1-a9ba-1b9c912ce9b5", "comment": "Malware payload (RemcosRAT)", "value": "b9b159dbcd1654c77e66b919b59c1dca62455a77", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712668813, "uuid": "9a1b39aa-da51-496a-93ba-e8445f00d31e", "comment": "Malware payload (RemcosRAT)", "value": "0b8e8a9994d1eabb54f6978709f6ef845eab3e7bd869dcd535074ead3dc89631a3faca26ef06e2da818b52e2ec68fb1f", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668813, "uuid": "cc3a04c6-f762-4f27-89c1-b0edbd453924", "value": "T13264E041BA818647E45143718DF78FAB6325FC416F924B0F321CF72D3DB16A81E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668813, "uuid": "0c496b76-185b-412e-8553-34c504a4b9e4", "value": "6144:BsunJsxY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbV/sMIGOBG3g6PuXpWWw7F:BlJsQ3bV/sMIGOIPPuXpCHvap4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712668813, "uuid": "c145e9ff-9a8e-4002-94cb-3be8dbf7ae47", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712668813, "uuid": "2066d6a8-e6cd-45df-b8c7-f10bba812736", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712668813, "uuid": "5c88475a-4f54-4937-8f59-794524882bbc", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85feaefa-f6a6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712690556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690556, "uuid": "7dbed53f-ad9a-4168-bc25-0c32e297a405", "comment": "Malware payload", "value": "10ffc1c53c611ad6caeb3fb6960701e3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690556, "uuid": "b19c1a80-54f5-41c6-8ba9-6123a84d2e17", "comment": "Malware payload", "value": "f5fc667d818a26fbb5c04657b131d86af1746a349ceb9d6e441d24c8673393b2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690556, "uuid": "791cd851-835e-4821-a27e-30e34a909f92", "comment": "Malware payload", "value": "eef77fb02f272ca3b6c9fec997e251ee7c3cb7b1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712690556, "uuid": "5b43fdf5-fa37-4008-84dd-f5ab923b967d", "comment": "Malware payload", "value": "d8395cb4f8ee96beb69a135ec9b70e7e2de781e03dce8ae1c5c246daf8856889885e94058d982cac2d9e40661addac41", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712690556, "uuid": "0775d65f-cdfa-45ae-93b6-98c909799a85", "value": "T126A401F8F0E17E6D2DE59B87A4001F021DE982C3613949B5FA3E76D948650788F9E3D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712690556, "uuid": "9c3afeb3-b891-45c8-a399-ed707e1b4bc1", "value": "12288:+CQgw6wrf68klS1+t/WPwqwp1pQbQFtw1nT3DCOLZLtomL:+C/w6we8qY3wTpQmtEnT3DVjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712690556, "uuid": "e6d83dc1-6ede-48ba-bb67-b4b176b2f059", "value": 483110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712690556, "uuid": "52642668-8553-4f4a-a54f-e61b165196d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712690556, "uuid": "b7010880-64f4-4972-b6e0-e14b6a440895", "value": "app.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1354ac98-f631-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712640113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640113, "uuid": "a8d43ad5-3836-4ba7-bf28-0f3cf81df161", "comment": "Malware payload", "value": "8e8b9d048001cbc855e87f1fe5a0e675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640113, "uuid": "011be9fc-5dc7-46bc-a43b-efe004f9f327", "comment": "Malware payload", "value": "f83686de0199b273f187b7bb1a4dc5cd995af4fa3fa74e3c33c49229fc0dedc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640113, "uuid": "b9aac719-8d6d-453d-86a1-c8da9a62d4ab", "comment": "Malware payload", "value": "50a8d194748ad63792547019f7cf7c4661b5b256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712640113, "uuid": "e47a381c-3f54-448f-bda3-2329f6b86dcf", "comment": "Malware