{ "Event": { "published": true, "date": "2024-08-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-08-28", "timestamp": 1724889781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "75f2001b-f96c-410e-acb4-b1161e35ef27", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6501afaa-6582-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724879618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879618, "uuid": "bcc7aa26-8388-4629-83eb-d7a48cfcdb43", "comment": "Malware payload", "value": "821e219f3bcece9cf0a01f414a86fce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879618, "uuid": "e2410b78-3105-497e-9534-770f2696940d", "comment": "Malware payload", "value": "00038f1e3f781026be34dc1fe4f1beea477c62e21d789342b5afe120a2edeaad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879618, "uuid": "cbfefd20-145e-41fb-b410-f01428f9dd0b", "comment": "Malware payload", "value": "3af019681098626f3853f31976a1c2e763e7bf23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879618, "uuid": "449294ff-eea8-49fe-8ff7-16fce87d2a69", "comment": "Malware payload", "value": "5df168fefb075082086a50a085c098f6c160a1ba110fda022a673f1a144d54c15279d880404787cc557ab9f3d9e0e319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879618, "uuid": "bcdf9956-b7fd-4f6d-bc0b-44ef2b432698", "value": "T1EA853310BE7B6CFEDB0F0B77325DC2D97071EA166E2B47A0B1A4417D266651032A78CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879618, "uuid": "12fdb30b-930c-43e3-adc8-10fa313f1c1d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879618, "uuid": "9525abf5-e4d3-4744-acd5-f392bcccc88a", "value": "49152:JvdhQpaiXo9MQq8Gi1xSHa6Ci1tZWtUf:BdE5/8OHa6CMtZWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724879618, "uuid": "39cbc614-2941-4a8c-9ce7-86a0a146139e", "value": 1782272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724879618, "uuid": "50c30d35-2872-4ecc-ac2c-22458f0c8b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879618, "uuid": "c9841b94-f5dd-4312-a2a1-22c8670ce483", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5651c85c-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822470, "uuid": "e47ee9f8-1530-4089-a6b4-6d09026450df", "comment": "Malware payload (Mirai)", "value": "ed07c2493eab78f6a1fb98015fa358f3", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822470, "uuid": "f62918d7-1f2c-4c6e-8807-96b0e5287539", "comment": "Malware payload (Mirai)", "value": "03107d582d711c707d8d924b900db0fc2f2e69251aeb5e0f0c4413b61aecc529", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822470, "uuid": "5b0fb15b-4518-42b3-9f12-b77961ccdb98", "comment": "Malware payload (Mirai)", "value": "93d821cbeec088219f1e8ddfd09550f1ec70ac74", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822470, "uuid": "9dcbf7fe-1fc3-405d-8a28-b76968964931", "comment": "Malware payload (Mirai)", "value": "b32ce5417d0e2a3628790dd315600f4a7b4091a10d15c0fc89709186e9e730e7d159db8586d92b25d5abb3001f741e6d", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822470, "uuid": "195708c2-5e6e-4b99-997c-b78b67afab2f", "value": "T12FC33A90FA0CAC32C46C0C36B77AD75A335316D54DA7D210D8A4E68DFF8B590ADB48B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822470, "uuid": "9fb16a07-ffbb-433f-9954-1f3393c0e70f", "value": "3072:pxHHyWfZ0Ua+GweK7rn75941cxMPeW4aVkm:vHyWx0Ua+necxQNmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822470, "uuid": "6a5bc098-1941-4c4b-8892-e7189e16e909", "value": 129076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822470, "uuid": "4081e2c4-e2f4-40aa-b1e8-25ca90fd7542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822470, "uuid": "7bca1bf0-bd9b-4027-b599-898398a289dd", "value": "criptonize.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf5ac36-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827768, "uuid": "ed5478a9-656a-427c-8045-7a7b13079a21", "comment": "Malware payload", "value": "834363fbcec9270704da8aa8da172e92", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827768, "uuid": "55c369f7-25e9-4e01-b040-42b4ca4b8d5b", "comment": "Malware payload", "value": "03160d7fd6c4a2b9b12a34255f6745c29441611cae1c4f9b1a23c792408f22d1", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827768, "uuid": "72af3525-6957-437a-8cff-8a3dc354a601", "comment": "Malware payload", "value": "5d956876e6bcaa2df9621417777b6431709c1895", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827768, "uuid": "070d2c4d-bb24-4919-aee2-06103ffcf52a", "comment": "Malware payload", "value": "ffff04d3dccb48019ddfcec7831ec122e271f85123b748b8dab68246c8f7d0ce707277cabf0247d20337434f162d508b", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827768, "uuid": "77357821-e2b7-46e5-8895-b10096c745b9", "value": "T15D23F895BA648CEBEA51633E84EBC3775B7DF1818B235B53B734B63017137923094246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827768, "uuid": "ab27878a-dc59-4548-bc2e-21fe21082928", "value": "0cd785ec9a8b789119b2f9d9ba6a6091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827768, "uuid": "8b737a25-c238-4917-a719-7d1ead7120a8", "value": "768:XnqxE87N7qFL4M9QFMmM1JCPP3lLuzZPKqgRrtsSnru:sN7q+MSFMmM1JCPP3lLuBZgF+Snru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827768, "uuid": "58879566-9922-4941-92f2-bc60db54173c", "value": 47349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827768, "uuid": "e3f3cfbe-0d27-4cbd-8ce4-37b2d0a2313e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827768, "uuid": "87d26ee1-48e6-499f-a875-7c0f8ab5a80a", "value": "03160d7fd6c4a2b9b12a34255f6745c29441611cae1c4f9b1a23c792408f22d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4032310-64ff-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AgentTesla)", "timestamp": 1724823540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724823540, "uuid": "9c21aa0c-394f-4e08-ade9-45059ec1e7cf", "comment": "Malware payload (AgentTesla)", "value": "691efff92b619a3acbae657746ae178c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724823540, "uuid": "4e6cfaae-71b5-4ec4-be21-807e817546a6", "comment": "Malware payload (AgentTesla)", "value": "03438d007dd69f9021f8c37eb21cd9f817189c99f86e94136b0f6223e07a7366", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724823540, "uuid": "dff795a8-4d5c-4303-8a3b-4db837189e94", "comment": "Malware payload (AgentTesla)", "value": "969b431980e834786e479aed79701b987560b658", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724823540, "uuid": "de5b5bcb-5388-4e07-9497-d73c53f611f2", "comment": "Malware payload (AgentTesla)", "value": "c726cd13a5b4bfdc95b77651dde9e965931b258dabdc4d24500da3a5b2d41d2fe20e022db0d2c737812dde74a9433b69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724823540, "uuid": "93eb6bd6-ac57-4b89-b3bf-afa7c504c439", "value": "T111E4238EBDCE653BD6AD6639A2C704508E326471819EE7CB0CC56C294E333E45B719F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724823540, "uuid": "56bc7fe6-428c-4478-9e24-ac945d00dbaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724823540, "uuid": "24d1aee3-436f-43c3-b248-986c9a58d09a", "value": "12288:ZT+APGx//pLtWUz6sLQiibI+YYtlsewEoVnzEYTLO83y7bvvv:NtOxnhtLz67b8Yga+zjO83y7Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724823540, "uuid": "d7da349b-ddfd-44b9-9445-bc1aa957f16c", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724823540, "uuid": "47187fcf-2be9-43e2-9dab-98662fd0fe6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724823540, "uuid": "2a65dc0d-6e5c-48e0-8c7e-ce5d39964a03", "value": "BGC-2024-EST-001 & BGC-2024-DST-003.xlsx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f48e26-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863707, "uuid": "80802dde-797b-4383-840f-fa94bbd94264", "comment": "Malware payload", "value": "ae327f467962e4d3126c3a7c16c3d87b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863707, "uuid": "5d7b201d-92a2-438e-8740-c496b56195a8", "comment": "Malware payload", "value": "03fa9e716e0547eb0a74a69ef50df5b33695e7f2d119df20e14e9c1465d20829", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863707, "uuid": "d5c5e95d-fb01-4766-94d6-b89bcf85b285", "comment": "Malware payload", "value": "1431f5b0b700b7faaa8f14ff3dd2b07135a89763", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863707, "uuid": "81d9760a-6fa5-42a3-bd52-d4bd574f5cfb", "comment": "Malware payload", "value": "c0ff0ae1976e3676a5795f7467e6f4e14432628323b56847fc4f8a438c969f1fdc065827132eefb7716a37e15bab1629", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863707, "uuid": "2d70f01b-10f5-4a72-86a2-a9aec1366027", "value": "T15C77230091B3B515F76BB2BF2AB95FE48559BC6A02E59DF7637173B806F109204338A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863707, "uuid": "1872f0a9-d989-4c16-9cff-5f7cde148ff8", "value": "786432:Et9UUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0yoJ2:Et9k7xVLYjsp+ikJS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863707, "uuid": "3538b413-f16a-484c-bb67-0bf11492f8e7", "value": 35910656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863707, "uuid": "cf0cfcfb-1fae-4a8a-a336-166e546afa64", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863707, "uuid": "da4e1a4b-34c2-481d-8c3d-eb1086a77d1d", "value": "03fa9e716e0547eb0a74a69ef50df5b33695e7f2d119df20e14e9c1465d20829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d850f6-6554-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724859789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859789, "uuid": "8108ee74-38aa-4f64-85b6-e8f1947e0e1f", "comment": "Malware payload", "value": "5324e4e95a407d02a643d79df9b0c481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859789, "uuid": "ae0ba46b-1ef8-411d-9c8d-17a6a68eb17d", "comment": "Malware payload", "value": "043604cb1f02cc13547d5cd00abc5f908b15167b6aaa68a23107ae46b8d9aec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859789, "uuid": "34318750-2330-4a38-8dcb-f1e0d5bf3d87", "comment": "Malware payload", "value": "bf137000cfc5bdf20e8beb902d3928b9ba5aa78d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859789, "uuid": "3cf76400-8919-4856-8983-102ae6488e86", "comment": "Malware payload", "value": "18d424237703334f69bbcbe814de273c6ede2e99c03d0bd6f397f4239906b534541e9c204944db3b973966da975d69c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859789, "uuid": "84fb6586-01c6-40ab-a934-f6d0d628fb92", "value": "T1A5159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859789, "uuid": "92f550ac-8c70-4e29-b279-4f4ced382a99", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859789, "uuid": "7694d0d7-b38c-4b35-9afe-ac324f3a5062", "value": "12288:CqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTK:CqDEvCTbMWu7rQYlBQcBiT6rprG8asK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724859789, "uuid": "e744c867-4973-4fe3-b4ac-2d3b5ed4c2b2", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724859789, "uuid": "3a357b20-369e-484e-9cad-d294d1fe94ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859789, "uuid": "fd0bae32-81b4-4c9e-bb2c-22a7ae70799f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cda53f-655c-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863492, "uuid": "71f98af4-c9ae-4e22-8e6d-5235872aad5d", "comment": "Malware payload", "value": "eb5658e5092c5119472c4bc6714e31bd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863492, "uuid": "64d011ad-bf9d-4863-9132-79f577b425c6", "comment": "Malware payload", "value": "05759b68cabd2e9391a4c0d7f0c0dba4c4784cb3371a6451432638a2a8181fe0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863492, "uuid": "24b3a0f8-1331-4886-bffe-9c86b9a0fb10", "comment": "Malware payload", "value": "aefe5b7b1a4b8493fb4dca30303738cff5c131b0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863492, "uuid": "244cd6b5-caae-4d91-bbe8-c999e3446ab6", "comment": "Malware payload", "value": "df465be37ce13663d9a596a89b0996703f7097c6bc3239e8726d149a268672eceac62fa39f34ec5f60dc53c5200119b6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863492, "uuid": "31316e67-29cd-4be2-a5b0-be9b461fd71e", "value": "T1DE77230091A3B515F7ABB2BF2A795FE48559BC6A02F59DF7637173B806F109204338A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863492, "uuid": "5ea40614-bd16-4ebc-860f-0c0698ac38bb", "value": "786432:Yt9yUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0yshkG:Yt9+7xVLYjsp+ikJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863492, "uuid": "b11dc57d-fa5f-44af-9c93-410ed38e34df", "value": 35908608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863492, "uuid": "59daf67a-7122-41b2-bcbc-c3d2d75ccdf8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863492, "uuid": "db94edfd-8e7b-4eb1-968d-af3bd369cd8a", "value": "05759b68cabd2e9391a4c0d7f0c0dba4c4784cb3371a6451432638a2a8181fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6487a0-6581-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724879124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879124, "uuid": "25476cff-3a0d-4e23-9d4b-d03a12d21e8b", "comment": "Malware payload (RedLineStealer)", "value": "3b6501feef6196f24163313a9f27dbfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879124, "uuid": "ff609068-7967-4e89-9751-09405099bd9a", "comment": "Malware payload (RedLineStealer)", "value": "0576191c50a1b6afbcaa5cb0512df5b6a8b9bef9739e5308f8e2e965bf9b0fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879124, "uuid": "332db3f0-1dbe-421d-bb6b-7e0dcd074b17", "comment": "Malware payload (RedLineStealer)", "value": "20d60478d3c161c3cacb870aac06be1b43719228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879124, "uuid": "ae6832de-c83b-4c24-8bea-df23800bc673", "comment": "Malware payload (RedLineStealer)", "value": "a4fdf05a1cb2a0a9941395f3c55aacd3daf3a637ce7618291a9dc1f00951b6e6a5ed2982e5f4573392870630d9c0176d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879124, "uuid": "71959313-a2eb-4b70-ad5a-5887672f98a1", "value": "T1DF645A5833E8C910DA7F4775D861D67193B0BCA3A552E70B4FC4ACAB3D32740EA50AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879124, "uuid": "c5d592f0-0367-4571-973d-caa0c9f2f166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879124, "uuid": "e2878e93-4310-43b9-b0a3-97731bc293ef", "value": "3072:acZqf7D34Tp/0+mA0kywMlQEg85fB1fA0PuTVAtkxzZ3RMeqiOL2bBOA:acZqf7DItnGCQNB1fA0GTV8kv0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724879124, "uuid": "9c6d5585-614a-4e78-aea7-1c4b848d5a10", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724879124, "uuid": "a5cfc596-be34-4b1b-8897-0e78c07a0d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879124, "uuid": "ab00d8b7-4777-47d2-8025-1eba951458f3", "value": "3b6501feef6196f24163313a9f27dbfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1822c8f-6531-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724844984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724844984, "uuid": "5e475979-60a2-4069-8316-3063d0d32ced", "comment": "Malware payload", "value": "4a10fb513a346ffdca884fa74cf18015", "object_relation": "md5", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "javaforyouedu-in", "colour": "#DDE5FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724844984, "uuid": "7ab229ff-5df6-4064-b9c9-2ac57868781c", "comment": "Malware payload", "value": "079e3171048286472cff2b0267cd2d6a90bf9d7f45255f48031bf4bf2ac3b0b4", "object_relation": "sha256", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "javaforyouedu-in", "colour": "#DDE5FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724844984, "uuid": "282ff585-81f2-404d-9979-9c304b9b469b", "comment": "Malware payload", "value": "623b8046938fd54fae54957ece8c7ff40653217b", "object_relation": "sha1", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "javaforyouedu-in", "colour": "#DDE5FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724844984, "uuid": "96bbe727-0aa1-422b-bbb6-6c94cf62b5f9", "comment": "Malware payload", "value": "8f8a67c5cc7262be29bed636aaa152c9fc7bb0475034458458b7b644dc4d8f7e36fed58e244be48ef6b29c0cdf4c6ffa", "object_relation": "sha3-384", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "javaforyouedu-in", "colour": "#DDE5FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724844984, "uuid": "7d6c57fe-7bed-43db-ac31-efdc2d861961", "value": "T14E4412097AAAE4BCCE57D4F9056DE531643F31069C1C86B81E82E0373E677D835BA98C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724844984, "uuid": "3814e41c-6c96-4545-af46-89ada22d5264", "value": "df00652ad3e78ba777ba702462655cf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724844984, "uuid": "87bbe2bb-b70c-4898-8904-808c0c72bce2", "value": "6144:M7tLKV/ZQEhoEo9/+CvLMtvs137aaaDnka/za1C/:M7t8WE+/xvcvs1EDkaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724844984, "uuid": "0632fcca-5d32-4cb0-add6-681754cc4854", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724844984, "uuid": "392767d8-59cf-4e66-bafd-37db04a231dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724844984, "uuid": "eb8ad08b-91d5-4dde-a211-56d328dcf31a", "value": "IMS64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c241c09a-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724840261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840261, "uuid": "a94b35d4-e467-4692-ba2b-bcce783130bb", "comment": "Malware payload", "value": "60b1dc8ed4f56a0ec9fc0e806afa2321", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840261, "uuid": "f3394118-1892-428b-9dcf-bbb751621cc1", "comment": "Malware payload", "value": "07fd27ad15257368e65e8f1159ba47f8963fbe62cd8da26f4f7d4d83bfbd50da", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840261, "uuid": "dbdff6aa-103c-4899-b4e3-a28c4cce4928", "comment": "Malware payload", "value": "99421e432fba58ea983f8929fccd296bda8f092c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840261, "uuid": "7684abee-9142-41be-bbfc-8417390d3848", "comment": "Malware payload", "value": "7c4b8ed7fb91423e6fd4ccf24df108d200343b54f7146ea1870c639c1fb4affa5323254afea030bcdddef27b7edc042a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840261, "uuid": "2944c051-6862-4285-8612-b19631a62f79", "value": "T12DC4231AFEF88108F93DA878589D6425130439832FEA56C5B9CBF706952FB4ECD2D670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840261, "uuid": "a233d624-207c-403c-9935-ecc929903651", "value": "12288:8FqZ58AkPNwXWdvb8Eb2PUGgyybHwLE52smagbuvv:OqUPUW1bLSPUQyjwYwsTwuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840261, "uuid": "8326677a-2ba5-4225-bd6a-80ea2445d636", "value": 583088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840261, "uuid": "73ab2bf9-354b-4da3-9b0a-775a4c266dcf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840261, "uuid": "56922312-e4b8-44f2-916d-19395b465787", "value": "PO 7001628119_61900PM.pdf.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9ee4b2-64e5-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724812447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812447, "uuid": "bf6769cb-71eb-4309-9523-2a13554033e5", "comment": "Malware payload (Formbook)", "value": "4bf5f0c19903569f5dd85fd8067041ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812447, "uuid": "33c26b6d-be6e-445b-be1c-d124c5e3d7ae", "comment": "Malware payload (Formbook)", "value": "086e659b1784ab08b4694bbb06483d4b54f966697cadffc2f15edceac440b7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812447, "uuid": "cabe06b0-b436-400d-b02f-4292077e7c8b", "comment": "Malware payload (Formbook)", "value": "d467e870a79615ad465d2215ca5284e5cb07fbd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812447, "uuid": "c27014ca-57be-4262-afa9-8c609b93761a", "comment": "Malware payload (Formbook)", "value": "283704cb4c6340abfc633344a45cfd0df4147bb77baf438dc1ac639fd59a54f99e9fcda9a205737a7f521d003938af5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812447, "uuid": "61c0d77d-7f41-42c9-bb3d-f78fcd632264", "value": "T11635AD0273D2C036FFAB92739B6AF20156BD79654123852F13982DB9BD701B2273D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812447, "uuid": "6e4bd03c-b217-4eea-b085-68b336aca500", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812447, "uuid": "64e5bb5b-ed64-4ba6-b099-51c88903ef9e", "value": "24576:tAHnh+eWsN3skA4RV1Hom2KXMmHaCdLtHgGbtYNHu5:Mh+ZkldoPK8YaCdGDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724812447, "uuid": "09a26655-8af8-43c2-8e9f-b5014d5886d4", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724812447, "uuid": "c337d1d8-db98-473a-acf9-a97832bd6715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812447, "uuid": "15a25c9c-73af-4dd9-827f-ab233092c893", "value": "shipping Arrival_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ba91cf-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854769, "uuid": "376866d5-7de4-4aa1-a0fc-0b7db8138ec7", "comment": "Malware payload", "value": "4a122be8d64f04eabf7e46705e233fbd", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854769, "uuid": "cf991bda-67a3-4938-889f-01a181d0b7c5", "comment": "Malware payload", "value": "090a32791fa3935bf9b30505cd3c2e710592e2a9d1be40fccd610e567d39279d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854769, "uuid": "09d683a9-b7e9-4af1-9f6c-59346141bc18", "comment": "Malware payload", "value": "aa69d75282779805440dd7780d4cc7b688a5e89d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854769, "uuid": "e8d7ba0d-b354-4281-9f09-98b8693d3f5d", "comment": "Malware payload", "value": "226e3c574cc979b103a262d7ec65e89cd072cd63ae0638a00d20e82fac808f8af99fb4c5c451c39d039d6e02188cfc07", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854769, "uuid": "85d6bf53-bc42-42b0-a5e8-1f1e822823bc", "value": "T1F6C4231235A59F13D0879CB42DCAD6D78DACFD05EF91C9473B64BB2E183CED88492226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854769, "uuid": "61bc7c30-941d-4e0f-adca-9cf171a12c5d", "value": "12288:v+wSlvwa6SBNYIcsgWb9NUaKhwuia/Sa26IhQxB:vPSuaJYItVsaKh4a527hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854769, "uuid": "361b90c2-b02b-490b-b929-d2c49752e189", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854769, "uuid": "1a4f2b35-8be4-43c3-9135-689e884dcf05", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854769, "uuid": "360b0152-bf61-4ff9-a2b4-c7570bd953b5", "value": "SecuriteInfo.com.Trojan.GenericKD.73942994.9810.18396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90d1fc6-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (CobaltStrike)", "timestamp": 1724827361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827361, "uuid": "fded1a21-b773-4265-bed2-0815f69095bc", "comment": "Malware payload (CobaltStrike)", "value": "1204bf1ec65e6428556cd7e0e27dcea3", "object_relation": "md5", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827361, "uuid": "39f8e25b-a9b3-498d-bda9-0531c06a9ac9", "comment": "Malware