payload", "value": "29f91b23c0258882b1cf38722861744716463e25d9293c28efb4ca7c29241fcd734a8b38493ba921c3c4dd71ccf0d50e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712640113, "uuid": "fb3e44b0-1f6d-4da6-b597-c2e9186ef68d", "value": "T19285F13E5D04061BE7CD89BEF2D53C769E2C4C74D28E5BAA6F8ACC749718245722B2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712640113, "uuid": "925232d1-a0ad-4ace-a833-8cec29772d4d", "value": "24576:D0/BGI+bCsAW6wh3pgDVJoVtXV8zWQURKN02TboSJupPycTLANX7MmKblVs:DGPLW6wh3pgDVJoPXV8Cw02boSQA1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712640113, "uuid": "dfa000d3-b78e-4956-bfda-8342b28ee91e", "value": 1758720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712640113, "uuid": "85ce958d-bb06-457b-b971-353401e3d776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712640113, "uuid": "503dd059-3f56-4ec8-814b-b06381aca425", "value": "SecuriteInfo.com.Trojan.PowerShell.Coinminer.30809.27485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57716c45-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651824, "uuid": "5c082213-1917-48d5-a60a-f63472bf08a7", "comment": "Malware payload (Mirai)", "value": "9a24e9c5f49af02cefb53a5013cd2a33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651824, "uuid": "2d8e2eed-1d7f-413e-9381-f16564c41e08", "comment": "Malware payload (Mirai)", "value": "f8387b16c9630632cd5e72a7dc3b34a78fd37d897f33d3e156a6b343c203a93a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651824, "uuid": "e6bb17a0-9655-4b3c-905d-e8fa644eff4c", "comment": "Malware payload (Mirai)", "value": "b59923391c342896ff09733f80eb3beb7aa26026", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651824, "uuid": "5f6dfa63-4c91-4602-bd9f-3acbdb0257ce", "comment": "Malware payload (Mirai)", "value": "f09d5269810ae3d7f62667de42e293b59481b994bc183b26ff3d3c4f4e30dea8e926b7a54d5a4e149ccdc434a07bd4e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651824, "uuid": "1c79cb9f-f172-4ec8-9bdb-2269c9936fda", "value": "T15F434B01B20C0A57C1A31EB4293F1BD087BFEAD122E4F689356E9B969671D331586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651824, "uuid": "97abb3b6-ab51-4a15-a89e-5667bc0ab457", "value": "768:dEZbR4HRCDBWJDu2teR67ZWG3BNozXdF9WMoELwu9w1eICudt0FhZtOLowBMIY:KbODJDdeR05WrWrEsu96eICOtIZ8tBMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651824, "uuid": "c3da715d-e7c7-4169-9428-14021be725c1", "value": 60060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651824, "uuid": "670fe8c7-4213-4ecc-92e2-0f58bc02acfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651824, "uuid": "42114826-3d1e-44e9-b3f8-6a936c85e270", "value": "9a24e9c5f49af02cefb53a5013cd2a33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295022d0-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712692978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692978, "uuid": "6e1fab32-060c-4212-b31b-112517071704", "comment": "Malware payload", "value": "841f4cef777c2978d35bf0a6dd5933ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692978, "uuid": "ce4e92e7-fb0e-48c8-af35-134c2c89d574", "comment": "Malware payload", "value": "f9ffd6e67287669a7d12ef46284919380a3109749d83fe4a5d47757c8fe4e282", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692978, "uuid": "9c60da22-8681-4285-9e3b-fb23237af1df", "comment": "Malware payload", "value": "c8a1d34d5bb5a97a4764555134a25dabc00eaa68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692978, "uuid": "1b53877a-1254-49d7-bbf1-ed1d8a79aa6a", "comment": "Malware payload", "value": "7dec79070ab38515b0e511216baa64c2b6385a1f0dc360e82b58d64b1b6e1900416b4ffea9e7edb8d5e3c07737a375bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692978, "uuid": "cb1c6b13-ce21-4cc4-aefb-2abfb0d9efca", "value": "T194F30822E51288F6E02D05F557F2073C9979877368B24AAFCFE4CDF11EA22324B9645D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692978, "uuid": "d605fe9b-aa3d-4076-88e4-065ff0fe4e5b", "value": "55762c13550569b1a3a5717bae4453b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692978, "uuid": "9ebe55e8-a530-4de5-984d-4bb3af928621", "value": "1536:ej+zUtBIBU+2Da4lH4Iiue58o/ZDv4GMfcHZIlVKAn5ZAcXeOqbZ6NjkEVnouy8e:eqSe5OmiEoAcCbZ6FNoutby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692978, "uuid": "0139b289-0f59-4b19-80c5-a9ec68e96829", "value": 159773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692978, "uuid": "f850e999-ce7a-48a5-b3a8-fde1210efa9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692978, "uuid": "38ebc13b-5c8b-4dc0-829e-160bdcfa3469", "value": "f9ffd6e67287669a7d12ef46284919380a3109749d83fe4a5d47757c8fe4e282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1d07db-f6ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1712692979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692979, "uuid": "cce63dda-91f5-4fac-86b8-8c89041060c3", "comment": "Malware payload (Blackmoon)", "value": "545c522b01a7d00dcb0eb17dd963e225", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692979, "uuid": "a66ce94d-d70e-47e0-aa53-ecfedcc7406b", "comment": "Malware payload (Blackmoon)", "value": "fac7f29114c71bdab56edcfecc1bdb36c65974c4e6596309695ec6c1cf3e02f5", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692979, "uuid": "f91ad3f7-a00d-4511-a73d-43b337a852a4", "comment": "Malware payload (Blackmoon)", "value": "25ba0cb8d16053a9c6b93f4f45e1cbfc6a1f5693", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712692979, "uuid": "2a5d214f-1a5f-43ed-a140-6f0244fa82f6", "comment": "Malware payload (Blackmoon)", "value": "b3546a6cefa4e07772c318f65be520e545f38740f0726e1731e560d1fd8abb4d70a1d4688368c9ee5e139abc846078b5", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692979, "uuid": "cea68804-f77e-4fde-bebb-9a107206f026", "value": "T1E6B3F823DA0289BAE06826B521FB0738FA7193B91C750963EFD5CEB17C52631DB4364D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692979, "uuid": "b0925144-fb89-43eb-85a3-12b1ed4f4960", "value": "38777b3eb947cc68a2158922f2c92579", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692979, "uuid": "5be92798-2aa3-41ad-abb3-debfbc32c811", "value": "1536:bViMsvI+AQX1OdBaKpVllHG/fdt+fV3JbB5OPnDE5+QDJ4rX27qgrf:bav9OdPx8wJ4rm7qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712692979, "uuid": "d5803198-7029-4e2e-a04e-5d475ec38681", "value": 116226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712692979, "uuid": "cd023d47-99cb-46b4-b58f-7afc4b127b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712692979, "uuid": "84bb09d3-6e8b-4087-abed-c430c5f8e4fa", "value": "fac7f29114c71bdab56edcfecc1bdb36c65974c4e6596309695ec6c1cf3e02f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c826f264-f627-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712636121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636121, "uuid": "67d460e5-a6c4-4b72-bfc1-454b000a0f3e", "comment": "Malware payload (Socks5Systemz)", "value": "58ded1f2ba21c90c0f071585efc54690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636121, "uuid": "c483bcd3-d110-40e5-b649-8d8352607377", "comment": "Malware payload (Socks5Systemz)", "value": "fb2bcf07adb62ba76d441eae8ea5adbbc37dc4d5dea66e5fd1ab85c06fbf3efc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636121, "uuid": "095a100f-9f37-4d12-abfd-b29e1db21725", "comment": "Malware payload (Socks5Systemz)", "value": "b19487634e323009803019fda596d17ba5bf64cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712636121, "uuid": "3e0c5e15-6835-467f-b216-391eeadc8ba4", "comment": "Malware payload (Socks5Systemz)", "value": "66361c91e0fb71a6a50c02c4c62406eedad99d7747c2d568d78bb80591be326bf6d6439a25d6601e5d24653580de5f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636121, "uuid": "f1663d97-5970-45c1-a3c3-24ea86f5d280", "value": "T19D163350E14F41B5C491CBBD812A654CF24B78BE3C76629A31C9CEF98F7B664801D36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636121, "uuid": "a251a324-fa45-49ab-a76c-ac0198aad1e5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636121, "uuid": "5654fa2f-65a5-40f7-90d8-949008f16833", "value": "98304:Cm1iBJs5llgsiLRQFG/tJ/oKYDE1AYgweiTf4ARKkQxI:DizcMOFU/6Yjeij4ADQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712636121, "uuid": "d73307e5-78fd-4b5e-a300-87f693292cbc", "value": 4249629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712636121, "uuid": "2ef0ec7b-2201-468a-b2f4-b070752d0ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712636121, "uuid": "09ef0058-ab6f-45b9-8756-82e2ceeefc0c", "value": "58ded1f2ba21c90c0f071585efc54690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e56acc-f6b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712694883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694883, "uuid": "d3f3541f-7b71-465f-94c4-679871284d5c", "comment": "Malware payload (Gafgyt)", "value": "d76d2bc81329e13416b02637805f439a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694883, "uuid": "6bae4501-5d19-47b4-a2df-3f7c1365fc46", "comment": "Malware payload (Gafgyt)", "value": "fb3743ac5374804c4b7ac4f74c497b432e515d391baa68f02d0670b6106dca3b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694883, "uuid": "6ed26f93-2681-4ba5-aba9-008a6b501a14", "comment": "Malware payload (Gafgyt)", "value": "c9bbd4c791bb45658f864522f5349c828a326a0c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712694883, "uuid": "0f79d7c9-1a16-4365-8f74-928c3c2ac945", "comment": "Malware payload (Gafgyt)", "value": "b7fb0ce7a0cfe21e9bbf0d272c8ba642730d2bf710dcb1af534986e22045d4c6783cff6ae7a6ed159a63f6e27f93259f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694883, "uuid": "5eb4afc6-58a6-4475-ad0c-de0def96b1eb", "value": "T1B8B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694883, "uuid": "14659851-5b6c-4171-a87c-3e77d08155b4", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aPxJmDk1c8xF6KjW:jfO8IBkJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712694883, "uuid": "35567e8d-550e-426c-aa10-e75ec46f2653", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712694883, "uuid": "42ba5b22-a25f-4ff0-af06-eae94910ce39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712694883, "uuid": "de973017-1a9d-4298-a2f5-227833cd7698", "value": "d76d2bc81329e13416b02637805f439a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d252b6-f6a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712688516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688516, "uuid": "4f092f1b-7ae9-40d0-9c4a-c31d6ed6435c", "comment": "Malware payload", "value": "28658163ff81d6a83dd2e817ad579ac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688516, "uuid": "200970a4-062a-425f-a89a-6fffaa202b5d", "comment": "Malware payload", "value": "fd06fc713a616f9cc3e869c1850201a14e9e5272ddb600d99c1fc357c641052a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688516, "uuid": "28970ddd-b61c-45d5-8509-d59afbbec479", "comment": "Malware payload", "value": "940955190d0878bb8563190ca35e7f9892235df5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712688516, "uuid": "4c2b048e-6f10-491e-99f6-e413f0b05e6f", "comment": "Malware payload", "value": "30f78a818e4f6e66ec19a03580b17daaf9499d35b742e8671712cf52cf5bac47a19e10e7dbd117ab8f331b9606dbe5bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688516, "uuid": "c6a4837f-1447-4d92-bc38-a07eef4f4e06", "value": "T14575332F27B69EC60FAD747DDB4089589EF9B089D02C617D47ADCDA06E7E0231512CE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688516, "uuid": "405e198f-610d-455d-b842-21fcdb54b636", "value": "24576:2mX2zplpExiCmwbmTrw7+3q7aSw5s5yGZjfk9d1kOrSxXbktrgZEr0cKkExzYU:271ZTUus0GZydmOibID0UExzYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712688516, "uuid": "e4b83355-a1da-4f55-bdee-08837477f1c7", "value": 