payload (CobaltStrike)", "value": "09966975d90bfd2d7afcdbe1a870bc131b7422c0fd8d3d2f498f6e88a274511b", "object_relation": "sha256", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827361, "uuid": "714a401c-246f-4570-a1a4-21c0a7e79aee", "comment": "Malware payload (CobaltStrike)", "value": "82ef0fd196b691b34bc3dd8308766f0c01645d91", "object_relation": "sha1", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827361, "uuid": "0bf646dc-05c4-4bcf-9b5b-483fb90bfe36", "comment": "Malware payload (CobaltStrike)", "value": "e93bf2e43356b67fea3f0ac8e431533c86e9452524ee8e02a5d06c24ffae2638c0fa8318aa9410ce331891e3ee007079", "object_relation": "sha3-384", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827361, "uuid": "a5cbf808-0d27-4a08-81f0-4688245d6157", "value": "T1BF954A4B7C9504F6C4ADD23189B362667B71BC290F725BDF2A80BB382F72AD45A75700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827361, "uuid": "888ea262-27b6-432f-9822-ef59f7776d49", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827361, "uuid": "49301829-3715-4457-b917-d7d1be92c6b6", "value": "24576:pWlT15nrizQCn6SPCHjeV5i2dVWTgNpwsXziLesdd1:po15nrficjk1wsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827361, "uuid": "31f1b294-d671-422b-9cec-676b946febde", "value": 1987072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827361, "uuid": "14fb4eaf-31cf-4497-8659-ab8bb3c05a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827361, "uuid": "8a9d347c-8ac9-4ba5-914c-d324d2dd72b1", "value": "09966975d90bfd2d7afcdbe1a870bc131b7422c0fd8d3d2f498f6e88a274511b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385ee8d2-658f-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724885127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724885127, "uuid": "be26d747-bccb-4d7f-ba31-30c87d5783fc", "comment": "Malware payload", "value": "00c8b60cc6c51b7c4c93405ebf9237ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724885127, "uuid": "18f1729f-8406-4075-a738-575ff8d3db52", "comment": "Malware payload", "value": "09e79ec83fba30ac5b424cd6c0fbee4f61d62a7438b1e1cf4461f34327cd65ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724885127, "uuid": "fd7e976a-b320-4008-8ad3-d683cacc744e", "comment": "Malware payload", "value": "fbf0bcf65ac29987a65234938be89d640cbae318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724885127, "uuid": "1b3c4546-a44f-4121-a770-ef55a26d15fb", "comment": "Malware payload", "value": "67c8f6d7a5b7f92787c53a2ae01a680d52f81bb2d49f940d5499b45d9d9b9e30e03fc5d0800192e6ecd460904e553938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724885127, "uuid": "9d9b2c62-3b43-4187-9565-a0a754d3894a", "value": "T17EC70890CE390C1BEC40117026F7126AB77A74CED3A1E347920DFABB7E67512AD89197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724885127, "uuid": "2a7f1fd5-5e2d-455a-97f3-3bc54a797c14", "value": "cd700d3e41bc9b2f92b52513996a7bd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724885127, "uuid": "0a06cc9c-8138-4613-8e4e-f6b2c88a9412", "value": "6144:n5ybnatMCCb5Zf3qbzZmITfv9OR7MnuYDy:0zGnCb51qbz5L9OEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724885127, "uuid": "c1bd23fc-5815-4262-bfa2-4bbc9ac86c39", "value": 57805160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724885127, "uuid": "235f07d5-eefb-4ff9-95df-c9638b61783a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724885127, "uuid": "fa1d0f49-8dea-4795-aeb1-eab9fb0d47a7", "value": "cY-5134-kfF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2f3ff7-6577-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724874741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874741, "uuid": "56d47f92-529e-4698-9cdc-adeb0215d365", "comment": "Malware payload", "value": "0e3dacf8e6b3cafdd219a55bce552b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbraLoader", "colour": "#871741", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874741, "uuid": "6784090d-fbfb-47c8-b600-6b979684adfe", "comment": "Malware payload", "value": "0b5dd45a57d8a73a64c8eaf525c5cb77fb53ff3360e1fae374c589ebf6e7a032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbraLoader", "colour": "#871741", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874741, "uuid": "cf7b2b9a-4884-49a3-a242-1124ba317316", "comment": "Malware payload", "value": "820d902693ec8d5bc911eee5a14ab5e2c21f4f81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbraLoader", "colour": "#871741", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874741, "uuid": "81e0f8cd-96a3-413d-a366-caec843a0f75", "comment": "Malware payload", "value": "75742b0830b2de1194459ce94a1b642b6b9e80bd39d8d9b3acf459e3eb916a00b2af397bca2af8bfa2bbe8cd695545f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbraLoader", "colour": "#871741", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874741, "uuid": "24c66149-63f4-4eec-894f-a54fed9c9d80", "value": "T171E34A352ABCE17BDE3181F2DFA59A75F051A8713611C81AF69723474A33843A2E523F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874741, "uuid": "4b1dc2ad-e31f-4229-b560-c22aaafd9bc1", "value": "ee75c11c19c26e8c8ae0a58c0636d023", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874741, "uuid": "98f7344e-6ffe-4e0a-afc9-8d7af9c447fe", "value": "3072:l5SVkkgUgXC7AdYzrV+Dljy/32ubwZ/qJH:SUFCkdYzrVolu/J0Z/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724874741, "uuid": "9ed9ac16-e080-4297-8350-e592e9122850", "value": 147459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724874741, "uuid": "8cb83de1-63a6-482e-86da-380c22641388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874741, "uuid": "7d9a4cdb-820f-4c08-8bc6-973f217f10d5", "value": "alta1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d23e7c4-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846131, "uuid": "9ed602f9-bd69-402c-ac0e-9c003e114116", "comment": "Malware payload", "value": "7f3766cea24781bc9fbd306209c41761", "object_relation": "md5", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846131, "uuid": "d2120c61-d095-4c8a-80ca-3763fb0094ce", "comment": "Malware payload", "value": "0d153acd727616dc6fc34fe224a3b654b8a657a25edf7c98705d8deabe88a6d5", "object_relation": "sha256", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846131, "uuid": "7616c03d-851a-40fc-88ce-c64aa418c980", "comment": "Malware payload", "value": "a7d9f9fe7b794f99dd5c120319902c6a3f3c1a81", "object_relation": "sha1", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846131, "uuid": "c275a204-ff84-43a5-b920-d650bf1b863d", "comment": "Malware payload", "value": "c5b209a2c5035cf9f595792260c77727563ba88f6233d9c7f1c5bf39ddb7426ef45ab812304bdfa601a79e7ed94ab199", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846131, "uuid": "52089724-933a-40e3-8af3-2aa69b247d9b", "value": "T173E73372B18B8116EA7D4176A93AEE6F44BE7F73033140E73764BE0A09F98D061B6543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846131, "uuid": "d7c33695-a3ad-4965-8bf4-6fda3ddc3539", "value": "1572864:xOvXF+e76KJ9I4OzKvmTq4aMh6zGORvApErPLpcNRc3xBKDz5c:iP5J9I9GWhC7vApEXNCDz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846131, "uuid": "a12628c7-0196-4eec-a9bd-440283351827", "value": 67692544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846131, "uuid": "d37fd0fc-00a2-450a-8d12-b5b100357963", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846131, "uuid": "8016a56a-8d36-49d7-b994-4b87aebe146b", "value": "BOCTGZXINFFCD20242108.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ed35d3-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846114, "uuid": "7145af3d-9e19-405a-b82c-050777af7aa6", "comment": "Malware payload", "value": "f1a018744980794ca5a6e784a7f84dc3", "object_relation": "md5", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846114, "uuid": "48e1ba43-ba45-4721-98d5-123f41de9543", "comment": "Malware payload", "value": "0f035dced631ac58cfae510cfc61bb1dbef119331a8aea8d5c724a5ddca0f8c5", "object_relation": "sha256", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846114, "uuid": "29f749a5-89dc-4742-9449-85907cfd1e0c", "comment": "Malware payload", "value": "6b0f40aa6b542eb80a0dfaaa55c340671ccfe80c", "object_relation": "sha1", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846114, "uuid": "cdf158ab-ab41-4eea-b2e5-3746fd894e35", "comment": "Malware payload", "value": "9a1c78a632a9454e3535eca420135d0bf1f80b3612d8a364e60258bfc05d934aea061646d8b86c8ea269b25200e67469", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846114, "uuid": "65191368-4af9-4bf3-8225-3b6eeeb578ba", "value": "T150273313E4DCC7C49C510C868223E26BEFE5F9B558361A5E2345D207BBC4EB6B76AC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846114, "uuid": "89b79497-5a71-419b-b6a1-4cd92652ccc9", "value": "393216:Un36caiNdTBRGjx4DKi/vYYZ1QKgERuXSqPz6c/yradD3QO7RmZfBXfSs:UKcaudTBRGjx4mi/RgKPuXSUz6cKr0jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846114, "uuid": "6121d33b-ca65-48cd-b216-7ba58b8f8887", "value": 21325424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846114, "uuid": "dd7b480b-c3da-4392-97f5-663feabe50b2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846114, "uuid": "1a3ea33a-2604-446d-a4ea-3814e7ec9f95", "value": "bb1308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b9b4a4-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724840265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840265, "uuid": "d3d3a543-8ccd-4454-8615-47ecf3b84dc9", "comment": "Malware payload (SnakeKeylogger)", "value": "8cda3620a0aca60bf561ee745c1e95d8", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840265, "uuid": "b2a2053f-6aba-4db6-8c66-9c2166baedc0", "comment": "Malware payload (SnakeKeylogger)", "value": "0fec3c669c7e1f7c180883a01062dc51394a600cb9a087eed466297f3b22eb13", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840265, "uuid": "29358546-4d92-4f71-afb7-38f2a3825e43", "comment": "Malware payload (SnakeKeylogger)", "value": "d4e47b38ec2fc485a86aaef6abe063dbba4225ea", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840265, "uuid": "5aba0aaf-8eab-4f76-93a6-351f8a2c79a4", "comment": "Malware payload (SnakeKeylogger)", "value": "bb0374d2b15373b5759798df20def0e2c484a43d936893bda8fd4b350a72f64d44a2bd75700cc265d63a672e458f6b28", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840265, "uuid": "b5e3408e-4116-4490-abb9-42cf0095aca8", "value": "T187F423CC361350047618BDCF7E10C3E77C39EC99401E6FAEA6279A2CE5CA776D886964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840265, "uuid": "8fe9951e-f2ca-46d0-9464-7f26413031f0", "value": "12288:Lctx5RNQk3xY0DRoLgep6spqJRWqK6W//FlTWfMd3ClpAvw6y8bNlFDMy1hMKtae:4vNQkhWg42DKBHvT2AS8bXKMvMomOXL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840265, "uuid": "a6ed43b8-7974-4c7a-aa52-c1bde45e4441", "value": 769041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840265, "uuid": "5a55019c-84ac-484d-b404-3eaa901b4869", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840265, "uuid": "38e4fee5-55bc-4361-823d-160b9b8980f6", "value": "purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a226f0c-656b-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724869614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869614, "uuid": "ced97385-1580-496d-a8c1-de4974f5f661", "comment": "Malware payload", "value": "9f2d66b4a7a38f350b831a822cc3e7e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869614, "uuid": "b7a2d76f-95a8-4e5f-84cf-41d54b4d7cee", "comment": "Malware payload", "value": "102fc6e94e9f86e74cb9dd80873d22fec922528017840e069b32e4db1a9ea023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869614, "uuid": "154e76bf-2959-4769-970a-94b3e4c743b4", "comment": "Malware payload", "value": "ada402070a5931c4f0954a617e9b917164ea81e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869614, "uuid": "b25c591c-d567-4bf1-81f6-a7d831e17434", "comment": "Malware payload", "value": "6d31a7ac053ed6667006e57d85c9d12f57604d22b506b97262bd4de8aa8910913942c853bada7d92cad1ba025220540c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869614, "uuid": "f3843d29-6635-4d61-ae27-0a33ac1af9d4", "value": "T14C472311FBE1CC73C47A07389C2B9F885A25BF504D2859CB37F46E8C6E7BA41781A586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869614, "uuid": "ccdcf542-ff63-4c37-baf6-0a3eab5081d0", "value": "ed2123cc8ad9c0bbe8526983cb011271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869614, "uuid": "21e0f985-8ae6-478b-862b-b8d72827e68f", "value": "49152:pYBaFrZQYnMDWCdOnd/j1fdsyeNY+sYCh2Ud80J5r3EtaHTgAcHXdpiTDJuzgNmG:pkWQ7W1fIY+sYCh3djAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724869614, "uuid": "14a9a9a0-b74d-4c9f-a26e-664334179add", "value": 24651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724869614, "uuid": "8d5c842e-c468-4c0a-83c5-637e885bac2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869614, "uuid": "4d3eb743-b125-4d40-8f56-f16723ea1d8c", "value": "CONFIRMAR_COMPROBANTE_PAGO000332488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00d9569-6522-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724838593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838593, "uuid": "10500c44-4a34-4ddc-9a7a-51e224169231", "comment": "Malware payload", "value": "c3ac879f55d769f91be14ebfcf568f4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838593, "uuid": "eed6ad5a-d64f-49df-9d09-f64ecd8d8ed4", "comment": "Malware payload", "value": "10acf950ae7a3d5a17e14d54cf12ed0472f6ccee7444f86529429fcfdfd34a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838593, "uuid": "6e250eaa-79e2-4d6a-86f4-83c1f6dea996", "comment": "Malware payload", "value": "9232232646d0ed1b0c92034463e8835728735182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838593, "uuid": "8b858f8d-a269-4009-a0c1-56dd0e16a1b6", "comment": "Malware payload", "value": "aff515e77f1f693d501141bda2789f5382dcc64e3973e4645d149efd4c68bf78404c26d92993b1e0846a6048175a785e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838593, "uuid": "1a4f4a07-1a95-40c4-bdef-8ce31e36d9fb", "value": "T16D159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838593, "uuid": "98046039-60d0-421f-abc7-462af90b689a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838593, "uuid": "d41be9c7-c45c-4121-bb41-b25aa4ae8248", "value": "12288:2qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTi:2qDEvCTbMWu7rQYlBQcBiT6rprG8asi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724838593, "uuid": "c26ee1b9-d471-4684-9dd9-8dfc6df647b2", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724838593, "uuid": "08548eba-6a6d-4ab2-b837-a5eb790a3e87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838593, "uuid": "3c7c1cfb-0139-4af0-be02-856e7bfe97b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e749bb-6566-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724867762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867762, "uuid": "ca33e92a-9ec6-4846-bff3-86cd72bcad1a", "comment": "Malware payload", "value": "ce802815c2f64f40d8c06595cf070f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867762, "uuid": "f2e50575-55d4-4914-8804-e03450a4194b", "comment": "Malware payload", "value": "10e6bb31697447ec3737781cb640dd8d7768ef0b577bb8ee5256b5de69f6beb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867762, "uuid": "8c215fe6-b845-4cd7-ba62-04db6cea9bf4", "comment": "Malware payload", "value": "31f35aca648a1f671dd9e38eb4b55125e5a1ae5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867762, "uuid": "72509799-6b5b-46b9-a8c9-7152ffdd8757", "comment": "Malware payload", "value": "7e5581795de885a367130c04af4f390954898e380a737ee1c67f262aa8fe823d3707378b5151831cb48c901189bcd0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867762, "uuid": "929e20a0-b948-40a3-8f53-b752a3c0fd7e", "value": "T16FF63981FED744F5E9435471945B722F67359D058B28CB8BEB04BE2AE8372E22D33249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867762, "uuid": "80a1c401-8ce7-4036-9523-252c92628739", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867762, "uuid": "f2c8d895-0c22-40c0-bfa0-df4df06ece1e", "value": "98304:zUZfU7G0fmZ/5RxJVSBJBDuYm/0gDcKnR2cpbo/j3/SQU4Y2n75Q4Q5ZML6JXvTF:8s7X6T4e0wR2cpbo/jyTTdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724867762, "uuid": "d5829cc8-021c-40e2-806c-5074efbd5be5", "value": 15950336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724867762, "uuid": "74af96ca-14ca-44c6-98ce-f4ab9b849fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867762, "uuid": "9ab4d703-6648-41a9-8c0a-882830eb8174", "value": "Setup-Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee0da10-6589-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724882588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882588, "uuid": "d3889142-9dbf-4ced-98fe-bd4c4c3daeae", "comment": "Malware payload", "value": "3a81013ee762a47909c88c078cc1747c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882588, "uuid": "a38167e7-8370-4361-b503-995f9ab44160", "comment": "Malware payload", "value": "1117f2da6a91b0bb38e5f49a57ba7ccb65fe78a148eb4375e769ac8b0e9cfb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882588, "uuid": "06669d1f-e4e9-4c35-9dba-86595330dd8b", "comment": "Malware payload", "value": "98bf17645cd1437ed226bb95f6f450d1cf6b187a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882588, "uuid": "b24df0c6-7bfc-4637-9976-ded1d552f496", "comment": "Malware payload", "value": "0412f33188ae3a67076114f2413a94b81aff5a895efdc69cbeb5e0cb811017ea0f651122faa7bc5889500f60083fbd9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882588, "uuid": "e6854386-ca37-4686-83ce-42b3fe58b6db", "value": "T1B0D633927E5BC8B4D2FB29328A1BD4450D2D392E56E5B8616EB2D74E2DB03C30C731D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882588, "uuid": "3febaf51-d28b-4f72-b3ac-220dd9ba07e7", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882588, "uuid": "499055d5-e837-406b-9058-edca84f7c668", "value": "196608:0RHBn8eeiMuXTCgfGMHc+I9Op1ZgOb86tVHilRotX5Tme81WSYq:0D8eeBuJ58KT9iH+5aebq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724882588, "uuid": "a5f2c715-6868-47eb-86d5-265f2f7fc7ce", "value": 13234736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724882588, "uuid": "da745427-7103-4276-a235-2800091eefe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882588, "uuid": "d3f149cd-b819-4324-b3b4-7ed2ee7794ea", "value": "iboysoftdatarecovery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10c729c-6565-11ef-b7c0-42010a9c0002", "comment": "Malware payload (CryptBot)", "timestamp": 1724867398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867398, "uuid": "4b1f3169-9422-4ac8-8011-f1049e9ceccc", "comment": "Malware payload (CryptBot)", "value": "7daccabacd62ea51195377e589a193fc", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867398, "uuid": "b90a3863-18b6-4c3e-bbec-6c1ce84c1367", "comment": "Malware payload (CryptBot)", "value": "116c6039367730485a703b6dd6198eb7754ae030f6e9e3aa7b38c68d8d083dc1", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867398, "uuid": "33a70ba1-1ad0-4e6f-b2e3-9e07e555df8c", "comment": "Malware payload (CryptBot)", "value": "f709e92edb133cc7320fe48f7e75fa21f1d8eba9", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867398, "uuid": "9522aa11-9332-4a48-9db3-cf2cc4500be5", "comment": "Malware payload (CryptBot)", "value": "cc023c1a4f12d4213aed71101561b78efdb2fa66e438c1cca81d795a0b561a6299239be88672afe805f884d372cecb99", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867398, "uuid": "25bedd62-b1ec-4f23-bd66-95677cefe55b", "value": "T18B66287A9B4341C8C13FA57ADD827F3FF4286AD843A9492BAC0508FCA755751E8AD313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867398, "uuid": "21fd6169-f815-4276-bc9c-f0b3a9b6c0b4", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867398, "uuid": "cef8c706-672c-44c7-a3e6-5a24af213295", "value": "98304:9xm7bcHmAYInPs9UTu4Ls7hAKZ0LFTY9Sz1jvQ:9xm7gHm0nPGynIoFTl1jvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724867398, "uuid": "21f6d400-bf51-4b89-8388-51cbfc141bed", "value": 6640589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724867398, "uuid": "d6d41e74-dad5-4fac-8175-bf06ef5678dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867398, "uuid": "646b3eb6-1605-464c-a4d4-00f49fb4dea3", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaf5597-653d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724850241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850241, "uuid": "2d9d88c2-8cad-4fe4-b73a-e48d76f78a62", "comment": "Malware payload", "value": "e088fdc0719165d03810729cd332827f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850241, "uuid": "4d60e06b-9339-4eb6-a2d7-d30a115a068e", "comment": "Malware payload", "value": "1195e23ce52a59091283a3a60ed2ac705335c0d7553aa95be4be357e2b3561d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850241, "uuid": "68bb7100-0a8c-4833-8b0d-79b3f5062612", "comment": "Malware payload", "value": "2a018e2ad96e3509f864d5c70dc4fa2ee17103c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850241, "uuid": "d9f85ba8-3c99-4cc1-b1a0-021a690e6d85", "comment": "Malware payload", "value": "562cab51452dc4d81e36c1ccc04e0893cd4ab330fb60c6c10e8071543961c3e541d2c2bf8958f3d9b9c21b9a0854a88b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850241, "uuid": "ef1286a5-d83e-438a-a6d3-464546316de4", "value": "T1C845C00273D1C062FF9B92734B5AF61157BC6A260123E61F13A81DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850241, "uuid": "cc7717fe-5786-44aa-a09c-e91f03c3598c", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850241, "uuid": "06533b8f-07cf-4cdd-a91a-2f6b693ed6d1", "value": "24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aIeaopOy69HzmzPJ1RC56Qc:ETvC/MTQYxsWR7aIkL69SPJi6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850241, "uuid": "a58e3ba6-29b0-4e0f-8813-c6cc6f846180", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850241, "uuid": "ffd65923-8fb4-4089-8c69-7674685a2995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850241, "uuid": "93fb10cc-8661-4170-ae31-0ce511d72670", "value": "factura-630.900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a54d450-653f-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724850931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850931, "uuid": "8d20f59b-35b1-419b-b13a-4f5e3f0e9b29", "comment": "Malware payload (Formbook)", "value": "5764ae8e7ba21fca98d1e235bba3dfd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850931, "uuid": "3b193bd7-9d44-48cc-8274-74e6a56cce06", "comment": "Malware payload (Formbook)", "value": "11ad332c8b6abba185078feff927b537737823276ab2cf85ba2a54aa30a821b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850931, "uuid": "56251c63-1f49-4f7e-94ca-f1d26bd79894", "comment": "Malware payload (Formbook)", "value": "bcf89d0b899a496fa2a8c770b5c52a0dfe2cbe10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850931, "uuid": "80a0b9b3-e400-41e3-b122-be85e55c13a6", "comment": "Malware payload (Formbook)", "value": "3310dc24bdb5ea9a1013750a29d4322f6e7a3382b9cb7818c941247dd82db919434a2afb6d5f77adf9fdbcf68ccb3f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850931, "uuid": "337df23c-fd22-4906-afac-81ef49085d51", "value": "T1A8E4CF41AA25DDB0D41A86B7F6434C368F2BFDADC93610AF53D9B30E99F3622045BC52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850931, "uuid": "73bec9ae-6928-4159-a5a0-e89569097bed", "value": "17b7d61bda0f7478e36d9ce3d4170680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850931, "uuid": "241f2327-9268-4b48-9e0f-17c6d1187dab", "value": "12288:tiu5LgA08Jh7fpCwTnh63YTqWLTMO1Sk3nIc6s5A/zcj:X5L48JtgOY3Yeehd3IA5sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850931, "uuid": "32149e81-3bfa-4ef6-9d17-3a3a79765a1d", "value": 669928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850931, "uuid": "e41d8c99-a7ed-4ad7-b11f-71b950108827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850931, "uuid": "ffaba920-703b-4f12-9e27-d49ec022637f", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dcf53c-653d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724850122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850122, "uuid": "019bb907-836b-4648-8f07-941a0dc85109", "comment": "Malware payload", "value": "404b3e8655b581497ea6d1f394a5d27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850122, "uuid": "4102f324-d81b-477a-a20e-564bbe929108", "comment": "Malware payload", "value": "11ff90a33d73be660d1408cf99f48baa9dbaf0d15572848a7a024aab03973476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850122, "uuid": "2a339e6e-8d36-47bc-9728-336053a47d31", "comment": "Malware payload", "value": "8c706938bc43dd1c4678c4879f4dc51dad9e6431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850122, "uuid": "5e0b5059-85b4-4b41-aa93-da94bf0747cc", "comment": "Malware payload", "value": "0d741c1d5cae62c5ae394fb57b02a1f7930ba1443d74761ff6ec47dab139389412415e0cdb04304e343df106828aca68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850122, "uuid": "27a94461-4d68-4d3a-91e6-380f4054a202", "value": "T1EED42D02AF5585B0D686BF75D78A6338E767DDA173429F462C89339718B33E1BE03206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850122, "uuid": "8488058a-d1f9-43ac-a6ea-a738f41fbc31", "value": "6144:aEpn+8kGzHlXoB9z2VloojvZNjuorHIpDFlSEf4H444l:9hHlXoBMVl8FR4H444l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850122, "uuid": "03dc223b-cc32-4d43-91f0-c294853deab6", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850122, "uuid": "91c944c2-256c-4ed2-aeca-975ca83a3040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850122, "uuid": "14bc4ba0-1b31-41d1-9fad-0b05de9902e2", "value": "1C24TDH_00017388.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2d25e7-6566-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AgentTesla)", "timestamp": 1724867789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867789, "uuid": "a46e0215-df71-4b96-883b-1859c450817d", "comment": "Malware payload (AgentTesla)", "value": "180ad8fe3294d5cbf1508f3576c70f1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867789, "uuid": "2031e758-3330-4306-bf05-382954190528", "comment": "Malware payload (AgentTesla)", "value": "13ca93f984b156e05041ddb9d172ddfd9b14456a243e432b1efbbe5f623b722e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867789, "uuid": "6ea0bc64-a060-470b-ad08-8978a4ff2189", "comment": "Malware payload (AgentTesla)", "value": "831c8ef7b3efedae003526a87139e806c713ed24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867789, "uuid": "1006daf4-698c-44d5-95fe-ee1cd3a8e364", "comment": "Malware payload (AgentTesla)", "value": "19283748367c9d33de05e122ee9d93b8bb00895fc3982e3b3ba3970759783b6b310cc6ebbbcaddf562500e7b4f7ed16d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867789, "uuid": "d61f40bb-e89a-4e76-8101-0ca2b37c9a52", "value": "T116754BD98E917626C11BF2384F67871E576C5D73F6029A8A09839883FE3D30EDC185E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867789, "uuid": "2070d8ee-64f3-4aea-ae95-cb7dd90d42de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867789, "uuid": "47f2dba6-cbeb-44ab-9702-7753082a9605", "value": "24576:qIgqdRkAM4OF+PMwrSVlbmfDYkhDvGtjXtGUAF9kJ7MqudghfEuCj0hThiHHxlhg:qIeMw6kbQlYSRUT7ofIlohsgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724867789, "uuid": "6c73bce3-5403-4f22-82ef-c200f867cd29", "value": 1551360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724867789, "uuid": "5bac08e7-4409-4651-838c-2e5e43f0f3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867789, "uuid": "2f170785-34cc-43c0-bcac-0d51b5cc2e60", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05e5951-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822595, "uuid": "032ea3f7-1b90-4675-b6f3-63cc8789d74a", "comment": "Malware payload (Mirai)", "value": "749715f06fcf51d9a73feab4ea343d56", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822595, "uuid": "6db3d8b2-554c-4cd2-be88-84643dde88e1", "comment": "Malware payload (Mirai)", "value": "14a2010dafa415a39cfdc2f927dedecf53928c239c15145423108431714b13ae", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822595, "uuid": "b76b353b-8a6e-420e-baa4-c083ea199dc9", "comment": "Malware payload (Mirai)", "value": "40d670c797cc19b1bbcf7920c1d8d4beced31866", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822595, "uuid": "0b4ddd3f-7edb-472e-a52d-8e3e02c2ec8b", "comment": "Malware payload (Mirai)", "value": "a274007f3dafb0222de3e141fd780f5703c56972c06bd19479bce71724a3e0ae617df510ce45e7e31d8ddab0ae02d871", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822595, "uuid": "5252f2f8-26b0-486d-ba96-cb38b5d7271e", "value": "T129936D8AFAE3E276D44605B81057E7775731EE7201A4CA03E3987E769D238D14A8D34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822595, "uuid": "c8e825bb-91f3-4f4c-97a0-7f491080ff11", "value": "1536:Ui5tSIROkRlecw0E5VmVRcloaxMaO+QQCmbzYtZbZ4Cdfbnk5oSYypj:NTOkRIX7mbcloa1O+3ktZbOokGypj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822595, "uuid": "01a1b72e-9d81-4fed-a708-5fef41016411", "value": 92532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822595, "uuid": "eec0df5a-2ef5-4495-8762-f1fa3ae85b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822595, "uuid": "932f1b62-3116-4dd1-80e3-209d0da751de", "value": "criptonize.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4196e326-6510-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724830596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830596, "uuid": "76d35e96-4d40-4f00-a1db-fd010bc71df4", "comment": "Malware payload (Formbook)", "value": "a69a87131aaf51359513abddbd75d131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830596, "uuid": "50dca4f6-6b5e-4888-8920-ddfef7a40354", "comment": "Malware payload (Formbook)", "value": "14eff9206677e4d8b2ff0ba356e046aeabbccef08086ac1f1d0686be85dc0689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830596, "uuid": "035e8817-b381-4bf9-ac74-3f65400abe75", "comment": "Malware payload (Formbook)", "value": "e306afee20e6e1b3c8a5499240b46fe927ebd85a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830596, "uuid": "88edbec7-6585-4f88-a1fa-f1bb16876167", "comment": "Malware payload (Formbook)", "value": "7370511f8f582cea190661d6f1d438fa26aa33d5b628fd8c526824ee62a6380e094538baf9a00c38e70ddb9a1c0bf8f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830596, "uuid": "53758f38-16c3-473b-badd-69dd1ac0eaf0", "value": "T10045C00273C1C062FFAB92334B5AF6515ABC69260123E61F13981D7AFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830596, "uuid": "15547cda-2ce2-4a20-bac1-3acfeb774315", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830596, "uuid": "ea1f6fd3-1407-4b7e-809e-f62493bff7c7", "value": "24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8aKrH3X5n6X:fTvC/MTQYxsWR7aKrH3X5n6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830596, "uuid": "45d125c5-d1d6-44a3-ad43-58e018f253e8", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830596, "uuid": "89c434eb-aa8f-4cb9-a5c2-6e33b90a7784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830596, "uuid": "97562df9-0e79-465f-9183-37b758063274", "value": "PO#8631286Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2f5c29-6553-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724859660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859660, "uuid": "a08898b5-d6c5-4444-b299-c402512265d5", "comment": "Malware payload", "value": "be8bf725892ddd7a200d0a1906b9387f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859660, "uuid": "0e29eaeb-be5d-4682-be0a-30caca5a8817", "comment": "Malware payload", "value": "166bba02413995aff28ffeb27d3bf3d5a5f6a6cd36893e252c7b9a22836f4980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859660, "uuid": "6ec686f4-9c88-4c59-ba23-f7147280731f", "comment": "Malware payload", "value": "582a24a72b29e70f2de26a8d217492c7a6b983ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859660, "uuid": "62a70720-ef41-470e-9e8f-88b8cdf37103", "comment": "Malware payload", "value": "72a147887dc2d18f63b9dfbbd3a08b5e2933bf705f445509f1bf8960c81d1f4228c5dfacbd7ba285e76fa5dd0afa7041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859660, "uuid": "449a4719-79bb-49d7-ad66-a10a9e7cd8f6", "value": "T1B3368D4369DB0DEADDD66BB461C36339A734FD31CE691F2BAA08C13169536C4AD1EB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859660, "uuid": "9ef2a226-d6c9-4184-97a3-932280540d33", "value": "a4d9bc817c853ddee0fd95530455e74f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859660, "uuid": "0f8d4f48-96c9-45ea-902f-faf5dfe9617c", "value": "98304:MjHm6/Pi0bzB+Ot7nM3wnuZFm0qRttZYtToFbSO7VKoFbSO7VyoFbSO7VKoFbSO5:O5unMkMsMkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724859660, "uuid": "1c16fbe3-a9b4-4b51-b50b-a58737c9b0e3", "value": 5333010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724859660, "uuid": "4a3a7035-ebc9-4562-bf6f-b6fed766129b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859660, "uuid": "af8f3815-b9d9-4366-b819-f18afc7e20af", "value": "WebAdvisorInstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db783b3-6554-11ef-b7c0-42010a9c0002", "comment": "Malware payload (MarsStealer)", "timestamp": 1724859795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859795, "uuid": "76404357-46a0-49f8-9565-b7e660bc7516", "comment": "Malware payload (MarsStealer)", "value": "0a41457aac1ca18038efb5ecaac7fa72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859795, "uuid": "f58cdd01-3a1f-43e7-99d3-c518091962f6", "comment": "Malware payload (MarsStealer)", "value": "179074a05a2323f1f828be2e5fffd58cdc7ab36303db559795c7a3fe0fbd434a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859795, "uuid": "02bca520-5310-4ee7-8374-7187ef8e9334", "comment": "Malware payload (MarsStealer)", "value": "5d49da940af997ef6d29241bd9458dd7f18212f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859795, "uuid": "71fa9737-6247-4172-a919-41833b144c22", "comment": "Malware payload (MarsStealer)", "value": "2c1a6ba7015168fa7dc7662d82c0b32409082d6a9bd8b1014e97986b4325b02b00fc31b79389ab7acd41f555f6c186e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859795, "uuid": "4b2ce7d3-cd60-48ee-8cf1-b570bebf0723", "value": "T1948533DD5DFAC119E80F553B61CCB743B088F1E1D29989C32A30E94EC243A9DFAB0659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859795, "uuid": "880e6e35-9f86-43aa-8f7f-8281f75ec3e4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859795, "uuid": "503bb360-8223-4adc-94c4-22002bb915c3", "value": "49152:HBiKCVoS0r+CvxJe9irj+MtDgXTFtHatSF:wfor3vxJeYBlgXWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724859795, "uuid": "df71c2c1-f0ee-4962-98a9-bdc85eb24a9c", "value": 1793024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724859795, "uuid": "d9cacc50-4696-4a20-b2b7-efd7e4e8d7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859795, "uuid": "a3a7184b-482a-4594-9638-7d3fab519c03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5733c66-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827355, "uuid": "5fe08a83-1727-4da0-8151-fd1f57267095", "comment": "Malware payload", "value": "66c045ed7b5d3f41a2d4a61ecd40b7f5", "object_relation": "md5", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827355, "uuid": "9eb32544-c82c-4dfa-a6d4-c635f94e7154", "comment": "Malware payload", "value": "192f86bf3312e9d3384b0fe4c3729a0daf99f6291d33d246264cfc8c1bf20551", "object_relation": "sha256", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827355, "uuid": "ac8fea5d-0ff2-4ad2-920e-c6a5caf8a038", "comment": "Malware payload", "value": "c2a186a9a57a9df948320cf8ceebbbaae8ed9ceb", "object_relation": "sha1", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827355, "uuid": "aa7aca86-d568-4d8c-9976-eb3ffb4a654f", "comment": "Malware payload", "value": "2d77a8f6955f7b0288cbfc1ae13185970ca71c2caeb2a11ac80b43aca9fd5b6c4217e3b7e7488e736e9e47b2fd407d29", "object_relation": "sha3-384", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827355, "uuid": "4894adca-4f9c-4302-bc1b-2afb098629d1", "value": "T17365594BBCD148B6D0AAD2328A6666917A31FC090F3223D73E90B77C2F767E09975744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827355, "uuid": "b395bdb5-b157-4cca-a764-b357a002daeb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827355, "uuid": "35e7df5c-c90e-4b9e-89c3-a503bd35bc4d", "value": "24576:j6txJC+hUr61SZfyviyhUhdGfNbwY0Nl2:j6A+ur+SZ6RwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827355, "uuid": "34ae9206-7c78-494f-bdb1-5a795164ad46", "value": 1520640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827355, "uuid": "a0aba377-7201-4023-a1a1-c57464042704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827355, "uuid": "1e7513f8-aec8-422f-b72f-0a1eff375134", "value": "192f86bf3312e9d3384b0fe4c3729a0daf99f6291d33d246264cfc8c1bf20551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3fa8a3-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863771, "uuid": "58b7ace6-4106-497e-83e4-37858c6e7d5b", "comment": "Malware payload", "value": "dc12b6f6672fb5207663bdc61e10f8aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863771, "uuid": "f80aa6c5-7f43-48e6-98d4-6f73dd008cd0", "comment": "Malware payload", "value": "1ab5b718a73e9f1b5025ab9b1ce5cee5bb3d5773777f3cf65ba0ef824cfe0925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863771, "uuid": "4b5e0ce2-9cb7-481e-a5f4-625aea1fbba1", "comment": "Malware payload", "value": "d5c078b706871bc9ad4a7fbb1557ada47c818b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863771, "uuid": "7e2b1d0d-9b70-4d1e-b5c1-2480f750797a", "comment": "Malware payload", "value": "1b2e5fc0bde2ae05e6a7e561f10dfcc680e64127f1956a1322e75fb8acb2c0363a046f642054cb1b8836f3e509e48840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863771, "uuid": "04963e58-3d91-43b1-83e3-70c2ac7216b8", "value": "T169159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863771, "uuid": "ff359116-ea17-4bc2-a9e7-1e3f412ba27b", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863771, "uuid": "03848c1d-7a35-4459-bfa8-0d28605ff14c", "value": "12288:iqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTO:iqDEvCTbMWu7rQYlBQcBiT6rprG8asO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863771, "uuid": "fb2684d9-52fb-4a2f-bc57-4bb0699719e8", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863771, "uuid": "174da92c-409b-4fe6-8a5e-af5d4bde3686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863771, "uuid": "1778dffa-f876-4de3-9d2f-07c6034c9a39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e03c6b2-64f3-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724818215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818215, "uuid": "71dcc36f-1a60-403b-805f-5a695180a6c1", "comment": "Malware payload (DCRat)", "value": "8896359aaa3ad04316e8b1f514163d7e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818215, "uuid": "258b5fd9-6501-4e1c-9af1-53ebb56fadfc", "comment": "Malware payload (DCRat)", "value": "1c32f798e64f7a3704a7fc45dd0ec264a82d0772c14f05bdf16ee1f8359bbf2d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818215, "uuid": "df83cf20-79a9-4086-968a-29c9eecb436e", "comment": "Malware payload (DCRat)", "value": "3bb48e99be1ab48c10ffa97b509ad16617ad1a3f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818215, "uuid": "1c985996-03ce-4f63-8419-a0094e3beb44", "comment": "Malware payload (DCRat)", "value": "783b8b126ac49e040a915208960e0b08ff81d8585a3fd8efd2db235f1ef94ada49bfe2ae6bd5bd19a8609d6fb2c29e8c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818215, "uuid": "38d83e2d-ba11-454e-930e-809667ecbaa1", "value": "T10695AE0675828E33C27157324677033E52A1FB763A12EB4F361F2596A9077F18B762A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818215, "uuid": "d8ff14c3-618a-4aab-a94b-9dacfe8ceb5e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818215, "uuid": "8cfb2741-a928-4348-a80d-854ba71c964d", "value": "49152:IBJxxEYaBuqzBCf9sIjxednUu795zPZbR:ybYuqzs1y1RxZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818215, "uuid": "9da33dba-f6b7-4f2e-8175-609be36d30ba", "value": 1965213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818215, "uuid": "f25c4007-9d46-4054-bfb2-07340e94f31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818215, "uuid": "ee5fe9ec-f0b5-47c2-be8c-daae627c2bc9", "value": "8896359AAA3AD04316E8B1F514163D7E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4c174b-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822480, "uuid": "a71798b8-e5bd-4251-b2aa-1674ead5d566", "comment": "Malware payload (Mirai)", "value": "922797db0e0e3ef07b7d56948c7c9df9", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822480, "uuid": "f998e257-e0fd-455a-a910-e670270d4374", "comment": "Malware payload (Mirai)", "value": "1cd93e1c674d08f1f28eab3b06a564674f60712c264ba60e8b7e2da8e2ec9d41", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822480, "uuid": "89aa82c4-7648-461f-ac7f-ff4edfc5d4c7", "comment": "Malware payload (Mirai)", "value": "19abfa4c86ae3544960c0e0e649971a3f6849455", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822480, "uuid": "a29db270-44bf-4662-98dd-5d94f6ccc696", "comment": "Malware payload (Mirai)", "value": "92019bae8b385544aad95c60827072db1363c39f3e4852e7df49afe9f4428f1d7ef9433583fa96d99e33465976969dec", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822480, "uuid": "e8ec2f01-191a-4231-bdfd-073f68ba9b86", "value": "T100D3AEABB20F1461C82507F51BCF9B6D2A2325018D6B92E77D5E373F2A335EA58053D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822480, "uuid": "145ffe5f-dd91-4f6a-861a-6dddb232f537", "value": "3072:2kEOX/ohDPd99g38xOMdIOtdqTaQCwhgBCUuqYYFHNq:bCdDgMxO0v0/X+CUvYgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822480, "uuid": "afbf0572-4345-4cdf-b5f1-2365526b21e9", "value": 132584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822480, "uuid": "f1ece9f4-27f5-4ca7-aa90-d39754d99f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822480, "uuid": "1d74b89a-c29d-416b-b58e-25ba610dd5d8", "value": "criptonize.arc700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca464fd8-653d-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724850153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850153, "uuid": "4c2abf49-7e80-4516-9f6a-10317cf93298", "comment": "Malware payload (Formbook)", "value": "46ab1444669b4733a0b37a61cc5818eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850153, "uuid": "9443f5dc-bde3-40f9-abc8-6867fce43b09", "comment": "Malware payload (Formbook)", "value": "1e4f0539e9cd2876c22d4d6353cbf6e772a4e0c19e74c8f5ee3684c2e11187c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850153, "uuid": "c24eec24-c60f-4f87-a8c2-e7ffc155d175", "comment": "Malware payload (Formbook)", "value": "5a30e457e3193149575e17188c771747c5d8a032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850153, "uuid": "3bb585cd-1ff8-47cd-9c32-df6aae804ff8", "comment": "Malware payload (Formbook)", "value": "27e518f3560bd2f81b7c3d246947d86792322efde0f794a0ea23c84123ad8949781b113eaab11fe3cce405cf2be33140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850153, "uuid": "a0ea4fd0-2dd8-4276-814c-52b152c06c80", "value": "T19F0523456AE37F22CEFD8BB1852228681370D455B243D37B3ECB74C26E1A7944A85F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850153, "uuid": "a347b23c-6775-4542-970b-cfd95ad1da3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850153, "uuid": "8beea32f-94cd-4625-bb6b-83d76609a428", "value": "12288:c4g5NWSSSdac1KzSjsD/JmAeShRe49RffMcmUUcNkbWjsjatlqUP:nSTkcGSY/Jmchk0RffkLcibWAj5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850153, "uuid": "8fd09dd5-b746-4b76-9d8c-22a193905852", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850153, "uuid": "9e6779a2-fead-45e5-985b-6d8fb4a78253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850153, "uuid": "501c7b77-036b-4423-8fc1-bfe3e332d609", "value": "Quotation-280824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b15786b-6564-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724866582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866582, "uuid": "75e5857f-01b1-4d15-8f3d-bb1e79e4c204", "comment": "Malware payload", "value": "62abfe8a7ad3a99ea4d57734689952ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866582, "uuid": "41d03374-3d5b-4b99-8a93-1c4be6f071fa", "comment": "Malware payload", "value": "1fd8bac5cc2b9aecafc8b0911842c86f0e5e16d58c82a93d717d2527d730ae54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866582, "uuid": "e98f8226-3fd3-43ea-b8a6-303d6a4d97a7", "comment": "Malware payload", "value": "4be1f30fd67930a52139df6716871a243dc68d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866582, "uuid": "fbe5c88c-dd9d-422b-aa30-26984ae082aa", "comment": "Malware payload", "value": "76ca56d9627076c76bc3607d39061f67047593fffc286361f2c9ad6197ce96da1f6aea27aa07b955bd5d4efbcd2be845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866582, "uuid": "9b857f39-5dd6-4ee4-953b-6c427f80163e", "value": "T160B4238693D100FDD93B323E2B16E418A3E187BFAB45CFD80147F29697B1A3489161B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866582, "uuid": "099ba5fb-4176-4399-8509-b393777d4384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866582, "uuid": "f7fd5a42-50f4-4c73-9583-2b1ba8597239", "value": "12288:wERhUu/QBnVPGc3xxQTfo1am2b1rslMrzi74Bm/H:tIuqVPGSxQD2aTb1lXg3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724866582, "uuid": "f3eaa66c-a00e-4db6-a497-6f7d41bb90a2", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724866582, "uuid": "54d16776-b6f8-4ef9-8e8e-456888d96c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866582, "uuid": "e2107b7a-3319-49f3-a9d7-750eabb80f17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fab5a0d-6501-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AgentTesla)", "timestamp": 1724824097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824097, "uuid": "5f8de0cb-dc70-4877-83b6-3c09852830d3", "comment": "Malware payload (AgentTesla)", "value": "3175bf6ab217796bdeec52d062ef9771", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824097, "uuid": "375ef668-707a-4eec-9325-63fa582cfc0e", "comment": "Malware payload (AgentTesla)", "value": "20aa510e22a6e0abf81a9cdb4491977cc7035ef0f62bf4e97e880688594707a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824097, "uuid": "7c5618f5-b5e2-406d-b1a9-6cfa8eed4ff8", "comment": "Malware payload (AgentTesla)", "value": "675b2037802f9a65f67429369a41118aa726675f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824097, "uuid": "ca566455-07bf-49a3-a950-054242be7b10", "comment": "Malware payload (AgentTesla)", "value": "9cb79546c0b926a3689d560b34aebed1534c229cf140e7b2c25a7f97332384ab5041a25684c7ccef896ebcb1928ed995", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824097, "uuid": "604149bd-f7c2-4b7b-8dd3-83c2389d164c", "value": "T1F6E4235A56988651F66B4AF786F9A1C342FB5B11B153E6EBD38005870BE0FC2D860F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824097, "uuid": "7873b84e-6731-496f-ac8a-7661f816b6e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824097, "uuid": "d76d1110-1160-4e67-8a52-bc9e1a74a62b", "value": "12288:MHVVjpsCzuvIkiDq9ydAOpRD9PyqrmiKaNGy9gbm1eb7+XxN:gVjpsHim9ydjgqrmHat9+z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724824097, "uuid": "fb08f9b9-4194-4b35-bb03-d3cdd8c83af2", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724824097, "uuid": "a6412330-ae58-47ec-b485-f801adabe098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824097, "uuid": "c2713096-54b2-4501-8501-ccaf86ded0c4", "value": "UNITY SAKURA - VESSEL'S_PARTICULARS.