1665256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712688516, "uuid": "53c136dd-adeb-454b-9f52-eea5b65e2801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712688516, "uuid": "11e44cae-aade-40fe-8252-7cb7483f8cfe", "value": "SecuriteInfo.com.ELF.Agent-CRQ.6559.14222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2deaa6d-f675-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712669613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669613, "uuid": "87496c72-54eb-489c-8b66-73e30bf301a2", "comment": "Malware payload (Mirai)", "value": "48974ccc6c49bae81e98b63a3090243d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669613, "uuid": "847d809f-33d7-47bd-9bbf-b734585e19c2", "comment": "Malware payload (Mirai)", "value": "fdb055b5021576c9d3be263b7b5f51c1c2502fecbf997c2ed11daf91516c9f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669613, "uuid": "98b0dbbd-e763-43fc-b3d6-96c9478fdcc7", "comment": "Malware payload (Mirai)", "value": "30317632f42aa77efd850312a36d82ba4c752cba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669613, "uuid": "58e48fb4-f4bf-4c09-b9d9-0e1f0bc07e1c", "comment": "Malware payload (Mirai)", "value": "688b266fed8fbe7053ef33ca49625029e9c38c1858966fc332eadc1547ad88a280dc8d99d68e2518e3bf4d1a202cf604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669613, "uuid": "eb25cf59-a2da-41b0-a7aa-4b29c2973698", "value": "T1C2E2E12DDA491FFEDD56E4FF5EA823C42A64163780828D094346D9CBADC5FB03A136D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669613, "uuid": "9d33732e-1121-4441-924b-3ad45ff08e5a", "value": "768:avEvoNpwSM1bCn9XpGYQety+VGM/JnkXn6XNI2WGSh9JgGlzDpbuR1JH:vvwzM5mXpGYE+VtggWVVJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669613, "uuid": "9f20427f-c23c-479a-8125-109c356f16a6", "value": 34232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669613, "uuid": "f6bae833-0a06-4ae5-9150-e13d653421c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669613, "uuid": "28a04eda-a241-4388-9dcd-ff37cd195cd7", "value": "SecuriteInfo.com.Linux.Siggen.9999.21872.7222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d951fc0-f64c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712651834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651834, "uuid": "0e328ebe-bcce-4ce2-a952-895fd8e6c500", "comment": "Malware payload (Mirai)", "value": "7f757bfa5a0fa33ac4dc8a99b93fdc5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651834, "uuid": "b6d635b3-06d1-4a17-b76d-78e6bcb80646", "comment": "Malware payload (Mirai)", "value": "fdcae10640db143c1c3c88657a87b8ff8b1a47a6195d10e2e4f2e79e455318f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651834, "uuid": "6815f75d-008d-46b7-b4be-5cf1ca590082", "comment": "Malware payload (Mirai)", "value": "0db9fbc3b66a39c42463a22484237d54bd17b694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712651834, "uuid": "3275567a-3588-4164-a3db-5d4364b0ff7d", "comment": "Malware payload (Mirai)", "value": "aef08e5fe0e423f8173d0bccd982fed1d397b3555b47b59f3f19b5c98306face168384cbb8d42673e12f41672c67d171", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651834, "uuid": "b76a4946-1da0-4721-a56a-1ee9bad9ede4", "value": "T1E4338D72DC2A5E54E18A0270B8644F791F23E1C09313BEBB16A9C2B5544BDACF905FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651834, "uuid": "3ab5da83-68d9-48ef-b01b-54e7f0998743", "value": "768:0jp8BaLXmXA2iES8kkvCDJTK05wUa3oIN8dFCylWJ/foQdvwRYI:018BareS81vKK05wH4IqFCy7QyRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712651834, "uuid": "65dc8593-01cb-442d-9153-906dda6c67a5", "value": 