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb15412-6599-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724889593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724889593, "uuid": "e7dc494c-6d02-4fc3-a877-862a8f8018c2", "comment": "Malware payload", "value": "6daeccad61a0c7a6343226aebc2f5991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724889593, "uuid": "eab0f8fa-2680-4757-867a-c701493aa498", "comment": "Malware payload", "value": "20feef1cd2f7bc7afa599f5e3305fc5cebe04110b5dc6e99c1844efb7b31aeee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724889593, "uuid": "8375e5eb-0e87-461d-a5c1-4f2bc51c0766", "comment": "Malware payload", "value": "789d113f7c6abc47d436f9e080635bbc8ea39c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724889593, "uuid": "620a3590-071b-4c55-9a8d-98a73420f100", "comment": "Malware payload", "value": "bcf1fae9311d992551fee3dc92d496b7c6b77cbab687e3c92824dd58cd1f0aa9338f06ef39712a190226f10315127216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724889593, "uuid": "85b4874a-5863-42bb-9871-27b26ddffb5d", "value": "T10C8533B9BE5BB09FE61CF9BBE405F7709C708BAA1B039FB52556297041CF042C166B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724889593, "uuid": "6a2e3c1b-4bd3-4f46-abb5-3d3c1081a55f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724889593, "uuid": "417b500a-3e72-4e5a-a684-df5fd6df3216", "value": "49152:V2HXuP5NQgPVyD7dst2nigvqAbcMYUTIPkID:V2H+EgPoDhPnFi8L4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724889593, "uuid": "89ba4ab5-a433-4a21-ab0f-6f71a170dd83", "value": 1757184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724889593, "uuid": "4dd156bd-8f4b-407d-b5ec-44caacbe3e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724889593, "uuid": "2e23feb2-8e40-4831-9392-be966771b563", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2ba8dc-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822618, "uuid": "aed1c471-e206-4f03-a667-528c236c24f2", "comment": "Malware payload (Mirai)", "value": "30117e034a0f3641a995c88c095f879e", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822618, "uuid": "bc21013c-ff1f-48b2-85d1-07ad001a16a9", "comment": "Malware payload (Mirai)", "value": "21db6b629f500d3a82ed04ca13cedb40ea8f5046e0ce738f059e354ffe8e71eb", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822618, "uuid": "fbf1627e-ca8b-4200-a639-ac835f34a9ed", "comment": "Malware payload (Mirai)", "value": "b0753f4478f94494ca91dd902a556e99916cfd47", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822618, "uuid": "85862986-873d-40ff-83cd-526b0011bde0", "comment": "Malware payload (Mirai)", "value": "995fc654bd19536f0cd0a0eb0a3c53d11392dfd01a6314716c5eb7d509b41e669b15d8a411631cf77c81e0b8891045b6", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822618, "uuid": "97f0245d-279a-4483-a395-583e65d497f0", "value": "T1B8E33907F9D441BDC4C9C1B54BAFA227A777F07E0235B61B1785EA222E09E20DF5E681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822618, "uuid": "07efec80-219c-4d95-b361-32fd72d15e4b", "value": "3072:q/qSdlq1N064i0Hj0k7fRVfgXSZNiLtZhzowDD6HuLhjTe:JSjTR8yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822618, "uuid": "d6363644-d464-4c39-a15c-0ed582310f4f", "value": 156608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822618, "uuid": "bdc6d349-6e2c-42a4-bdab-1a6e0f70a038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822618, "uuid": "dc55c719-4be8-471c-9db1-355cd7e28dee", "value": "criptonize.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49a6a59-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846331, "uuid": "f4c626ab-77f0-4e1a-80d0-b356003ea4f1", "comment": "Malware payload", "value": "f86a185db8b9a383245e2639a234e7aa", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846331, "uuid": "546f3607-fb9b-430d-b1c2-c2486e26c756", "comment": "Malware payload", "value": "227c0d045a590bfd1e70044c6d01a62cae7c9b0a90b1c4165be4c987aa635a74", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846331, "uuid": "692eb54f-8385-4a2d-a3ae-f77725bacf9f", "comment": "Malware payload", "value": "12cd9aed8efe4708fcb05df2537cae919c0a7342", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846331, "uuid": "81a055ee-e2b3-4f2b-a33d-63e6d8e1e4b6", "comment": "Malware payload", "value": "d1eb4f68d1dbb2855ff37d337395ae4862e10b5748ad91e77a42869a9c49dbf997b6dd2f7447630a14cb3e8da8e6fec3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846331, "uuid": "a3b5391c-692c-469c-ae2f-9f3121279625", "value": "T191C4235473E8CF07F487AD7098CCA2CF266DFC056FA6C7677154B389E434E825A82629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846331, "uuid": "22305ece-ac2f-465b-9a95-3442cabd3b70", "value": "12288:U+vQGJ95vnS07h1m0P2ringUiv6BVZhi+m+p5RdzVPVIWFCoD3xRBIW7Y:UMB3h40PhgUNZhiT+DRpVPbFbDBRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846331, "uuid": "6a19c3ed-d900-461e-9791-79d38e058f25", "value": 568342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846331, "uuid": "338666c6-9403-4ad8-af8c-b7b425dfebe4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846331, "uuid": "1e6da6c3-670e-4f85-abfa-f29e8f8fc257", "value": "August Shipment - Inv No. 041.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ab74b9-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724840082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840082, "uuid": "09b7c9f6-b58e-4625-80cf-5d1efe53b8e0", "comment": "Malware payload", "value": "b8912ea5639dbfeca6e495e5686f5344", "object_relation": "md5", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840082, "uuid": "b47a0041-7346-41dd-8e5f-2feec2e37c8e", "comment": "Malware payload", "value": "22e3fd58885a4fdeacad8598b65747135dbe2466a2cbe4afb9b37c272f2a3112", "object_relation": "sha256", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840082, "uuid": "3034d7c1-181b-4745-a057-abc5a9d1a512", "comment": "Malware payload", "value": "d9bf0396630631c7047fe584a2878b988dc7dc13", "object_relation": "sha1", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840082, "uuid": "a9c86292-bffc-488e-8714-c82b7168b2fd", "comment": "Malware payload", "value": "18c104d932b8422024c251155f87d683defd7a92ef46e07f12d7bf889b5d90b7ee635365eb713fc5c62aff7941bede8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840082, "uuid": "365241d4-39da-4b55-bf48-3a35c48ea561", "value": "T1F3A733627F80D228F9EB0E3231F2C7550E716D69A56DC82ADBD0BB18B9F31756471E10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840082, "uuid": "e7da4834-aa91-463e-b58c-4afc4682dc67", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840082, "uuid": "7c1ba3d3-af0a-488a-a590-a57d7dd02d9a", "value": "786432:oWIygbBtGVX1hzZVdzYl9uMkDR9hOtNCGz98mez71YCvZwblhkqesTsu8/x+IpKY:oWIygbBIVFAz4DQtNCGzeLz71YChwbl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840082, "uuid": "609e1a20-9855-492a-9b35-38482b914cdb", "value": 46492928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840082, "uuid": "9b3ddf05-4351-46b5-9daa-41ed351cf434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840082, "uuid": "ee768f30-e09c-4852-93da-e3f1451afe53", "value": "Adobe_Acrobat_Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee0412a-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863931, "uuid": "33d56ea9-0baf-40e5-83cd-618738f45937", "comment": "Malware payload", "value": "92f568435d45171720e472e48f5aa7eb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863931, "uuid": "944cc535-a545-4a86-8f34-ea9382178b8b", "comment": "Malware payload", "value": "23c8116ad4c7b5a2c598a433c518861cf11e37787b75fe9b3c2bc2d566dd7726", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863931, "uuid": "771cc5fc-0ec0-45ba-943f-b27c3c45cf7a", "comment": "Malware payload", "value": "0116589b765f151463644814b92fbd7a43c2f407", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863931, "uuid": "ba732c69-19a6-4a6d-9a49-6de4dca92146", "comment": "Malware payload", "value": "c5451c5b71a9350fe7988998d6d757ade06fb112d2c32744949b7cba5ea907cc4437bf0496a6e0d38a506244fa84bf14", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863931, "uuid": "205e6a27-34ce-46f9-b7f2-d5d3defe707e", "value": "T12077230091B3B515F76BB2BF2AB95FE48559BC6A02E59DF76371B3B806F10920433893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863931, "uuid": "4fc48c9b-1762-4caf-a92e-279a28527a12", "value": "786432:6t9vUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0ylfIaw:6t9f7xVLYjsp+ikJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863931, "uuid": "9c25f273-f4ef-49b5-b64f-11d06c2c50a7", "value": 35910144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863931, "uuid": "35b6d3b0-81d3-4ff1-bc03-9105357338e8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863931, "uuid": "f70c5f6a-3e59-452e-bce4-b44795097d87", "value": "23c8116ad4c7b5a2c598a433c518861cf11e37787b75fe9b3c2bc2d566dd7726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929f0ee1-6553-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Vidar)", "timestamp": 1724859508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859508, "uuid": "16e41e8b-ba13-491e-8940-e9f18e3bdc4e", "comment": "Malware payload (Vidar)", "value": "39a75882ca5f56cb35dd0634a22c2739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859508, "uuid": "0ecdd703-9d68-403d-8d83-e56812939e53", "comment": "Malware payload (Vidar)", "value": "24c26059e1855f17af7fc470d2a6ca8faa69ba6ca5b6526383f464d63845db4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859508, "uuid": "12ce921e-8b56-4c8d-9577-377db60e9564", "comment": "Malware payload (Vidar)", "value": "2c02df0a1c6bb1eb5896e1ac6fa1e243ab6c67d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724859508, "uuid": "31352278-59c9-44d0-9aa5-8f2df7b19b1a", "comment": "Malware payload (Vidar)", "value": "54679b3a6b90da573dfcc862dd36eb06a800dde40641f25023d4103c84d1e7bd245a4a2b44bd52ccf613c0e634267e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859508, "uuid": "2d478159-3c70-4637-80f4-6c322c8a8aae", "value": "T1971412E72AC00669E9DA417030C3F73C6F3971EAA4D24DD732F7C9A2C5897712B94998", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859508, "uuid": "963b437b-06ae-40b8-86e8-736279a36e7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859508, "uuid": "1e7e8988-87c4-4927-882d-efac56e73d03", "value": "3072:LX+0zvAER+HfutQogdHdUXEigdxej5kVZXCjTTclR9c2giq9gaCBKYzEO:LX+UZgdHiX9tjuZ0A2F9zyEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724859508, "uuid": "b044b7f6-e2fa-476a-8b1f-f356e3285c14", "value": 196136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724859508, "uuid": "fc1a01ca-a2d3-47a9-bd41-e5a87feb7f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724859508, "uuid": "c4d96174-80c0-4ef9-83f2-a90a7113a9c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad94e0cf-6541-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724851823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851823, "uuid": "4157c287-198f-41fb-bba0-126b0cc48962", "comment": "Malware payload (DCRat)", "value": "20cf7f39edef3db30f388829c5a3f05c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851823, "uuid": "2ae0507e-b13b-47f2-8e0f-543820a99252", "comment": "Malware payload (DCRat)", "value": "2554c3bd1b50fccf6833eb50179c877a95fce8135031204e8e678c4d8c5db89f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851823, "uuid": "bd28d39b-66f9-4459-8d8f-1db083f857c5", "comment": "Malware payload (DCRat)", "value": "009eb186382733844b2d8c5202d0da9ac1f8dfb0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851823, "uuid": "3db67f85-d1ab-4354-8b44-d434e269a25b", "comment": "Malware payload (DCRat)", "value": "8712245a87aa4e3a9757388d82d6acf6f60446e39679e25d7caba5f06a70bcb6ed899814a93819a71b5e5a4aeb741e40", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851823, "uuid": "7df24eda-d7f6-4fa4-b49d-8a0fed89bd7a", "value": "T115455A027E44CA12F40913B7C2EF464847B4A9916AA6E32B7DBA737D55123A73C4CDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851823, "uuid": "cbd9169b-ac99-4cc0-af5a-65b52c907b87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851823, "uuid": "3a9ef288-19f4-435e-aea3-d6d0f53344a6", "value": "24576:nlWmSIicCBo2ugqxe4AuMylBW2ZZo3/n/HV+MZ+oRzyeM:lriNuzxcUo2Z6//1+cjxye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724851823, "uuid": "7010ba22-a9d7-43aa-9228-9519b797b8a7", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724851823, "uuid": "6ffc5e0b-b8c2-42dc-8ae5-25c89eb8ce28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851823, "uuid": "53469e7c-dbd3-4224-8019-6b0bce64ce49", "value": "20cf7f39edef3db30f388829c5a3f05c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2d3733-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822640, "uuid": "45148639-11e0-4ebd-9170-0293a46c3d31", "comment": "Malware payload (Mirai)", "value": "7221798477a57c3639c026c8a5b42f1a", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822640, "uuid": "2296e214-014e-4c52-8ce1-47da9897352d", "comment": "Malware payload (Mirai)", "value": "2556a87ed603f130f679a365d80171dae1571b5c22651c891aefc84dcb8379b2", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822640, "uuid": "d8d937ce-cb26-43b9-b86e-e10df39771cd", "comment": "Malware payload (Mirai)", "value": "c94d84f3b63bb5fa6a80e491816ac40eebd000a5", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822640, "uuid": "9dbfd6fb-34dd-4bc0-b24c-8b10eca4fe24", "comment": "Malware payload (Mirai)", "value": "fe407be8f79dc8e1d28c33f6507b1efbe371a5b137a68e57765cb827b8401a09f9830797e12f211c4970625bade99b61", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822640, "uuid": "d688500d-67bc-43f8-9f13-550f53ea5a6b", "value": "T1C5D48D23A3518F94E364D2B101F38B149AA116E30BE345D65378D728BA506BC6D7FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822640, "uuid": "0bcf53d9-e4be-4c4a-bfc9-eddfc9af9d73", "value": "12288:k3G46+sHBhYqFguCjSGl0S/bgaazo51sUQWGGScwAO6GDB8JXtHhZQpD+nl+1:k9Xsh2qNC2Obgaazo51srWGGScaStt7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822640, "uuid": "7a7e2aa1-4704-4d4b-9974-4b745b8caf22", "value": 650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822640, "uuid": "5a3dfa75-b873-4023-a963-cf1d0e1f3762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822640, "uuid": "69ca0632-1bec-43e4-8c81-3837ea81725c", "value": "criptonize.mips32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6cfd4d5-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Stealc)", "timestamp": 1724863837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863837, "uuid": "cdf4c665-5df7-470b-b092-7fc79cb8d115", "comment": "Malware payload (Stealc)", "value": "171eeb8ca5c439e8af9e180a5f6a09f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863837, "uuid": "8e9bef9a-e85e-4fa4-937b-5415ae3ee56b", "comment": "Malware payload (Stealc)", "value": "26de39355a5ffb112e494503f44bd63c8e2bc7dba35d58fedaaea1c84f868748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863837, "uuid": "32eab4a2-5790-4863-8c22-b267e56b57a6", "comment": "Malware payload (Stealc)", "value": "0cd33a5c35f8c5ad98c5eab9b11946b1ff146bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863837, "uuid": "1ab04c28-6c8a-4bda-9ec7-089cc355b4c4", "comment": "Malware payload (Stealc)", "value": "7d33f0dbf119ad42fea0463f69333ef4f46aab6daed625bdfb3035e8fc739615f35fd31c65567985bd416f9593867da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863837, "uuid": "220554e0-eafa-4167-a8c8-098f9c5efb61", "value": "T10926BE0A3C50CE22F1194237C99D944857629B612BF2F37B3D76721E65223E7788F98E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863837, "uuid": "5d8367aa-e681-412c-bd59-80527456ce9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863837, "uuid": "255c59d7-1baf-428a-9e8a-66961643e7c9", "value": "98304:q1H0pPbGUO4gORpEYYAA9Yd9Bw0/N+2IDSu839hqt4XIr:qqz/O4gOQYTAww0/N+fSzNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863837, "uuid": "2b82c2f4-4b01-43f6-b76e-280a55e78b21", "value": 4643392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863837, "uuid": "1bf82103-ad24-4e9a-ab48-f34de1396542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863837, "uuid": "433f0e6d-cbe6-4b80-86e0-4ddc6dc0b3b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bf37aa-6587-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724881946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881946, "uuid": "145521bf-3d3b-4704-a2fa-ebc217ad2dde", "comment": "Malware payload", "value": "438c7a93f853a732c1934512f4ae125d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881946, "uuid": "8b8229c1-59be-42fd-a16a-97e065901085", "comment": "Malware payload", "value": "294d7d2f0a521db1eec00d58da797eac88902209a7083d2dd7b7920c206dbe04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881946, "uuid": "d9de8c40-5cee-4510-91be-04d7d3483c5f", "comment": "Malware payload", "value": "5e08b5be8a39bb307d27eb7332367ab5b95017fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881946, "uuid": "37ead4f4-ab55-4765-987e-1e0dce3239ba", "comment": "Malware payload", "value": "579a6c82039558caa8abbf9ff1e42c8dd2fa56e9228c88bc40329d9476581550119861715a858750b83df4c9449d1528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881946, "uuid": "21170ba4-79bb-4fb1-a29f-354d1f8ab071", "value": "T18FE53381F935ACA4E26845B10453C193A26F7E129ED5C14A3BD8BFAF1DB06D38C37E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881946, "uuid": "83cc281c-08e0-4b7a-8e29-04bd12657660", "value": "8f252d622858e6b45e6c847617db8770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881946, "uuid": "625e8ec1-e70c-4f43-83bf-831121f6d297", "value": "98304:h+a6JLpsf7ZiP7BXyymDvnSfh12dMfPwJp9:h+3JdKcdinvSp1Y/Jp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724881946, "uuid": "eb68621e-b7bb-47eb-8180-95fd21b60359", "value": 3206991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724881946, "uuid": "f4332c5a-1d6d-4c34-93f4-e4223bf48ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881946, "uuid": "42b2aa65-ff61-40f6-9de1-6cfd93c8593f", "value": "4303-mailclient(star).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49efd941-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822450, "uuid": "725457ea-b897-486c-bfe7-7f1f11549542", "comment": "Malware payload (Mirai)", "value": "14ed49e3e284bdebc5d696dc14f48cbf", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822450, "uuid": "cb998564-15b2-4b18-9276-2a0b4a2d3197", "comment": "Malware payload (Mirai)", "value": "2a26fe1303e180efc67f39675248cf12e3ab973bfc29ca98117c29bd33e72072", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822450, "uuid": "3a7ae453-2141-4365-b6d0-65fd8d4c8310", "comment": "Malware payload (Mirai)", "value": "9f12c0766522848f7d81c398bb0ac3c10149033f", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822450, "uuid": "42a24113-b841-4a18-8026-8f64e3c904bb", "comment": "Malware payload (Mirai)", "value": "1a7c7ee92710dcbfd91b08ef39ea9ea78f46580f1cc35be877212eb69f62e5327ed0940a88db6bcf088bcc69816c68aa", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822450, "uuid": "399cc190-e344-47fc-953a-4cbb6017e08e", "value": "T138D3296277760A2BC4E0A17971F75333F2FA478614B8960B3FA15DCC6FA965031237A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822450, "uuid": "b8070959-f618-4252-be96-df4f9ded6135", "value": "1536:uCviS02GREboKbKFe7v57SBjt3AIHfjwGw/7RrRxnuXU0PgLVZt5WLzOPKMo+Yv/:/vhT1OFDfMGcluXHPlOSMU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822450, "uuid": "11aaabef-34d6-49e9-9f8f-a7ce96da6812", "value": 142584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822450, "uuid": "6187ceba-10a1-4687-8c37-2fa43253648f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822450, "uuid": "d2661021-7710-4a53-8444-5aaba97e52fe", "value": "criptonize.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d64386-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822436, "uuid": "ffcb3fac-4b6d-4458-bfd2-a91d7debf620", "comment": "Malware payload (Mirai)", "value": "5af18fcd88c209f1029eb11d6b4919e5", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822436, "uuid": "ad49cdfa-b4bf-4656-aac2-9d47059d8611", "comment": "Malware payload (Mirai)", "value": "2c3e6b758d47d055c038811423bfd72d9ef30bcd702b6c57aaf563e9abeadd89", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822436, "uuid": "361867cd-082f-4c39-a538-dbae20504f04", "comment": "Malware payload (Mirai)", "value": "397e5611293e582836df051a67279bd044fcaf1a", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822436, "uuid": "6303a870-ee55-4ff2-b380-f28c8f32d6b7", "comment": "Malware payload (Mirai)", "value": "50b9dea809e314adee268f922586b5c32fdeb4d0da17c650ef5f0ab100c60a0a6279c3d3cf3f017d5ff5a124b381049b", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822436, "uuid": "31ed1ea3-749b-4182-b12f-efccddf7bd66", "value": "T10ED30856E8819F11D5D115BAFE1E528E73131B38E2EF72025E286F747B8AC7B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822436, "uuid": "79833cce-1147-4e89-b013-e9a151d583ff", "value": "3072:N+xYaTvHXurQv9aI6NtwlRS1quPxxB9G:m1DXurQ1afElIpPxf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822436, "uuid": "b252063c-af91-40bb-b6bc-ad104fe89e82", "value": 137832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822436, "uuid": "cc31642a-bf88-4b12-80d7-cd29e1bc654e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822436, "uuid": "09eb4fe4-f0e5-4fb1-9918-a4f7d70334dd", "value": "criptonize.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b71f7b-6502-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724824640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824640, "uuid": "f3b4e669-9226-4567-a655-ec2a296410d9", "comment": "Malware payload", "value": "fac8907f02f3e14d78bd6a25095b4e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824640, "uuid": "9b5f5442-8aeb-4e07-93c9-5613274a23a2", "comment": "Malware payload", "value": "2f0f54aa7e9a6acc28ef42b9be274d7c957cd38ed951c6b126a3d10a06b38df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824640, "uuid": "dbdbae85-d29e-48cf-8e80-1cd352f3ebc6", "comment": "Malware payload", "value": "078ddc27d644424a056a374a1da71d1951d1d4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824640, "uuid": "69baf495-5735-4757-9de8-2b02abc3955e", "comment": "Malware payload", "value": "7407c6518a39906e9f81d1e83dd39b2f5d11575d184d6ac50c0e949eab9e4e9b15fa4f85ffd0e0964985d4b192e5fa81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824640, "uuid": "add94249-bd5c-4691-a749-2ed76467f806", "value": "T12C159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824640, "uuid": "1fa3100b-8d89-478d-9eb0-39cd528f7809", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824640, "uuid": "ab654585-4ba2-4c6e-8dfb-47d9d9b7b835", "value": "12288:PqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTy:PqDEvCTbMWu7rQYlBQcBiT6rprG8asy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724824640, "uuid": "b7ebe8e5-c82b-4d87-a319-c8b339f15607", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724824640, "uuid": "166fa5ec-26ce-4488-adeb-5bc5005f3249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824640, "uuid": "d4eea107-71ec-4138-a4bf-5c9816866997", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b781b167-652e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724843679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843679, "uuid": "88acf753-7964-45d3-9884-3d8b040f896d", "comment": "Malware payload", "value": "e1a7176406b20cf3e4ef3d567d9509eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843679, "uuid": "00484e76-5072-49ae-8110-f62a90b0e4a7", "comment": "Malware payload", "value": "2f7be16d3503f8c656f9a735d037a45d89e3be23ea60901c74efab439583242e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843679, "uuid": "aa058b3f-a9cf-419e-a689-b76163dba975", "comment": "Malware payload", "value": "43f3326a25d27f69ebb3c687b7688023af570f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843679, "uuid": "bfddc241-bfd5-46d9-a86a-6b48c6edeb69", "comment": "Malware payload", "value": "4250a084edf46462ae7bb4b0f85de8ed371aff31490296ff80aee8fda5f5e60c9528d64d35e80117d36762def7761c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843679, "uuid": "7f02a9fe-d129-41cf-a792-06ed17d022e5", "value": "T1FA159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843679, "uuid": "af6c81e5-4448-47b1-b7c8-8a44b3435d04", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843679, "uuid": "1090a1ab-f31f-4157-bfda-16b4a4cf23af", "value": "12288:nqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT6:nqDEvCTbMWu7rQYlBQcBiT6rprG8as6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724843679, "uuid": "20b8c352-8a62-40bb-b6a5-05589b305ad1", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724843679, "uuid": "2067ad72-4b4c-4b58-9702-b6619683969b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843679, "uuid": "b2f35240-359f-4ea0-b2ec-e0af2ca799ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a2a4f9-64e8-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724813415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724813415, "uuid": "455894ac-c3ee-4c86-9fbc-87bb04b76f7e", "comment": "Malware payload (DCRat)", "value": "7e92b919f0d413c201afd73a1206a471", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724813415, "uuid": "bc74c60f-79b8-4bd1-99a2-0f95cb46499d", "comment": "Malware payload (DCRat)", "value": "3049dff59c007e4d95714d9e75a74a50e0ce1e012c0ea0e8dd0c4d457d99bf44", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724813415, "uuid": "2b2b2b81-3392-4cdc-b3fa-a4a9c33a6d54", "comment": "Malware payload (DCRat)", "value": "d232d9e8c0d0bac4706a9ed3fcfb0c29f3411bb3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724813415, "uuid": "50cb5631-6ee1-4d25-bd67-58a7697166be", "comment": "Malware payload (DCRat)", "value": "626a1374ac02a892550816c3b4df4d1119a64e955be25e0685043388757cff6f9e04c6aac48654601850b0d77c36b1a0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724813415, "uuid": "79658cbc-7b87-454a-939f-a2b95fdacc17", "value": "T1F1C5CF017E44CE51F0195233C2EF454887B49A5966B6E32B7DBA377E26623933C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724813415, "uuid": "8a613d40-961b-434b-a790-08bbab729cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724813415, "uuid": "965a70ee-4785-4c79-b160-55a3e6b9c7f8", "value": "49152:YnKY/LDpwDbG4PgI8l0muhENyOdPazXijeJ38T:Yb/Lie4oaZhE4ipe+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724813415, "uuid": "f8227186-6462-4c58-8e03-e28f6cf83e9e", "value": 2539008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724813415, "uuid": "f74b6970-fb9a-4707-9af4-060bab1f7885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724813415, "uuid": "23801af8-ca5f-486d-9d0b-982af6ba2973", "value": "7E92B919F0D413C201AFD73A1206A471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1a1192-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827691, "uuid": "89747a85-e669-47de-8353-01178d26f827", "comment": "Malware payload", "value": "b70f4af9a0bfc0bc38b2d7b75e6b524c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827691, "uuid": "8536287b-f1ef-4abb-9217-a9b50f7d73ca", "comment": "Malware payload", "value": "31b171a89cebf5782b28cd35719a8b1419c2312055e3a47bb6892db1de239c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827691, "uuid": "4256af78-8f1f-4607-b53f-cd2d485ff9a3", "comment": "Malware payload", "value": "462c39e3f1b4ba524793ce5dd18e0c7b555bca12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827691, "uuid": "5403ea4f-ee65-4024-8373-7a4ef74aac52", "comment": "Malware payload", "value": "b967ec8fb1f26323cf9df689fdd0e1aaefe550da2399703bc5fe67284e17a9d38145c321055a6b755838c1aebb509e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827691, "uuid": "4a94ca50-8bbf-4fca-8589-2d2cff3a5bcc", "value": "T192159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827691, "uuid": "13cd5778-9c79-4bf1-9150-9352c05183e1", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827691, "uuid": "fa33c615-9619-4b46-9ed8-f2de00a181ec", "value": "12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT8:qqDEvCTbMWu7rQYlBQcBiT6rprG8as8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827691, "uuid": "3721c152-8a8b-4547-8778-6399c9866553", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827691, "uuid": "1244f415-27a0-46c2-9c04-c5adc768f609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827691, "uuid": "4fb783a9-a6bc-49a7-9c19-ad20ea67d5ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d6f3c6-6576-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724874442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874442, "uuid": "9c06218d-7b72-4ac9-b6d7-9d45bce3c7b2", "comment": "Malware payload", "value": "0b182aef2380479423dc14220756aa7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874442, "uuid": "fabd0ae8-32c7-4b34-b4e6-a6b9672ff9ae", "comment": "Malware payload", "value": "31df9f3e58054928779b114af501c62497d3605a6b4d6c3e19230b320d2ba5e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874442, "uuid": "f1a20988-971f-4d6a-82d8-014746b7b430", "comment": "Malware payload", "value": "4d514b4a814f1deb47bc0d5797934aa9d649106e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874442, "uuid": "631fe59d-d988-40b4-8cdc-a3608771df4d", "comment": "Malware payload", "value": "1fdfeb890f614196e54bf49d953b89dd4f43a37689b40ecec366164d366b17d0ab370a38b3e253e01a1f918ed6a53f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874442, "uuid": "56c6eaf3-e39b-401f-87d4-f312995e49cf", "value": "T102A30156BF3882ABC7291335C9361E7A85B27C987A77D98CD3E936CF8870111C15EC4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874442, "uuid": "9d6c4040-9c45-468a-8266-4ec33776defd", "value": "e5e0ae6977b6b5292d9abee09eb5aff2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874442, "uuid": "7b42eb98-cbfd-4184-b1be-0f7bdd3675bd", "value": "3072:xFphTfm1UC7AdYzrV+Dljy/32ubwZZqJ:FhTfmuCkdYzrVolu/J0ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724874442, "uuid": "f50d50b0-da39-4b92-8455-cfe2ad9dd185", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724874442, "uuid": "238ecffc-f149-4b15-84f0-09b17aece4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874442, "uuid": "3f1dc3f7-3f65-483e-b845-061c3306313d", "value": "alta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4629df-6575-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724874267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874267, "uuid": "1727a40d-a2db-4401-a568-f3de3bf7ae0d", "comment": "Malware payload", "value": "7f0bde5df6ebbdceeda83413fc738320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874267, "uuid": "d76f9ee3-b5dd-4619-907e-a6c35071c473", "comment": "Malware payload", "value": "3220d05370089858afc641382a81dd7e36ee4ad2061addfaf9d70b966e20b718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874267, "uuid": "6de0e75e-01a4-4ba3-adb9-842e07a24700", "comment": "Malware payload", "value": "0b56f2596dc7a7a98d0658fa713c390fc13e3b58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874267, "uuid": "feffc941-19b6-4c68-acc4-6955976bf7c7", "comment": "Malware payload", "value": "002436bbac0ad1c3f350d89e97c8ec1d62f773301916b7f8eaf56603918f06207fd4ad88e8ca5ed7af21be94e38c172b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874267, "uuid": "910de448-5320-4862-9cdf-87281f7ce490", "value": "T19DE4236F3B8A99B5CEE95676D48AF8784621F40D82D3F3CF0CCA0C611EE53844D98667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874267, "uuid": "fe3213c9-1431-4b9a-b5a8-ff16485b861c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874267, "uuid": "5183d6ba-b92f-4a46-8bd1-4545485b4dcf", "value": "12288:6mdn4uUeOJon2ftsknVYzi9FCqW+mizBu0LbDcrnsCQYF9eNQvnoj/TY9VNh6T+6:6gTOJCciUPFCqTmiVt/crnbF9eKnM0V/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724874267, "uuid": "19e6736d-7c61-40d9-aa04-e3e37556d901", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724874267, "uuid": "95eaac67-017d-42c2-862b-c735b6760ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874267, "uuid": "e2683284-242b-4590-a332-044d0e4961be", "value": "PqHR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971fe703-64e3-11ef-b7c0-42010a9c0002", "comment": "Malware payload (QuasarRAT)", "timestamp": 1724811412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724811412, "uuid": "4dec240b-b639-4ab2-aa85-1fd80e34109f", "comment": "Malware payload (QuasarRAT)", "value": "889a3afb40737c487874393ad4915eeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724811412, "uuid": "fcb4fbf9-51c6-49ad-9845-fb49d6a33e92", "comment": "Malware payload (QuasarRAT)", "value": "3255bba29d1d4de38cb9d72636251ed19516ee5c090512f4332f38b837cf13f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724811412, "uuid": "93bbf615-1dc5-474a-8e15-42c69dd48e24", "comment": "Malware payload (QuasarRAT)", "value": "d005c0dc81b6934cc48438ad3b32042ad67deb07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724811412, "uuid": "ae0ef66e-5a53-4fc8-af17-546d4c8ba199", "comment": "Malware payload (QuasarRAT)", "value": "ec9be29bb7137d0fcf663d317f36d763a24c3140fdd44402835aba19e9d9c7326099b45f66df90fb53a27840746238c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724811412, "uuid": "ac5fcae0-a268-4aea-86cd-8c7d0073655e", "value": "T1E506330525D6AFA2C8DF07B98652058447330D48AD81F3EF2C9E7CE17DE6BC86586E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724811412, "uuid": "c0c62882-75eb-41f5-bf50-cca77db3e0aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724811412, "uuid": "dcc6f1e8-5d1d-44f4-8875-d852e4abb3d1", "value": "98304:cDMgfL0MjhdmEYApF4h1LfuaIy5Sp+l75v:uhdwApFAmaIywp+l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724811412, "uuid": "a527f023-c233-49a8-b16c-da1288993a71", "value": 3821568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724811412, "uuid": "649c3543-940f-48f1-bb70-fc7af3f18d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724811412, "uuid": "3df075e4-d573-4c86-960b-9c2f86122bb4", "value": "ZKB - Zahlungsbest\u00e4tigung an 20240828.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa8b47c-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822424, "uuid": "cf118902-2c0d-4ad1-8681-a20c09cb5edd", "comment": "Malware payload (Mirai)", "value": "8a29c9f9c8d80684aac29a72ad1506f4", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822424, "uuid": "7090cd8b-4c30-4488-b709-0de246d9a1a1", "comment": "Malware payload (Mirai)", "value": "3282bc3a69c9be6bc5c74d2748f391023f6199bb01c9f1a6e6b293d769522947", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822424, "uuid": "f60c7ab8-4898-40ce-821e-3cf5b04a4bee", "comment": "Malware payload (Mirai)", "value": "6177bcf50dec851ff30f9cbafb6edfcdfdac76b6", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822424, "uuid": "601fc767-6e79-4e29-9c69-5fad9cc7bbc7", "comment": "Malware payload (Mirai)", "value": "8fb8a3e7fea514addb305d5911ae9654d7918973fa3ba639f66ea89d4846bed66f9c70cdd706d5de658f970026fe2440", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822424, "uuid": "d226d3bd-8b70-46eb-8126-eb8f60e64ded", "value": "T151B35AB3D8296FA8D914D8B4B4B48FB51763690841471FB96AABC3785083E8CF6407F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822424, "uuid": "f5d1e58f-1ef0-4931-8bb5-552a0e15bbe4", "value": "1536:zz/iPw4rW0s6+sKY84i5vvogHHwItR26Bs3nmUSTL3xwzSScfsCu:zzew4r9+sTk5vowaCs3nwzxOdcfzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822424, "uuid": "37c5cd39-bd86-4eb6-8010-ed917f097987", "value": 116852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822424, "uuid": "6a3a06fd-ecba-4221-91a4-66e79dd1b323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822424, "uuid": "df5fa1a2-84a5-4c5a-bd59-1e102fcbaf92", "value": "criptonize.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdf4c68-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854801, "uuid": "31a04bae-a2c7-4322-b274-c72d1e4affd8", "comment": "Malware payload", "value": "0f968ecececfe7eed680da0225af8fe5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854801, "uuid": "443b474e-5bf2-41a5-b008-80e742c1da16", "comment": "Malware payload", "value": "32dd589e1f7963ff5e31e4bcecc589a98434f910469e242f114892b9f372b960", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854801, "uuid": "08f93957-f73c-4d1b-816a-55edd46a4d23", "comment": "Malware payload", "value": "4ab8560296545064446a80b25bedfe5960aa0880", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854801, "uuid": "224a6b75-2170-4af9-8be9-21df53f34844", "comment": "Malware payload", "value": "54941400f65575e6471388eb02835de22ad1f546659508dcc7ff077f787568599281d4e734598ae3c18d4aa11510da34", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854801, "uuid": "6968b3d8-1702-42cb-9de2-33eb873a6e3a", "value": "T15297331C3FA08791E15882DB0B2F3BCCBDD19817DC6A39F4A13B9089DA9A78270D7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854801, "uuid": "e0617f5c-ccc5-4313-94a6-fe5390234df2", "value": "786432:7CL6sj2uVEtGL9CjcxryGoWq8sgGzNOtEG+hOF2NB2VFRY5dk0dMBEVl+pcfC0:u2saYo8GgOyEG+sF232rRYfcBTcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854801, "uuid": "d7d6a7e7-2135-4ee3-b29a-7f7740ddeeb0", "value": 43305829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854801, "uuid": "fe74070a-a81e-471f-aa36-e13cc0216910", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854801, "uuid": "fc7f6dce-e158-43e4-97bb-9567d8f99ef4", "value": "3694fa6c046477537b5740dce2121d635c06209b799c81793e1b9e723b6ac9b8.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e2a7f8-657b-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724876853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724876853, "uuid": "73434cad-dab2-471e-890a-994f2aca3205", "comment": "Malware payload", "value": "4d86c48b5d9f043b6e0b1ef3d2c7bdd4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724876853, "uuid": "e49db090-c476-474b-b6a8-cae025489c3e", "comment": "Malware payload", "value": "33ac27d5d62b88cda7ee122abcd3209306e9527ab0b9dea5633572d8f3908bdd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724876853, "uuid": "e51a1bab-1b23-4085-a8d7-ad33110ebf10", "comment": "Malware payload", "value": "9206cc3a88ac7f737bdac86649905a9978443109", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724876853, "uuid": "dd872212-25df-4938-aa01-94bb32c03c15", "comment": "Malware payload", "value": "857e02e36e7dd83b3a50b114e8bf13833180ffd619e2e70184cb22c437cc2400ee3aee7826b6eefa103684229471f984", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724876853, "uuid": "53644c45-9492-4cac-83d4-cc298e93e083", "value": "T181C423983AE1EF37F08368364ED2D0A78680FD160F92CA87B158379EC9FB7557611A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724876853, "uuid": "0be17b07-57d3-4f09-970c-f65397b9d870", "value": "12288:4AFGkrsew5HQeDRsdq4oNNxFUYM9eyfDZX4t2sbOeux3:REZFRQeHhN7FU7e4DitZ7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724876853, "uuid": "e21612da-e4a6-4f4c-af91-4fa2312d7d7f", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724876853, "uuid": "8d511a7d-168f-4b62-85ae-13ef02c336f0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724876853, "uuid": "9d0d32b7-5f6e-4947-a810-eff4aaacc4d0", "value": "SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.16063.8851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd05e73e-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724840252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840252, "uuid": "46f89a48-c94d-4c53-bf5b-a425142ce9f5", "comment": "Malware payload", "value": "fc4e7424a92989df9f8c693bd1f394d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840252, "uuid": "5baad9ab-5e9c-4add-b39f-6a9c642748dd", "comment": "Malware payload", "value": "33c35a40c1a1a5e6367c54c260ce98a319656620b699c2415c37b0ac0c96308d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840252, "uuid": "1c87bd28-997a-419a-9cab-d53530fa5ad7", "comment": "Malware payload", "value": "59a421287b23bd81fbaab36e2a1052c3f890b2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840252, "uuid": "5e0d5074-15c0-4456-a6ce-be38e9ffa962", "comment": "Malware payload", "value": "2225e2cbb4aca5aab07c8517f73bc7a5d29d7d2de1223d4e97df217b5c583ea99b6b1a10db03f58cfaea7c03eae5b90b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840252, "uuid": "8914fa28-634a-493e-9a58-e5be4752386e", "value": "T16575CF0237D1C027FF9795324FE6F725467C5E650827A61F17A83CBDBE706A01A2E292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840252, "uuid": "9a4aba06-2951-4eb9-a910-afb8e46dae47", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840252, "uuid": "af749171-3683-47f2-a296-dae1c9adfdc0", "value": "24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8asthte3HBelR5BfimN9ax:ZTvC/MTQYxsWR7aCA3glR/KmNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840252, "uuid": "77a2220f-f3d4-4ee0-98de-a6e7507589f0", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840252, "uuid": "f961efbf-9873-440b-99af-4ef985143184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840252, "uuid": "cb886a97-41cb-4467-8464-e34147f23e56", "value": "PAGO $630.900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7004ace-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (LummaStealer)", "timestamp": 1724840349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840349, "uuid": "b2ccd7bf-e27c-4c72-9b5b-79e4b1e97ac4", "comment": "Malware payload (LummaStealer)", "value": "0e41a6c28512f5519cca3505aed89ec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840349, "uuid": "0f9147cc-69cb-4680-8f01-2c9848a1aa86", "comment": "Malware payload (LummaStealer)", "value": "33d80d826bcc36c44603e065547e1038e94478d4053c31eb472d4f159d2964f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840349, "uuid": "689ff4f4-762b-4355-ba8f-a08632dde4d5", "comment": "Malware payload (LummaStealer)", "value": "cc09897a0000ec3649923bec5d18850757dd0425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840349, "uuid": "87e61e15-860d-48b0-8abc-86d844b0cea8", "comment": "Malware payload (LummaStealer)", "value": "2f3f524559405cb595b65567f2da228bfc10d5a1634b5c7afbf3cfb1146280e7ef2a8f2eb4f04a79b09add9d4ec0c1e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840349, "uuid": "1f0f134b-6268-4a04-a77c-9d1464a4c60c", "value": "T1D0D63950FA8745F2D9034936844F723F6734AD098F29CB8BFA107E1EF837A925972649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840349, "uuid": "6a00d270-83b8-4efc-9fbd-c1b20bdb3ae9", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840349, "uuid": "dc03ef87-ab9b-473a-b781-27a89143dd8f", "value": "98304:j1bfAxk5HgvKPcZziN89QpAKovjkroQlb/sZ:Gxk5Gd41A2sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840349, "uuid": "28836945-f055-4cf3-be43-d0a2e69a942f", "value": 12819984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840349, "uuid": "56611a12-3b6e-492d-a1dc-df2200a2f156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840349, "uuid": "8139a874-79ef-4fd1-b2b2-2cf657a0fd56", "value": "satellites.