55064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712651834, "uuid": "d664feba-a040-4c59-8c47-ab40993719a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712651834, "uuid": "ba308e81-3ca2-46ad-8e77-67e47187daa0", "value": "7f757bfa5a0fa33ac4dc8a99b93fdc5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f7894e-f652-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712654423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654423, "uuid": "6cbbc3ce-8fcd-4e18-b2b9-e53dd2f57b87", "comment": "Malware payload (Adware.Generic)", "value": "f21ac45378def6701936925c94cceaee", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654423, "uuid": "371d7a6b-7632-4db5-b617-91eb7343f1c7", "comment": "Malware payload (Adware.Generic)", "value": "fe38389b7c9e5c5522ed3df1c64da2109715481189ae5011f6c8f425554f7dfb", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654423, "uuid": "4d7660c4-8665-4e5d-8958-cc199ce5cba0", "comment": "Malware payload (Adware.Generic)", "value": "c783d5565dd9b5ebca3dba635f488f8bc4e2a453", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712654423, "uuid": "c5a96326-b44b-4510-a930-651482fb81de", "comment": "Malware payload (Adware.Generic)", "value": "9419bb902ef6aa0e6f0379b244aeec21c6056ba5276986be5d4a7524bf28bb55a510d86aad7715ae43ff5691e4a7c58e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654423, "uuid": "3d786632-66ec-422d-9afe-cb6dc62e9761", "value": "T1D267337BF124B52EC8284A324176E22044FB6F1965160C4E67F83E0DFBBE4517EBAE45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654423, "uuid": "49333426-ccef-45e7-b2df-9ed0f1863ad4", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654423, "uuid": "3fc7fd4e-7a9e-4d6c-b3fb-5be25a620fb7", "value": "786432:UFnShjsZHgskk7aj2xAgODhYc7lCUt9ROXBV:GnShCHg87aj2+gMjMiOXBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712654423, "uuid": "b9ef39d6-2559-4545-b714-d642664a42ef", "value": 32379576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712654423, "uuid": "99244c4f-4626-4480-9a36-4bd377f6cd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712654423, "uuid": "6666888c-c387-485e-9ace-91522332e852", "value": "SecuriteInfo.com.Program.Unwanted.5387.22209.3690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce03df2-f674-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712669227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669227, "uuid": "3dbd9866-485d-4957-a3a6-32113005f289", "comment": "Malware payload (Gafgyt)", "value": "e49d0053205349b949aa72e831ae499b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669227, "uuid": "79b389b5-102f-4aa6-84ee-93ff5bca0a9a", "comment": "Malware payload (Gafgyt)", "value": "fe5098f8d800db748dae58003f17582c84bd62d7d07194c07f480324135aa3f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669227, "uuid": "bf11651b-2505-4880-a174-df0dbcce713c", "comment": "Malware payload (Gafgyt)", "value": "2986f0ce1f16bdc31c60dd609d2612b3d363eac1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669227, "uuid": "03922c8c-e378-4476-871e-764a744ce6d7", "comment": "Malware payload (Gafgyt)", "value": "54ae37c9e87808a3782d20bcf85e0bf4bfd27e4d9b0f64a23b59f546ec7f66d42b32433e3c8157443068c123f4e04afc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669227, "uuid": "9cbc02a2-8491-41c4-a61b-787e6e88f4a3", "value": "T170D32A02F4504767C1D2177AB79F520D37236BB987DB33129A346EB42FC179A1E3A9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669227, "uuid": "c9577591-88be-402d-9aa2-1a56945195a1", "value": "3072:/d+SqaD0nztKJpzAHR+ushO/kVYqAGSrjmWQ9AKXNY8:V+SqaOztBshO/zqGjmWQ9A8NY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669227, "uuid": "ac131d63-f9aa-46bf-bcb8-1c3a0015e5d1", "value": 