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ee4bce-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822461, "uuid": "0fcf254a-96b8-40c9-8cf2-c6503b81c2d1", "comment": "Malware payload (Mirai)", "value": "ec2444babb68f2cf6b0f36d5bae71b56", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822461, "uuid": "e84112b5-f49c-4361-82e6-c1c1865a7bb4", "comment": "Malware payload (Mirai)", "value": "346ed3a966ee5f5d61b639bb9eead2c5b750193d96411249e2410a44967d89f9", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822461, "uuid": "eaa5b249-f2b4-4be1-b353-85c8c262ed1d", "comment": "Malware payload (Mirai)", "value": "1d485ef16d3f13935ba92f603dd4c09bca74e257", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822461, "uuid": "56105411-47f7-4f8d-b299-cea0ab84a8d9", "comment": "Malware payload (Mirai)", "value": "d657d803c4c0c47b47ea16b3f8b306351b687a84dbbb6f9e759675e62c0787a85e417961a0f9d7ef4bfe85729d976649", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822461, "uuid": "39abbebf-d9bf-41ac-baa7-aae5f13024b0", "value": "T14AD32A06B30C0943D2673EF03B3B27E193DFAED120E5E685255EAA495171D33558AECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822461, "uuid": "602eeeec-4ae4-431c-828f-802297e15432", "value": "1536:5NqOg4SwxGBbjUaEha3RifGi8GqMaxZByHvo3SRRAdAWfC5pON1x375xgV9nH:50Og4SZChaB6z68nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822461, "uuid": "fd21da78-acda-426b-8fc6-25b155fc920a", "value": 137436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822461, "uuid": "fc3f605a-81ba-479d-b73d-bf05204420b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822461, "uuid": "09ad55d2-7067-486f-ac53-913ab9557302", "value": "criptonize.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7394a19-6510-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724830847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830847, "uuid": "9d1ce96e-25ac-4f4f-be85-0cb18ec3fa3a", "comment": "Malware payload", "value": "29bf9b3da02546cc1dca15db55e31a6f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830847, "uuid": "5e3d631d-6f2c-4467-83d0-10cb44c455a4", "comment": "Malware payload", "value": "3545f9d3ed947a54018b10a1c149e67bd74a3be12107d56d8b3e1785ad0e3f22", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830847, "uuid": "5ddf8bcc-414b-433c-8a82-0e6f7af96e6a", "comment": "Malware payload", "value": "3b729a74f3f96083aeb3555305cc9c9c0a984189", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830847, "uuid": "48931a9d-04bc-4ba2-ae9a-6d8010416873", "comment": "Malware payload", "value": "7e53718a7b2259bc692868bcb813c5cdff316dce31019e583b85661b03f90e47e9794738947c119ee6ecbe109feba2ab", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830847, "uuid": "d2f277fa-39ca-4ef0-b897-f09012db3b38", "value": "T1F621CB1037F98A70F7BB0A7898F767258B76B803D900CF1D400841581CA8A40ADADF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830847, "uuid": "4d74b01e-86d9-4da5-b4b9-36179a7f89fa", "value": "24:89lBBVJO9J+3fuAOc8PAMYWDvvdp+dTbGy/N0ReVVw5kw5hwy+cImo:89lBBVs9of1Oc9MnvvdARx/KReQZbaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830847, "uuid": "9b9c6a27-6dc6-43d3-8c2e-1cf90ea67bdc", "value": 1206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830847, "uuid": "249ecde0-39fa-41c3-b4fd-a73f30ca5ffe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830847, "uuid": "a1c4f360-9c9d-4f98-8973-c0a1e637d306", "value": "4604883298344743821_pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b629d3-64de-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724809340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809340, "uuid": "0dc6b56c-5a1c-40a4-a977-afc5f15caa84", "comment": "Malware payload", "value": "0d24393571b411921999d665eb3153a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809340, "uuid": "29161974-173c-4001-9530-d055a5f3c11b", "comment": "Malware payload", "value": "35f9874bcf78835358c9f206c961a37a2884d57d9fa508d392c0b15a2fa007ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809340, "uuid": "d30aa9c3-5564-4b5e-8e6d-3530c5f22b19", "comment": "Malware payload", "value": "85f3146ceea9738c4d0b83f50a8fabf8d3802d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809340, "uuid": "0eb37648-8b90-418b-a865-cda9ef93ca61", "comment": "Malware payload", "value": "8f1d6df5f68cb9ec9f035f083b3e5f69f5df5141794bba24dc613f95e77345c1d37bc9370b080bd65a71f824994efc79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809340, "uuid": "4e866bc1-7a96-42a8-8d3c-cb3675526e3b", "value": "T1E1F733AC4D68F006F580B87BE1CBDD361F8C2C7508106B89BEDD7ECB3A6A9146789754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809340, "uuid": "f0b58686-8a63-478b-9205-3ecd63cfff78", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809340, "uuid": "ec276c01-4ae1-4c44-a30c-f8af9e8ee0ff", "value": "1572864:p2PkJop2Mh8gJ3yf5MvzEyADbFTI3tNDsJlHYLMsn7Xygocyq2:p23p2M6OQWbEDbhI3tND2FWME7ygocv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724809340, "uuid": "879102a7-65b6-4176-bc92-c6d42aa15837", "value": 73004128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724809340, "uuid": "6c83ec65-5609-4690-9458-6bf27e30cfe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809340, "uuid": "63a41c55-74f3-4b5e-86ab-7b2375273c47", "value": "Nebulard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1fc585-650f-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724830350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830350, "uuid": "0d8f5db1-aefb-4b1b-9d9b-8a6d783ef14d", "comment": "Malware payload", "value": "a0b62eff0899c3c718aa59ccab5a25ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830350, "uuid": "d379511b-89f0-4e43-ab77-9facefef3338", "comment": "Malware payload", "value": "367912a0bf91ea74f523407c928501623370e8a282dc5d67c4d218e16febe097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830350, "uuid": "ad826066-3876-466c-b318-fe90043a577b", "comment": "Malware payload", "value": "051daab6f1aef64a71d5f0d26582b45694c0d72a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830350, "uuid": "22ca01b4-d3f4-40ac-9a5b-875e41e33f6f", "comment": "Malware payload", "value": "e46241fda4b2ffe93cc16a77a0ef6266075146bd798da286b2e80d033e39df67bccb1f43aec1490f7f0fd539d5a89f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830350, "uuid": "49fe83c7-18c5-4bbe-8156-21f81ca424a3", "value": "T1EF5733DEA7B91032C0F2A0F6E9D3436DC657B6097AE88F2586D4F3642819255FF83349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830350, "uuid": "f9cb0005-9bf4-43ce-841d-33a430926ff4", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830350, "uuid": "67871e33-d730-4bc5-b3da-62dbd39e97f2", "value": "786432:xs+sgn3k0tBeJarpxG8/Q/La8PhR4EV/UTqgnF:zB3kSecrpUOQ/LVXrNU2gnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830350, "uuid": "963048e1-75c7-44c4-acfe-ecd72322f379", "value": 29586732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830350, "uuid": "7b2e44b2-16dd-478d-8814-79cb69e144b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830350, "uuid": "7bf2ac77-3757-40e5-bf3f-84e79c4a42f6", "value": "SecuriteInfo.com.FileRepMalware.795.19843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa54f7b9-6528-11ef-b7c0-42010a9c0002", "comment": "Malware payload (LummaStealer)", "timestamp": 1724841214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841214, "uuid": "61c7a227-0a08-4cd9-8387-c2e128137d6e", "comment": "Malware payload (LummaStealer)", "value": "0f0efe43455290de3ad95564961c57c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841214, "uuid": "22ee10bf-5a59-430f-8977-2472434b790d", "comment": "Malware payload (LummaStealer)", "value": "36d281ade337022c002a83111f11c0994075c49887ce3527c10a050aed69726f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841214, "uuid": "318e10aa-ffcc-4349-9357-58846f0556bc", "comment": "Malware payload (LummaStealer)", "value": "d2c4622ffd59e1f9389ad72d5d69fe30652fce86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841214, "uuid": "86bf876b-fa12-4131-912b-f7405776805c", "comment": "Malware payload (LummaStealer)", "value": "4421f8935da1edf9cd0374995beb8cc1097148b974219f69f4b161c2a863edb5401e0324222541c16bbd0d8151029e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841214, "uuid": "ce8bd32b-e01b-49e6-b0a8-95a91afc3232", "value": "T18D172847E8A555E8C4EDD130CA728226BB70BC854F2427D72B60F6342F76BD0AEB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841214, "uuid": "ccfa3e21-383f-46e0-908e-a024fdba3c3c", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841214, "uuid": "893ac4e3-9520-4301-bf4c-4156678cdea8", "value": "98304:Zh8o3uafmzZd0BCbV7m5tw4qe8lUzhg9z6J04ZXKMEwNvxChEgeSLYcDDF0Wq8Wl:T+aEUCbV7KtoU3TNv7nsYKvwup5I5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841214, "uuid": "c0224652-4a76-43be-94ee-90f4abf57a12", "value": 18851344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841214, "uuid": "0ec7d534-fbd7-4975-aaec-9782643ee426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841214, "uuid": "e684e79e-f53c-461f-be74-3545e4b28a30", "value": "36d281ade337022c002a83111f11c0994075c49887ce3527c10a050aed69726f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c2b9c3-6566-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AgentTesla)", "timestamp": 1724867783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867783, "uuid": "c0d66e6e-fba9-4f18-b8fc-577be163fc1f", "comment": "Malware payload (AgentTesla)", "value": "2cfad4baab1419bd9c45e0209da28fd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867783, "uuid": "cb64f06e-5dfe-4417-a120-eccfeff0ee66", "comment": "Malware payload (AgentTesla)", "value": "37038c1f73a5fe103d0f8f8cd7b15a032412dfb8d7f0e1a8373dc730b0eae3c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867783, "uuid": "2e778de3-2a32-4f4f-932d-98c81fa01eaf", "comment": "Malware payload (AgentTesla)", "value": "43fe95136ad0f40fbeb15c69c992562babb53541", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867783, "uuid": "c1b4036f-0dfb-4989-9c63-eb96b61716fb", "comment": "Malware payload (AgentTesla)", "value": "33cdaf7331b98f8dcdd8ee0bba6b857949fda862f745a6edf83ad47780217f2d1d3badc9d4cde16827c7b18cb0ad95a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867783, "uuid": "7a866560-fc9d-4861-8d58-6212502655f0", "value": "T1390523C4DCE181AB44CD4D6D40F80D6FA3EAC7ACC2A6DB9800BDB7E16766AF1D6504C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867783, "uuid": "a05ce1ff-2dd7-4cd1-9a32-fb6d0558ac8e", "value": "24576:N17+7J0Ln7/wQAELwcEQQ8Yq149/QVFHjjoHyC:NtoInjwhAwhQimFHjPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724867783, "uuid": "1e6d5502-15e0-43a6-9de1-7a149108904b", "value": 865601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724867783, "uuid": "c69721c0-a8b2-4a78-9930-e2e05d2dae56", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867783, "uuid": "07f18729-90b3-4f1f-bc82-4a7cfa082393", "value": "New order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe46141-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840257, "uuid": "6c85eda2-d463-4096-a1cc-446cb6dad1a3", "comment": "Malware payload (Formbook)", "value": "25c8cf4edb39a5f73840e29917cf5818", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840257, "uuid": "5eefbc96-f0f2-4157-b950-33b0280488cb", "comment": "Malware payload (Formbook)", "value": "37494458df14c404338c3204ba4ce78df686b5d65c2e528fc7a36453e1835f09", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840257, "uuid": "b18f470f-26f2-41ee-b60a-c120ef6f0bd3", "comment": "Malware payload (Formbook)", "value": "b9c86cf8bf35436c75ce6c1f9c4296be386cbb12", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840257, "uuid": "8b0250fe-5ad1-4cf9-a86b-f5deb911b2a2", "comment": "Malware payload (Formbook)", "value": "10eb07b588521dad3c067b44e50cd5cdada46dbd44e040da4f728b31107ea882c37e1df49353b5b99a08044023a0656f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840257, "uuid": "b012ea56-e9e0-465a-be49-6aef1f30b579", "value": "T16E05334EA18781CA02165CF6BEEE121EB2ED3FD487A4D0577EA39D19A9638CF471C710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840257, "uuid": "4fb35d69-722a-489a-8772-d139f944df24", "value": "24576:jht+/WwJgmaFuUj1uMJcN0YOMgOYRo7HfN5Q:jrcJdU5FaZ4Dw/NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840257, "uuid": "df2f1bbe-3bd2-41f9-bc36-4f89e472a9c2", "value": 812899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840257, "uuid": "08097b4d-362e-4762-a426-11d10f4f2868", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840257, "uuid": "8fa71728-5832-4b0a-88bd-aa4067e33fd9", "value": "PO#38595_1.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8609ad-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload (XWorm)", "timestamp": 1724818590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818590, "uuid": "c2d30617-a5ed-4cea-99ac-b387a404b631", "comment": "Malware payload (XWorm)", "value": "6039ec87674addc9bad5fefe8597e233", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818590, "uuid": "75513326-bbb2-4d65-b0bd-f53525df69a4", "comment": "Malware payload (XWorm)", "value": "383a710e98a950ff7ae8ececc1302972d8970aa1f44fe76a4340613316f0b2de", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818590, "uuid": "ff42632b-9452-4f86-a50c-3830806ade82", "comment": "Malware payload (XWorm)", "value": "70715cdb16e53e581e2a89b6dff56880951fde8f", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818590, "uuid": "f3e0591b-ef6e-43fa-be33-aacab148b211", "comment": "Malware payload (XWorm)", "value": "14e0cae705881b707915a46ed1ab4c96ce3a831cf4dd38bb44bd3451dc7c84025dc530f03dbbfc31ebd8d68c6803db20", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818590, "uuid": "d8308273-249a-4912-aac9-a02c6f2b63dc", "value": "T152E24B4477D48626DAEE6FF528F391011274D517C823EF6E0CE489DA2B67AC087407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818590, "uuid": "deb4363b-1dd5-4a7a-b493-77114cb3bf14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818590, "uuid": "da15eb8b-676a-4bd4-a9fc-4b8a07b2aa2e", "value": "768:4LUa+vNohsXn42JiB70OVF49joOaOjh9bu:4mvNohsn4WiR0EF49joOaOjj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818590, "uuid": "d0b9a9a2-829b-428b-9ab4-2b9e0d51848f", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818590, "uuid": "92bc3d2b-47c2-4178-b384-6f189902bbf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818590, "uuid": "a7f2ddd0-2f43-450b-a557-4508f2690422", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab2e0c8-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854932, "uuid": "5e4e712f-f63c-462c-abe7-3596013687b4", "comment": "Malware payload", "value": "289cd10e285b5bcfc772388300d36efe", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854932, "uuid": "58c0a39e-6fa7-4fa0-ab14-16fd044d37bb", "comment": "Malware payload", "value": "383e88368d22ea3759390ef1dc84a8bf15b1df66355ae652a587dbd0ca0a292a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854932, "uuid": "fbf0b94a-3661-4abe-b819-10db896db78b", "comment": "Malware payload", "value": "46c406c7530f843e6a12c379d32b1b250abd9692", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854932, "uuid": "cb721020-9953-436d-83d6-e1eae2b07325", "comment": "Malware payload", "value": "7c01dfa037b27e0e7d85bd33df047b2a37a6fc09f1bc44eb0683f1d0a05949e460a57d332850c6d4051d1aa636288f25", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854932, "uuid": "56efacdb-aa01-4a70-bb7d-b36edccf5db1", "value": "T1BB1833FB1C1973EC982CD2189B19876E45421051F652E91C0B8F6599ADE8FD2E3FC8B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854932, "uuid": "bef99202-cc60-410a-9fbd-e58b11e0f273", "value": "1572864:0qdmZOQ9lVR75hO1olKAmgj4+Y3HdpTXAaZWZN8GKfB2sIncG4v2T:0UmIMlVl54vrgm3dJUZN1qPa4vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854932, "uuid": "cb957d0d-3028-4b5c-8212-e7827c4117fb", "value": 86493316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854932, "uuid": "1ab373e0-75b7-40c7-a55b-9382f2e176f7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854932, "uuid": "870ab6a8-c7bf-4ead-9098-40209a56c72c", "value": "782b52989df334e5da6ceb048dde920b32a9ae43887516955eca21cded2a7108.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb93e4a-64f3-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Stealc)", "timestamp": 1724818428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818428, "uuid": "17d9ec40-164e-41d9-82ac-6f0743269906", "comment": "Malware payload (Stealc)", "value": "2c2051ebdb331b42e2ac0bbebb1f5de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818428, "uuid": "6d728473-1ae6-49f0-8d60-044a00196467", "comment": "Malware payload (Stealc)", "value": "3976d65e1c1de55198231e5a8fdf280f2a7d97da4717500cfbc7305f4e00fe0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818428, "uuid": "f8322d4f-ae73-4da9-a184-875a46d4e818", "comment": "Malware payload (Stealc)", "value": "98ea577e758d6ab876a7c36a95e28df68a6db98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818428, "uuid": "7f1ab090-e665-4fdb-810e-a49af767bfc7", "comment": "Malware payload (Stealc)", "value": "f9421b518444ea6113c5c10346570a8b5f2322a9419985173a59a9be220c96bdb09de698d47f7eb664446a0a939733a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818428, "uuid": "ad0bc946-57cf-4f09-b324-374b807bc1a5", "value": "T1568533C20805300FFF7582FBE1C142479B6CA159EADB22BB66DBF58EC41FB52549E14A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818428, "uuid": "0cab35c7-512c-42ca-bed6-b47824ca91f5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818428, "uuid": "f667722f-61b0-4b4d-9965-28ffdbd8c88d", "value": "49152:4q92yjiDKsgCjkfPGN++VxQJUJuyUSmmCFoAjsX:4qkOujkx+w+Ju4mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818428, "uuid": "e0613162-55ae-4b4a-a2d5-008d0ad9b205", "value": 1771520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818428, "uuid": "a9208b47-4b15-4d1c-9c39-3156c1e6375f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818428, "uuid": "df3d814d-f91d-4024-a483-a7878e0bdbc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9901074-6563-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724866499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866499, "uuid": "db42ad1a-8dc1-4efe-88ca-1977e74b96c0", "comment": "Malware payload", "value": "26517f51c9700a0b58f3aa16a8ac45b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866499, "uuid": "48d98607-0b4e-44b9-befa-9fadf42b805b", "comment": "Malware payload", "value": "3ada80cacda5e82adfe3bea72fcabf62e267700d846a7351913b18ac27c527d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866499, "uuid": "b5fc77a1-8c5b-445c-93ac-583cd427ce16", "comment": "Malware payload", "value": "72956b02bc4fa977854f7c2e0811d68dbf39bc2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866499, "uuid": "a098c19f-f987-4304-98f0-96d8afe9f01e", "comment": "Malware payload", "value": "3cae75ea436bf04d32812206f4a72ea69218cacea521f0a17eb2c17bc08e91038621c6e6104676663213e68812d049c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866499, "uuid": "1284ee5d-6938-4fa5-bbf6-a17f8e14c985", "value": "T16444C4006FF585A7F2BF3BBA94F412505F7DB512A56BE70E09B010F90D62790AE68363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866499, "uuid": "2b1bae1c-9726-4cc7-978a-fb39754de317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866499, "uuid": "847894a0-b063-42bb-8867-08faf06c23a5", "value": "3072:6UH7dML7j3BLsvlQfDgFN5gdN7/1EWCAQ0BZNqYNlVFs1R4B1s5PaqCE0ddmEvAI:6UH7dGzmGDCvgdp/UAQ0dqNXEEyS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724866499, "uuid": "ded772d2-b9f0-4c96-b0b4-981bbfa10da1", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724866499, "uuid": "acccd751-8be4-4af3-85a5-c4e237d071ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866499, "uuid": "c29ea086-dc9d-4318-89cc-c0ff62fd1438", "value": "SecuriteInfo.com.Win32.MalwareX-gen.1375.14180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a882aca0-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827762, "uuid": "f970d9ec-d5b7-4584-b47e-3933751c6ae2", "comment": "Malware payload", "value": "ad30340320a7af9f65509f9de8a1a27c", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827762, "uuid": "0e5605a6-13a5-4064-b109-be1e226a6a33", "comment": "Malware payload", "value": "3b411d0528f87859aaa3d3b981f4b1ebd6cc7c1d495ba77011cdde22baa0de94", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827762, "uuid": "9687cd0b-cf84-4900-be56-a5d6997e36ad", "comment": "Malware payload", "value": "860686f66ba20ab9c8af22ba6906767ac50a7fe2", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827762, "uuid": "bbef957f-e70f-4c6d-a64e-82f5647e0e51", "comment": "Malware payload", "value": "5e1c9034f1a9ec91022edf5443c47e93150f9f8b1664d215a75ef09a02651483951b18ad8f2c7039045251dcadf590de", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827762, "uuid": "72d679d7-8638-4af0-ba25-276d21e3eb28", "value": "T156B5E9036A8B4E75DDD23BB461CB633F9734ED30CA2A9B7FE609C43599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827762, "uuid": "190c6c17-09b0-4a1a-a910-939baed9326b", "value": "468e80a4a8ce4d6e9e8e29d85706b7f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827762, "uuid": "d55d0262-c04c-4a74-b6a1-56451424c4c3", "value": "24576:N++qcrT+Hm82z0LmlbKTXoMe+09vvc7081W+vqe7ZtFuQ5r3h3Yb:NIWKmGj1WHkZti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827762, "uuid": "4d27feca-8629-47a2-bcdd-bbbad5eeb9e0", "value": 2337354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827762, "uuid": "6d9ac559-e57a-4c5b-9a96-e9046a4d32fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827762, "uuid": "7eefc47c-a222-4196-8ad0-7059d871bedf", "value": "3b411d0528f87859aaa3d3b981f4b1ebd6cc7c1d495ba77011cdde22baa0de94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0399bf5-6580-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Vidar)", "timestamp": 1724878885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878885, "uuid": "330740fe-446f-4a9c-a24f-9d6fda9555d8", "comment": "Malware payload (Vidar)", "value": "8ae4605ae214af3ba375ad58263ca707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878885, "uuid": "8196d2c4-b38f-4dba-b864-9f41a91b4637", "comment": "Malware payload (Vidar)", "value": "3b434c699bd12fe3d7cadf72b13a935b1c9c097064e0a72d2ce6729bef59c4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878885, "uuid": "c7ac9f82-be45-4059-8e86-090758b9c7a1", "comment": "Malware payload (Vidar)", "value": "483c4442d923c66ac17a479667dd105a928c9c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878885, "uuid": "dac187f4-9a45-4efe-b65e-e23acbbe130d", "comment": "Malware payload (Vidar)", "value": "726714b8663165775a66b976c9c86ca51ff6e5b2206626d36effb857ac60e629fe5633c8019070a642ac76428abfc330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878885, "uuid": "c8ce0ea3-1f36-407e-95d2-0a48cc1455a0", "value": "T1C114125B03F86025DF1BF831AD4AE52AAA74C5F736D2434638ACDFA5B7813B02B5C149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878885, "uuid": "531475ab-c0dc-4003-8192-30ae97f74264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878885, "uuid": "c40937ef-72e3-4c71-a15b-457d63539e3e", "value": "3072:xzGDr6OuWXicgg9VVdrxF/C2730oedT16M0R905WZXyhwVSwG/RtD1x8a111g675:xzGDYWScj7zF/C27oT+WWo5fIaT1f7jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724878885, "uuid": "6cb5e1da-9442-4d0b-9b5e-6a346d80ab08", "value": 196136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724878885, "uuid": "191c4e3f-d757-420d-8417-58730317fd95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878885, "uuid": "c8f922e9-22f0-4bc1-9417-69752a2eef5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cae09b7-656a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724869323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869323, "uuid": "180fd284-1c48-4674-a1ee-994798952936", "comment": "Malware payload", "value": "4ed57d9e22394dbc124e2b50537a2b18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869323, "uuid": "892005c7-0970-4705-b164-8fee0d9ad48c", "comment": "Malware payload", "value": "3b7678d39d5a774c59d1ec1eaa9be08c17a7515199510c839ce4dc1d02afe911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869323, "uuid": "dad1427e-380a-4447-9631-e62f17e5308b", "comment": "Malware payload", "value": "b59f77d33e2645f59129ccad7e8da2d6af79c3eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869323, "uuid": "76dab134-6111-4fbd-9082-be84d1ecf877", "comment": "Malware payload", "value": "4dd8df9b7e19e169533488d0b121cee4ea62d049242643921b2a0ec60018cfb6e04f2eb223585f082a36c1de5b023af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869323, "uuid": "311a859f-f6e3-4c3d-b8c6-417b224c40b7", "value": "T181473351B9F2D2E0CBC74D606A8655C936D155DEC1EE632E22C98C0339B0F7B4989EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869323, "uuid": "a86e9f35-5b5f-4f43-8998-37c5d7830147", "value": "216f2c9c6182b928443399a24f957a79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869323, "uuid": "b7b7bd32-6a80-486f-83a9-767d6f62e32c", "value": "393216:fOn42ieA+cqm0MKwnjfX95l8xIHiCj7v5se7wA9EnFPDZnbQs3idXRAv:fOn42ieTcqm0MxnLzp0PFb6Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724869323, "uuid": "b60d3246-ebaa-4bb9-bdd0-afb8bb5b7010", "value": 26290176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724869323, "uuid": "6d285f9c-d0a8-480e-9156-511711c49e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869323, "uuid": "ea9d689a-3867-452e-8470-913e6e2308cc", "value": "SecuriteInfo.com.W64.ABRisk.KSAB-7665.26815.23633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7525bb33-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846144, "uuid": "b85fda6a-1856-4f0d-8a84-1c259aabd511", "comment": "Malware payload", "value": "efadb006e9fd7d8782e43bef2b67433d", "object_relation": "md5", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846144, "uuid": "28d49161-4de1-4c67-b23f-5e4ab3303f93", "comment": "Malware payload", "value": "3c1aed8d9962dda98e0f08ce8ec2d42b0817c1dfd173d1e70e2f09ec8da4f7c5", "object_relation": "sha256", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846144, "uuid": "75b2f661-5c34-4243-a734-e841a2150574", "comment": "Malware payload", "value": "9480bd0be6c5b3251e311b1b5984089f2eb0eac2", "object_relation": "sha1", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846144, "uuid": "ecf9d04a-23e2-4a2a-9893-8fe11976eb2a", "comment": "Malware payload", "value": "860500e0b089d65cdfca938dd84bbdae46f0aa3457e176449368978fac916c14056746a3f1dba35b040f0940d28b7a65", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846144, "uuid": "692cfe5e-968b-4eb4-b9b6-00fb8b4bb1f2", "value": "T156E73361B18B8116FA7D5176A93AEF6F44BE7F73033040E737A4BA1A09F98D061B6503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846144, "uuid": "249f8817-33b0-4a7a-ba00-7bf60abf4639", "value": "1572864:zbvXF+e76KJ9I4OzKvmTq4aMh6zGORvApErPLpcNRc3xBKHR:3P5J9I9GWhC7vApEXNCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846144, "uuid": "da740e0b-a3a6-4dee-b34b-d64a99eb0a92", "value": 67692544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846144, "uuid": "43079486-aaef-4edb-b25c-cef0cbbe980a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846144, "uuid": "0604a42f-a614-459e-83a7-5d5b432b1454", "value": "CTGZXFCD179480408.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9cd1bc-6538-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724847956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724847956, "uuid": "1f8db78e-f06e-4fe9-80ec-221f14d96668", "comment": "Malware payload", "value": "7cc9e26ea1d1d210b0743a04f635f3e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724847956, "uuid": "27f6567c-076a-436b-9295-800c2f2d6455", "comment": "Malware payload", "value": "3d0c2597a61bef53c2468c53ff641eea3faa4ec908ed7402573d74b1f8f79464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724847956, "uuid": "c2335a4e-6831-4e3b-80ca-5c05216059ec", "comment": "Malware payload", "value": "900eac1771403ec7e52613f174280c0d407dca37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724847956, "uuid": "41094928-4956-4bff-b8e6-5ca260d7d871", "comment": "Malware payload", "value": "afc02ac600d166bb705a1ab1a4525f6ef3ab2081c335cd11b1e38e1e089cb4573bfee31b6978a7dcb2fc52e96b5c3120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724847956, "uuid": "7dca2354-061a-4edf-9d2f-4b87f7ddc053", "value": "T144F401982A15EA02C5A443B90EB1F2B0177C1EEEE802D7578FEA9DEF7926F455C441C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724847956, "uuid": "dac4d067-8d9e-4fc3-8c21-2efbd1aa352d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724847956, "uuid": "c5ce76ea-8e06-421a-a9f3-8653087a73f0", "value": "12288:6Wg8P98FAb0eZaY+OGPIKOAHLoXmdExbTfwPKrjiMNyUi6rM0Urcz0zERaYjXfI:6+18Qvo5PIKO4oXzBzXk0Urcz0zEzjPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724847956, "uuid": "fe95c979-3a21-4bf0-945c-15135c2460f0", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724847956, "uuid": "ae3d5e60-dd68-486c-9904-7950cce87114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724847956, "uuid": "86c891f3-3be9-4052-b128-4d1c35e247b2", "value": "18__ e_t___s\u00b5__ 2,6_ G___F____ _._.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939118f6-6527-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724840612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840612, "uuid": "eb7b08c1-1ebf-4267-b6d2-21da452d083d", "comment": "Malware payload", "value": "439d5a4d54504632d364f1ee9e8acd43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840612, "uuid": "d87bdcbc-9874-4ceb-bbcc-c3ee8d21a4cc", "comment": "Malware payload", "value": "3db983f5bbefb35bdcda7168bd4c17b5d2766a2997c1e67941a8244bc8399b94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840612, "uuid": "67e117dd-635e-4c75-9d6f-41e44e323c8d", "comment": "Malware payload", "value": "827de52f9fe961dc531f0688ca3cf15ba7ac8625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840612, "uuid": "71064d02-32fc-4240-9a7e-3b0e8b9bc8c1", "comment": "Malware payload", "value": "0e4a4ca044d0a1f5d089da20584d9ddf7870277a9cd142fe06be7ced7ff3cd7585b0b926226d71fd1a0e83ec18a84443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840612, "uuid": "d0d29547-217c-47b3-a2a0-62885f176683", "value": "T1B0654BA5E2E14433C92505FFB887A390761F7B519A1D54C2B6BE2B781E35EC82801FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840612, "uuid": "5d826d86-7488-4d8a-a5c4-3580edc8d44e", "value": "0de255985d7b32e559f7b245e58a691a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840612, "uuid": "96cfb76a-bb5a-480f-814b-5a1f6e2139ea", "value": "24576:9PV6rANTFY+l/yKJc6qfQh6AMskY/m2AIvO4+UVBAlUz:92A5zqfQh6ApqI/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840612, "uuid": "91d8012c-33d0-4d54-a1ae-07801f38491c", "value": 1544192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840612, "uuid": "85f15d85-7fbb-4d1f-a7b7-2b0e44e7ce51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840612, "uuid": "e63e6de8-89fa-4a90-8aa5-a0bd6dde9dd1", "value": "709876765465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76237e6a-652a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724841851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841851, "uuid": "e35b602f-5d75-4b67-8023-ed4d9d6362b4", "comment": "Malware payload", "value": "bc3b4377a7f4dded755f48d376c0c173", "object_relation": "md5", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841851, "uuid": "c3bd41f8-70c7-44a1-858d-8895573157ea", "comment": "Malware payload", "value": "3e5547790a7148b99733c94dbe1b690eb13dace3d9fdc0298db7eaa2c5fd3b88", "object_relation": "sha256", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841851, "uuid": "080472be-9028-4135-84ee-fbf0de836dcf", "comment": "Malware payload", "value": "2204754e4ff58fb666c8c9ff2bbe7208e83b72f4", "object_relation": "sha1", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841851, "uuid": "82a4b664-7b1f-4fbb-839f-b507189e45ba", "comment": "Malware payload", "value": "f0d2d9da99ff592d5c82cd2a91b1bdcfc9e0d8adecdd55cf7a50959a33a60270e0dbc60f5aef8547463cc8c4ed6b0482", "object_relation": "sha3-384", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841851, "uuid": "b80820b2-2a0c-42e0-b7a6-883ae2d78a1f", "value": "T1B1E55BD504553C9DD0C7A5BEB43A958AC1CA1DAC040EA3ABC3C4F36CF5BA8E616FB509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841851, "uuid": "9fc31902-b788-467f-aa35-ae6407e42bc7", "value": "503e5b28a848f841a1d6f249a5154b23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841851, "uuid": "b02ccd49-032a-4d59-a8bd-e90f0f03864f", "value": "49152:T22Td5mKnwQY0j4NR3J7kgi0nVIJowqNNoJRfJ8M8Hxhcx1fkt3Xb34k0MJOTIRt:/IKnwQ7j2Regi0nVIJowqNNop8M8HofS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841851, "uuid": "8d9e5775-5830-4d9f-8255-7d8da5934f34", "value": 3078408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841851, "uuid": "e8606aa6-3c96-43c9-96f4-7866c0d4c400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841851, "uuid": "6b7b4b40-e051-4f53-89af-f5f6d548943b", "value": "3e5547790a7148b99733c94dbe1b690eb13dace3d9fdc0298db7eaa2c5fd3b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed453693-64ee-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724816281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724816281, "uuid": "153165ec-44f1-4d1f-a1b1-ba102f6d1521", "comment": "Malware payload (Formbook)", "value": "446d34efa459afa72069623736d2900e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724816281, "uuid": "bfc5431c-f48c-454f-bcd0-8ec1fd126aeb", "comment": "Malware payload (Formbook)", "value": "3f0555b9500f604e6f9ef5fe05681e823ea2a107ee74cd284c2c8f5d790616d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724816281, "uuid": "7ad0c1f2-f699-4b6e-93f1-03b75633348f", "comment": "Malware payload (Formbook)", "value": "d0a707bbd96bfe952514f11844ba756b548d75f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724816281, "uuid": "01e7a56d-6447-47dd-a7f9-7d8e8b0ad89f", "comment": "Malware payload (Formbook)", "value": "eaf74ac5fa10ed36b8c3a8594ed749b71271ae62cf1b2ca1a0445a1efccaceebc86cae2af6b9bcf909ec679f957d090e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724816281, "uuid": "27223305-0fd7-4b7a-a508-3373a3977475", "value": "T1C4D4ADACF86160DCCA56CFB7E8E1D7BF74870C20BF004825A74A754A17B51FB605AD2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724816281, "uuid": "de406c08-9610-4556-86d9-10a74cc7da87", "value": "dd68e663380c71f66b512f005f1be7ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724816281, "uuid": "16c414c2-6e2f-499e-81f8-28622c7659d6", "value": "12288:kMBIHm4pmHGqQz1lsMd5tnPNuZJj03rG/03CG8twko:kMBgTpkEjsC5hFGO0aC7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724816281, "uuid": "5f5940f9-19b5-4610-bf8e-4409e0961028", "value": 615829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724816281, "uuid": "0020e568-faa4-458b-82ea-b37e91532acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724816281, "uuid": "0ac6c3d0-1c57-4f0a-a005-795ab8a9641e", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e6705a-650f-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724830340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830340, "uuid": "e195a5fe-a654-4ab6-8445-9f088b2fd330", "comment": "Malware payload", "value": "c92c6d010f5b5c3493e2f865c84dbde3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830340, "uuid": "eecf1194-4d83-4bb7-98bb-923750d2ff2a", "comment": "Malware payload", "value": "403f9f6e2a6fac0e76badf90667cfb23c822f6da87e8fda52554b0349e27c19e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830340, "uuid": "54087df0-73a4-445e-8358-86bbad2cbd7b", "comment": "Malware payload", "value": "eff67777be7a259e41f076f3fb26c3cd6cd10df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830340, "uuid": "8ed612fd-09ee-4eb8-b4d5-3f6138480922", "comment": "Malware payload", "value": "7d6199872c37f1c0dab98bd772d10808cfaff1af8debb70df8f7504926934a18306130f019be333e5bb3edcc3100b869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830340, "uuid": "b04485be-8fe7-4d81-a23d-b0df6a86f5cc", "value": "T10557339B99ECCA3BD395147064C76CAF42A7F7CA5D52CC07C9E6A15F220C336293C662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830340, "uuid": "f6036998-50d0-4110-acc0-300713ef5230", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830340, "uuid": "aaf99cc8-1482-4eb3-aad6-fa69b3046d4d", "value": "786432:+Y4v3ICUsQrkzbCM2eVh5MUTEE5f+vFGJJSIfnOXYaqd3:mv3QsQkzbpyEXksnSIGoaI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830340, "uuid": "acbacc4b-9bd5-4144-94dc-e225c905edc7", "value": 28134851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830340, "uuid": "a9e893f4-bccd-4d96-a4bc-72a8499daf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830340, "uuid": "30f73400-f765-423e-8232-f93fc54e8bc5", "value": "SecuriteInfo.com.FileRepMalware.835.16222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8796a93-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840244, "uuid": "707e100c-c181-4c5a-b89f-0359ac48fc11", "comment": "Malware payload (Formbook)", "value": "f7a4c5c83c6cec59cc96222b6ded8198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840244, "uuid": "726a822c-eb19-4339-b44f-ae1e4839cff5", "comment": "Malware payload (Formbook)", "value": "404b5782728673052607ae3e7ede250acf4e7049f34508f31d5c11bed80c3ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840244, "uuid": "5bce503e-5e11-4c28-9433-d41e956f2960", "comment": "Malware payload (Formbook)", "value": "474f23a7127790f3eccbb06c0b36bfaed37d225c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840244, "uuid": "68fa2f08-f108-481f-805c-4e9787ce70d7", "comment": "Malware payload (Formbook)", "value": "de8caab153063be62ac9fd7929f04f32b894fe5f054ef81fb56ca982bccff0453f05d5098282baf02300370e0534072f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840244, "uuid": "2abd8083-cd61-4fa6-bf32-c684bc3b0f5c", "value": "T11945C00273C1D062FF9B92734B5AF6115ABC79260123EA1F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840244, "uuid": "db3f3a66-10a6-41b9-8df6-b3637272a052", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840244, "uuid": "f40e846e-18ef-4ee1-919f-c68975dcfb8e", "value": "24576:PqDEvCTbMWu7rQYlBQcBiT6rprG8aFl1+ITVDgdgT:PTvC/MTQYxsWR7aF3+KWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840244, "uuid": "800d19cc-20b9-46e9-b8e7-0dc41980c477", "value": 1269760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840244, "uuid": "cdc2a65f-38ae-497d-822a-566ddcc9d0fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840244, "uuid": "53682b5b-a9da-4e45-ae46-3924c46de500", "value": "COMMERCAIL INVOICE AND AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df7485d-64f2-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724817625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817625, "uuid": "4d875839-eb22-43e6-a7a9-9ee299d15b47", "comment": "Malware payload", "value": "014263ff8146add2d7c8df55bfbd5123", "object_relation": "md5", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817625, "uuid": "b9a76a3c-bae7-4e0c-932d-de4461f5b19a", "comment": "Malware payload", "value": "404cfad4dd215dd858029e635f0d0a95ff53bf92bc8ccdf30d748f43d1013ae5", "object_relation": "sha256", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817625, "uuid": "10cbbaf3-93de-4050-989e-b977cb53a5cd", "comment": "Malware payload", "value": "d7e7f23dbc5016f5dfe7b3a8eac6eaef3bb77241", "object_relation": "sha1", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817625, "uuid": "7676d7ae-de65-4253-b94b-d9aaa319d9e1", "comment": "Malware payload", "value": "5eb93e4515ac88c7342922275f39271e25c7d4facc2a23ea977a1458570e841349ecf09dc9a348e38eb4185e5eaccdb5", "object_relation": "sha3-384", "Tag": [ { "name": "Barys", "colour": "#D49C03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817625, "uuid": "6614d922-5278-41ef-b9b0-caa31c69133c", "value": "T1F7D40461659CA61BE6B3BFE7EE909DA10ECFAAB739740285F5440F41C027CA7DC60C61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817625, "uuid": "7c145765-7145-488e-836f-feeda8322b0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817625, "uuid": "577f69ab-7afa-472a-8d29-02fd2809e497", "value": "6144:BuIapaJwpz1NUXnDGgm5GbJQEKnEYVnddDu+5+wOJlUFYjaLMIpv3ix5Ijy97S2Z:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724817625, "uuid": "d8024372-fec7-46e6-8e19-467a392a29eb", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724817625, "uuid": "06de29d0-c8ed-4657-89ac-468c4f3bb662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817625, "uuid": "635699f9-8c3e-4433-bdb0-4d4b4437c59f", "value": "x1061y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37b117e-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822654, "uuid": "5237e0f2-2b40-4d3d-8efa-76f432eaef8f", "comment": "Malware payload (Mirai)", "value": "ef72a54b98018fdb577719133963fbb3", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822654, "uuid": "814cdac0-517b-45dc-a1fe-d88ce224aa09", "comment": "Malware payload (Mirai)", "value": "417097e44fb95afbd1a84114602e41e95a306685062f68a4061bf402c4b362de", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822654, "uuid": "fa991cf2-5c0a-4730-b604-21f2af835ef0", "comment": "Malware payload (Mirai)", "value": "b4948bacba5a041f49113a7a4075ca183f5ab9fe", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822654, "uuid": "12b5531d-6327-4c7c-91f4-59ded899ca83", "comment": "Malware payload (Mirai)", "value": "2dbd1568827ab03efe213b0c10022c9458b5e20dae7a07cc7c6c6806b3008f454de9adbc8d3547f9ae046bafd6ead3e3", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822654, "uuid": "ba6df0e5-3b01-47a8-a806-368a6fc5c76a", "value": "T199F43A1773E1E87CD18AC0795A9F8771D6E9F0B2152B787B7F96EA303D18C411B0922A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822654, "uuid": "96a859ea-fb2b-48c1-ab82-9244a28480e5", "value": "12288:Ii2L9Gd0cYfOJ4phmelyEUf4SeG03qnsCdC4CyizH3aFRGByJ8YEqJP90ybu8+5U:Ii2LAYfOJ4phmelyEUf4S10ansCdC4Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822654, "uuid": "32b7788f-a7f2-42b1-837e-435bb1770d07", "value": 758120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822654, "uuid": "22937aea-78f7-4c8f-addc-a7a6d363ac37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822654, "uuid": "047571ea-29de-477f-8be1-cf0132e09256", "value": "criptonize.bsdamd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9312fa45-6545-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724853496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853496, "uuid": "d1fc3071-42d6-4706-bfeb-2bf7e586ff26", "comment": "Malware payload", "value": "45d4f2ba51452d796a806ca3d4d0c8d5", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853496, "uuid": "41cb5f40-4786-4ae3-8cc6-1d4bb73ba011", "comment": "Malware payload", "value": "43193c3513dc175db234df156acb6df5588bb2380f19eb1362069bbb0fe256d0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853496, "uuid": "c4b107db-d064-4533-b579-c62f67fe5b78", "comment": "Malware payload", "value": "856a8c531b7d6ace4fef9b6ee0d8f554b0b591ab", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853496, "uuid": "02cf002f-9860-4364-9067-ab08ac21a615", "comment": "Malware payload", "value": "0eef5910c042a5060edaead1894506ff8370395c31763b98ed7ce5e70b58183ec75f666c4b4ff9a0b19d93fb662bc730", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853496, "uuid": "45b6cc5f-ca78-4d70-8ac6-9cb3d39a087b", "value": "T12FD2CF78DC169848C37A753DC04F18D7B20DE88192E6990F3858EEDD17C1A8FCB5B69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853496, "uuid": "ccdf6f3d-062b-4b45-93f8-3ab882620ada", "value": "768:6E/MeNsu+9pPJ7y3rr3ZML5f+Ja5H7GPQQ87:6EEMVmFJ2rZML9nJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724853496, "uuid": "4705a6ad-3ba9-4f49-91a6-7b903cead273", "value": 30341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724853496, "uuid": "4f9c06a8-3dae-460d-8b69-21a717f547a8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853496, "uuid": "507383a3-a926-42ea-bdcf-ad868dce5dd7", "value": "Alchemy_Monthy_Returns_Inception_-_July_2024.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b34f38f-64fb-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724821485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821485, "uuid": "da19a597-6e22-40c5-a70f-d8876ccde78b", "comment": "Malware payload", "value": "9482d7b91ae2c431e8e584cee62ac3e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sedexp", "colour": "#CBD458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821485, "uuid": "d6f67831-291e-4af5-b22b-654ca679b4b0", "comment": "Malware payload", "value": "43f72f4cdab8ed40b2f913be4a55b17e7fd8a7946a636adb4452f685c1ffea02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sedexp", "colour": "#CBD458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821485, "uuid": "4ce626c1-f70a-4d2c-973d-dbe4782ae44b", "comment": "Malware payload", "value": "e8530cf5652d35148b2fa6f963387d8f21c2ee52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sedexp", "colour": "#CBD458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821485, "uuid": "0a061464-f47c-40e3-aa7d-c009f6d5e4d7", "comment": "Malware payload", "value": "1cd1c8fb0ffec7f2bc2b583f72bde7de664cc7c479862de91bb8087f94353cfed27ba992aefbd1bde0d217b7305b5972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sedexp", "colour": "#CBD458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821485, "uuid": "9226bff2-04aa-4a54-9315-5d6453ce803a", "value": "T11424B521C4E341EBEAFBE2334B8B792B7D223559C5309B1BE65453121B35A38AD7D390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821485, "uuid": "fccc9c30-88c8-4eaf-8c2b-c5e0582851a1", "value": "3072:LRfZJgy8WKR0HdxiJw39vCcaA4itvVJ3vZylta9tAuyXnrgp1jjY/ztwpx8sUT/z:tCtI91r1crRYO12OTBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724821485, "uuid": "ca88b9df-d3e8-494b-8893-542e2ee261bb", "value": 214456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724821485, "uuid": "3586c56e-a304-4356-b4fc-fc8dac56f9c2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821485, "uuid": "21ee462c-504a-498e-bf1f-d03e91d65975", "value": "43f72f4cdab8ed40b2f913be4a55b17e7fd8a7946a636adb4452f685c1ffea02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538d18a6-651d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724836210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836210, "uuid": "2e71d9ea-e294-4b1e-b7f9-95ba17441069", "comment": "Malware payload", "value": "f7ad8585ed9a9b46b3a98a64a7780dc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836210, "uuid": "3e8ad4b8-a5a3-423b-87af-06d13eba9705", "comment": "Malware payload", "value": "44599cd8d329c27e18e5600cf2ce0dc1a8ebe8be976337eea0070be0995fa40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836210, "uuid": "37fe80d5-108d-450e-82c4-2ec1629ff97b", "comment": "Malware payload", "value": "0974f543632bbb15787590bba20a2259a02f6a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836210, "uuid": "a2686656-79aa-4092-a4e8-c21fb9fa45cb", "comment": "Malware payload", "value": "62624aa3261edb2081383169b5f54f4f54f98eae9c020ffaac3abb12c476d56d1f702959c702f1d042ead3ad197b7eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836210, "uuid": "f6a9e2aa-6b9a-4573-a828-2e545850459b", "value": "T1DAC64B90FAC719F6D8435479849F626F17349D0ACB39C787EA447E69E8372D22C33289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836210, "uuid": "d3c091a4-8e6b-4403-ae91-0314369badee", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836210, "uuid": "de8c6783-c491-436c-ae04-da5fb897c2d0", "value": "98304:JeBSce1n5NQXme4wPL9jIGkh8dJkkU71B:CUl4u71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724836210, "uuid": "f528cda4-ec82-4f10-aca2-606d797ef505", "value": 11890176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724836210, "uuid": "acbda7e4-e2fe-4419-8bef-f2b5e839d9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836210, "uuid": "b68b64fb-817a-49d1-95e4-ff52ba3d70c4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484bf261-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724827171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827171, "uuid": "4d2988f9-ea21-44e0-bbf8-9a4255f4b163", "comment": "Malware payload (Formbook)", "value": "ca61ca8c6b0cb6021c8bede9a65bd062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827171, "uuid": "e438750f-beca-4392-a559-58ef189f7384", "comment": "Malware payload (Formbook)", "value": "44967f8ecdfe8a37ec62ac17d72cc93976a2909be95e013426594a6695be9bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827171, "uuid": "4fe7a173-a37c-479b-ad5f-887ac86f777e", "comment": "Malware payload (Formbook)", "value": "6a5b52ccbed4523b80325dd44d4e93db5a883539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827171, "uuid": "62c0f9e8-c80c-4e11-9af7-59c38786d161", "comment": "Malware payload (Formbook)", "value": "81e0e6c180289870a4daa038129870a099f396eeee65e6250c097f444098d69d9a10d9653a7ddbce2279bf99910c7422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827171, "uuid": "fbb6e2fb-68db-4526-a049-d19ea5904aca", "value": "T19D45CF0273D1C062FF9B92334B5AF65157BC6A260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827171, "uuid": "72edd96c-5383-4d50-bea7-0c9c36186c23", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827171, "uuid": "fd9465f8-61ac-45ac-ba2a-3b3ac62ea8ae", "value": "24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8ao6skTKocV1KYMAj6d/QAq:JTvC/MTQYxsWR7ao6b8PFhjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827171, "uuid": "2036beaa-2ef6-4615-8601-a87a25fdd292", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827171, "uuid": "5a5a5c1c-176e-4066-ab40-052d507dd6e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827171, "uuid": "1b49a702-46ff-484b-8ba1-111f76c5498d", "value": "DN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d1624d-6510-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724830818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830818, "uuid": "97d3629a-aede-477a-8a41-0703078baee3", "comment": "Malware payload (DCRat)", "value": "5ff0cc76b0a007e57397479e5fe854b6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830818, "uuid": "d2f1b324-7145-461e-9446-912048c1d018", "comment": "Malware payload (DCRat)", "value": "4680e30e6308e3de983503541f05f158fe6bcaf71bdf6462959999f1aa7fd3f4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830818, "uuid": "2dcaa681-2a94-44ce-ade5-0604baff42b0", "comment": "Malware payload (DCRat)", "value": "2da3ca539f2a69cb44b5be7118ed4b5d463960a5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830818, "uuid": "038cfb61-730c-4da0-88b6-c5cbdba76eb5", "comment": "Malware payload (DCRat)", "value": "369bcf8d638a22ec7cbb03eb2f62681a596e33c75c9e766aa6a5314179b99e9eeb4de2c63edce7d98a888ca5e5f1e8fe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830818, "uuid": "1a4601c2-50c3-4c4a-a504-78f1272614fe", "value": "T12595AF16EDB28E32C2957F3584DB142E52E1C726B912EF0B762F10D1AC15136EE8B1F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830818, "uuid": "71a14a9e-3399-415d-a8e4-01ce7768e5e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830818, "uuid": "1fbb924b-49f5-4254-9331-bc228cbb295c", "value": "49152:Xcql3qzKdi2mcnaKgkxueaRFuNZWYUshMtQd:XcqlO2mRKg+mwhhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830818, "uuid": "b208d66f-c8a0-4f64-94bb-f9e044494560", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830818, "uuid": "7d6af913-b3c3-4c0a-ae97-dcaba8be88e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830818, "uuid": "d3c7382a-377b-4879-b302-dcb0c8a51c62", "value": "5FF0CC76B0A007E57397479E5FE854B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff65cd4-6587-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724881918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881918, "uuid": "f402ff43-8044-4fe0-bfaf-63c009524d60", "comment": "Malware payload", "value": "a64e374945845aaec6ad063e8be450db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881918, "uuid": "63f26dd2-9d76-4619-a400-8093258dfa9c", "comment": "Malware payload", "value": "46d0413084564b4de78218ab73cac481743d6c5756b13fd4ffec7c897b8f75d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881918, "uuid": "1ae6d62f-48b5-4a3c-8e79-4cc70f687b55", "comment": "Malware payload", "value": "765c30dcfe127cb9c7c246ffa5ebb35040e1ee82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881918, "uuid": "2e8f8a87-1f78-4a22-a258-2bb269138e4a", "comment": "Malware payload", "value": "35af02d5b3a1060886e51bccbe4d73e088a5972249c92f0b095acf94237513af2f83381374428bf66ece426f8498c99c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881918, "uuid": "c7c379e9-4712-4839-80db-5f8208c5791c", "value": "T1B50633CE73DFE85CEC54397292FBCA5C52A87E0D651123EC80BEB02184B6985E6D09DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881918, "uuid": "3d246118-9536-4837-8a1b-0a70bfcf1142", "value": "8367c1e56060d6b1b2715e99ca951476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881918, "uuid": "750d7f2b-9e00-40bb-b6d7-83a78f62dc43", "value": "98304:HkpOWMJrMHGo5Bp+6IOYMCT2oOB9sQJ7OW24JRTlnm:EPMJ4Hj+IYMK2zB9tJ712yRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724881918, "uuid": "b83c520e-b7d3-4a78-a3b1-fb242c0bdf82", "value": 3982360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724881918, "uuid": "7bcbfff3-faad-4139-8626-a8b7c94d0a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881918, "uuid": "cf56402b-bbbe-44af-b687-4b6f29c474c0", "value": "3645-onekey-ghost_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1222af0a-651e-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724836529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836529, "uuid": "f27764ff-9582-4827-ab1e-91baf4a32213", "comment": "Malware payload (RedLineStealer)", "value": "1714616095f0d3f62aac384222620ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836529, "uuid": "4682ae38-5e34-400b-9cfd-4c4de3bc0bd0", "comment": "Malware payload (RedLineStealer)", "value": "4788d6606f23c828bbaaad8f8d3418fa86d704fc35aabebd48db7de370fb0f3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836529, "uuid": "d74ca6e5-3b75-4a2f-acd2-71ba7ee0106d", "comment": "Malware payload (RedLineStealer)", "value": "31412d21c22f20efa0f5f57b45842d1df6db0c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836529, "uuid": "1eb94db1-f525-4f13-ade7-02bf6755d642", "comment": "Malware payload (RedLineStealer)", "value": "4cb3f09f5f75ca89898cc236c7d0a791e2a3d87660c9bb4ad0cfc1624018511739d28cf52c072e31fe76ef702d68917e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836529, "uuid": "809b0749-f800-4461-a3f6-349a00ee6f35", "value": "T1CEE481DD365072DFC85BC8728AA81D64FB6078BB471F9203A0671AED9A4D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836529, "uuid": "d6dc3cb9-06ab-4b62-b48f-54db6425a746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836529, "uuid": "3148fd41-27ee-4d98-82e8-ecac10d07ae2", "value": "12288:n6CpQpr4Aqyt0MbXYgDq+qh58WcYrFmYqMdCN1VXmdWnSRv/MEkqI9zDVATDNTkT:nHpCr4Ryt9S+qRcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724836529, "uuid": "6e6a7bad-e521-4bb1-97b4-55528ca16884", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724836529, "uuid": "29f81791-33a3-45bd-876e-72fa8a132b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836529, "uuid": "7a40da84-3215-460c-a979-65823298fbf4", "value": "SharkHCShark.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52af4f07-64f9-11ef-b7c0-42010a9c0002", "comment": "Malware payload (GuLoader)", "timestamp": 1724820746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820746, "uuid": "31470222-bef8-44e3-ada9-cf09c0db438f", "comment": "Malware payload (GuLoader)", "value": "af84a827601b117c89f0fe2a30604669", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820746, "uuid": "efccb26d-31c3-4d92-b911-289f72f56a6e", "comment": "Malware payload (GuLoader)", "value": "48c37299c9515e8cf91ff1faa09135014ae7303a88aea29e1d2298398200617f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820746, "uuid": "44dd291e-e6a6-418f-ac5d-cb0b809e0856", "comment": "Malware payload (GuLoader)", "value": "6844a66c86b23a67429aee33094ba33bc9c61fe6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820746, "uuid": "814fb17b-f3fb-44cb-ac8e-9a03b83a1ba8", "comment": "Malware payload (GuLoader)", "value": "de8349dfcea0f33ad21b9a617bc6e071c37f56c2fa11fb030a8805d567ad2b9bdb768100ef5e8031b211394fab324c91", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820746, "uuid": "2b92a7bb-feb4-4e84-849d-4c2de20faed6", "value": "T100337CC27ACD1B13218CFDFEE646CDA958F34C652A0D95B5365CACE700322BC751A1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820746, "uuid": "c56d9ced-6149-4094-89bd-88bf89fbed82", "value": "384:3TZMJWa0ExTcydcXtfKUg9EHfHAWcaaySJTFpuIDoGWKj0vfyFkMAqfhCDnXSP3D:Daj0ExAVg9KTwRubhwkAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820746, "uuid": "964c5ae2-21e7-49e8-b70b-21c801c8450f", "value": 51026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820746, "uuid": "40c81687-0973-45a2-81f3-94b7261d593b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820746, "uuid": "4929c57b-8993-4d73-b91a-c46890aaef4e", "value": "INVOICE_DF76K.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b7953f-6574-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724873772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873772, "uuid": "df54ddbf-6afb-40cd-906b-a278639ec47d", "comment": "Malware payload", "value": "cacfd0e2d423ae0f7ad637c971bd591d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873772, "uuid": "71b61933-970e-43a4-ad17-1afc0baffc2b", "comment": "Malware payload", "value": "491f7eb35995a90505019c995e9bcd29d75167f8770e74747893807f420b107e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873772, "uuid": "1cd0735b-0dcf-4990-a448-2469f7fcc152", "comment": "Malware payload", "value": "c98f4026b1bb1df65ebcdbbe74e37f8138f6efe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873772, "uuid": "398f690e-5a21-4436-8017-e28ef737b622", "comment": "Malware payload", "value": "6d9bed32a17735601f799942136d7336586931ab93e19d9545df1187a1d583abed2b5a6676d24536116a3bfe0d013f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873772, "uuid": "c863a68b-a7ac-4781-b075-852da2d157f5", "value": "T132158C0273D1C036FFAB92739B6AB24556BC79254133852F13982DB9BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873772, "uuid": "b5d10b13-69a1-4b0f-afe0-f54046c1b602", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873772, "uuid": "2fb1092a-911f-49a3-9d52-86689f05ce5d", "value": "24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5J:gh+ZkldoPK8YaKGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724873772, "uuid": "b8b51e5b-0fe2-412f-a0c4-f66264d37a9b", "value": 926328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724873772, "uuid": "1cd4005d-f8c3-4797-a37d-4760c6d8eef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873772, "uuid": "a88e30db-a8c3-4163-a710-8257da742795", "value": "IEXPLORE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc5fdd2-6572-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724872945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872945, "uuid": "4a5e34ae-81f5-4e94-be98-7e4f39f7395d", "comment": "Malware payload", "value": "fade052d4e356eed118f3d575d06aa6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872945, "uuid": "74d76c3a-92e7-46eb-a2db-ac7a55881916", "comment": "Malware payload", "value": "49b289182777d283c1c69a58f7f4ad7efb38bd1926dfe266e175eb4bda1505be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872945, "uuid": "2e5b311b-8f42-4020-bf18-db055c5080a6", "comment": "Malware payload", "value": "3e187ef77ca255696c609da96c9231d28b7775eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872945, "uuid": "18d9fcd2-694c-4dae-bfcb-dbf99f2dd67a", "comment": "Malware payload", "value": "2cf8a52b374abf5ad85aff08ee56f0ffb832fa7087c67242f7b03ebf05783277d08804ca031f3ae4ae851ad2520928fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872945, "uuid": "0b3743de-6ccf-44f7-9a57-a8d217bd63ef", "value": "T18C159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872945, "uuid": "f6e46202-c3c2-4048-b0c5-ab69b1c1c8af", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872945, "uuid": "2d17a31a-6bf1-41f9-bdf9-9b3484b64e43", "value": "12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaITQ:5qDEvCTbMWu7rQYlBQcBiT6rprG8aQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724872945, "uuid": "5be8cf38-0a76-4853-8c0a-5cb83eff2e14", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724872945, "uuid": "7ad5eaf4-7581-4764-a3a3-360fd5eee09e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872945, "uuid": "31e556ad-4150-4fa6-83a2-1f4eecd7239c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f264dd-6505-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724825899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724825899, "uuid": "1f3ae04e-1672-4fb7-8226-3d468d27f0db", "comment": "Malware payload", "value": "6a3401e664a000c14a6cc5a9156f5a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724825899, "uuid": "b2f98b17-cc9a-4006-b66d-ffaa026ae2c2", "comment": "Malware payload", "value": "4a7ab164a5d10dc4c5d912c32bddc8490ff4380a43325428a130db078c791cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724825899, "uuid": "e00000c1-1ec3-4217-a226-0045e6daefad", "comment": "Malware payload", "value": "962e202b0d4b36c6326e35700f84b7d42226aa91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724825899, "uuid": "187e7b45-4a04-48fb-8e2b-d5fa1b5bb81d", "comment": "Malware payload", "value": "8045cf62aefb23a4565e7ed9af7d4ee4f40048e93998127b58f441fe3511f380ff64dcda283102192bd77d9dfc04c8b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724825899, "uuid": "fa2ef9ac-e7e9-4edc-b6f6-9f71d4c6a8ae", "value": "T135B46B0AA3A503F9E167D03889574A46E6B2BC450762CADF13E0767A5E733E05E3F790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724825899, "uuid": "eff0848f-5d4e-4e13-b826-0b51c464d1bc", "value": "43dca76562a9aa04b86d3c33081331a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724825899, "uuid": "26f78ce0-e2f3-43b1-bed9-f81180d0e87f", "value": "12288:4Wx4Hi4NWYgeWYg955/155/OZgPkSDe+HEJhBoaDLlCHO:r4Hi42PBe+Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724825899, "uuid": "5dc1a093-fa8e-4599-ad91-ae3417c6596a", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724825899, "uuid": "3bb41809-aba7-43a5-a9a6-0b0ec9adc2ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724825899, "uuid": "4f25ca75-12db-45d8-97ca-a68eb6804cc7", "value": "MpClient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a53da62-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724827577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827577, "uuid": "122d6c34-2d7e-4b95-8ed8-fca7a592a9c9", "comment": "Malware payload (Formbook)", "value": "a9bbfbbf4a7fcaff41263bad0a21e571", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827577, "uuid": "5800294a-ff5d-461e-a80f-281733b5acbf", "comment": "Malware payload (Formbook)", "value": "4c1b8ba78eccf964debe1276f9fea527baf3dae3afcc9e5514204023ce36a5a8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827577, "uuid": "e57786a5-d975-41ee-864d-0ec378ee79d5", "comment": "Malware payload (Formbook)", "value": "7940c98d021cd77e046d1c3f8969607c0221a261", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827577, "uuid": "a3a4efb6-23bc-407a-afe4-f890971e6bef", "comment": "Malware payload (Formbook)", "value": "03f11a8d2b7db34309287a876f8de96dc5a72556eca37e2c3448947c5cf0a861450bd4f32cd6b1584c249604e664e12d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827577, "uuid": "2ebca066-f5af-4811-b6f4-003abf4abca7", "value": "T1CA0523C38AF1F6BDE0A4E778436119BE8203BEF5DA4F7641563256B0B9022D11F3E842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827577, "uuid": "28cc30a1-fb3f-4ca1-8ae0-eeb4f475c0d3", "value": "24576:HR4KZh/oGV9UIoN6N1JwV/B9T4K5PKZXSf:7bUaLJ2/B9sQCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827577, "uuid": "8a93e294-b001-4273-a517-15d0cab81cbb", "value": 816828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827577, "uuid": "e7c68c38-df81-4818-b460-81543dc52cf7", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827577, "uuid": "9874aac1-5b21-4648-9816-57f0183f60e9", "value": "WayBill_no5301292345.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b267369f-653e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724850542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850542, "uuid": "789c59bb-89c6-43f4-beb1-dc8e12ca2de9", "comment": "Malware payload", "value": "7548f40150a9ed26892f9ca3297c319a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850542, "uuid": "8004ac26-bd73-49a2-9548-9d5189736626", "comment": "Malware payload", "value": "4da16139cb4602a5b13098a25a3824d72abbe6059818c8c42a59992334e36a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850542, "uuid": "4d5b6035-4253-4476-8832-2902bf2199ea", "comment": "Malware payload", "value": "d3be1581bb82ae9951f4a76a0880eecdc09aa6ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850542, "uuid": "9d521a21-5b6d-44c4-98eb-8178a878b21a", "comment": "Malware payload", "value": "257ad04bfb8197f70e3bd7e6723e2c8dbfc44051467a548543c562cd524df6d2338ed096cc0aa0e689a12720e64297d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850542, "uuid": "c6b5687c-99b6-4c9f-a3e3-f7704f8911ad", "value": "T155159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850542, "uuid": "c3dc43fb-e4f3-4944-831c-1848c51c12f6", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850542, "uuid": "32c98b81-f0ca-4efd-9795-ca579dbe4202", "value": "12288:1qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTp:1qDEvCTbMWu7rQYlBQcBiT6rprG8asp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850542, "uuid": "3ab156a2-b7a3-4cb0-b0b6-89bcd548e3fd", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850542, "uuid": "319894a5-e7cb-447a-9757-261e1b2aba5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850542, "uuid": "5a4b0d61-41cd-44b7-b7e9-c3e42050b63e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f5140a-6593-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724887050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724887050, "uuid": "ded661a5-1ed9-429d-94f9-bbfd17dba857", "comment": "Malware payload", "value": "e63943693d426b7360277c344d887756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724887050, "uuid": "94068761-cf84-426f-a853-32adf051d9e5", "comment": "Malware payload", "value": "4e5230b94479545a03d6f366539b3b2f9cf2243929858e5cb1603ebc1901ffbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724887050, "uuid": "93d99ae0-f44e-40c7-98e7-2cd280183697", "comment": "Malware payload", "value": "1b03678737f998870808b386369e8f5bdee92d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724887050, "uuid": "ff2c945c-b867-4a4f-b3a7-8355450faedb", "comment": "Malware payload", "value": "113555886d4f6340b2a96000119b9124706290f1acdc6e8440c6e3c6fc01e8f45feb9211f54dec97e3bca6809dce3b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724887050, "uuid": "19566bbf-2ea1-4c26-b765-3e3b749da0a8", "value": "T19B159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724887050, "uuid": "84d22bc2-b140-44d5-9dc9-62d10f6345f8", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724887050, "uuid": "7f0dcbf6-a527-477f-b1b7-1dbda1043650", "value": "12288:EqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTO:EqDEvCTbMWu7rQYlBQcBiT6rprG8asO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724887050, "uuid": "f14f780f-3f81-40ef-883e-c9208c793a48", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724887050, "uuid": "819f1fef-