133086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669227, "uuid": "21548e11-6351-4e04-b1c6-42d34dfc3b12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669227, "uuid": "5be6dfbe-62e2-4102-bada-7a4be4ac0439", "value": "e49d0053205349b949aa72e831ae499b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671c5c2d-f675-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712669459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669459, "uuid": "bef1ed45-7bdf-4796-86d7-cbc136b954e2", "comment": "Malware payload", "value": "77e52123c83c19b73917a9f40fef8fe5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669459, "uuid": "1ea645f3-f0a5-472e-a174-f65a524d36b8", "comment": "Malware payload", "value": "fe735c6575ed3a25c3bf8b71c7d049cf361de031af8769c9d3614b57ffd38531", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669459, "uuid": "3f8288ff-d7cb-42a0-94e8-ae23c8687aff", "comment": "Malware payload", "value": "8369b20794c8be73ec7681c7b2caa30fe78455bd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712669459, "uuid": "c30969b7-bcfb-4a86-89b7-c74e9eab9b40", "comment": "Malware payload", "value": "e24e354e6a627b5c6a4fc703e10f47e8ce7206c7dea58e5405b49eb760fcc58a7a5955ed8742bb7dbb4e50087c8aef43", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669459, "uuid": "8c7032cb-b9bb-4a93-bd7e-6f6db074a866", "value": "T1AAE3BE2DD34B02698F520377AB1B1E5141BDBA7EF38552B1306C537933EAC39A1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669459, "uuid": "27790a6f-c4c7-4484-a2fe-2a59a7bacc6c", "value": "768:1SwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWj5WplNAQ9GFajwXV2TX:owAlRkwAlRkwAlRuWpGFajwXwdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712669459, "uuid": "18cb6266-856f-417a-b2b2-b4bd58db9511", "value": 148813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712669459, "uuid": "79a03ca4-98d2-4f57-ad30-ab8edd7352d3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712669459, "uuid": "fd90d79a-de2b-41bc-88ae-8ebf8152c701", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6a4d04-f66d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712666198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666198, "uuid": "ac92b255-e8f2-4fc7-91cb-e7cd50ff8c66", "comment": "Malware payload (Mirai)", "value": "9290be80dd5734df13069a428c372355", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666198, "uuid": "3255b43a-022f-4f48-908e-30b85c93e64a", "comment": "Malware payload (Mirai)", "value": "ff70f0092e42e63cfbd3112edfc6eae4914f4e95241a7b64be14d69f031530be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666198, "uuid": "e33711bf-2f17-450b-b90f-9704eff1b358", "comment": "Malware payload (Mirai)", "value": "9e2064b1a2e23136d0c3e82fdfd376808db0a6fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712666198, "uuid": "6350edbd-27e5-40d2-ae1f-b0868fe91967", "comment": "Malware payload (Mirai)", "value": "5f76e5020ed06f1704d80b7577643adc73634953c5a82d0f572c2047ecfe281ebb37ac938aa8b68a94a2cf11a90ed389", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666198, "uuid": "c18bb773-3a98-4b48-91b2-e08cb413939c", "value": "T19A131931B9762E17C4E0A57A21F74328F2F6530F25A4CB6E7D620E4EEF04A4452636F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666198, "uuid": "32eae283-d08e-42de-bb0b-5055d6ba6598", "value": "768:Dgmo7dI4I+bYep9MHPYqS4G/moT1NIQR0O+q9K0yX2:0m+dI4IBg9swq6mujIQRuqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712666198, "uuid": "790899d2-07aa-4eb0-a4f2-fa4df522a7fb", "value": 45404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712666198, "uuid": "2a42d915-c0d4-47f9-b4f9-c5d28ed3d8ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712666198, "uuid": "5974ea95-376d-4e4d-b9cd-68b95f845e14", "value": "9290be80dd5734df13069a428c372355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }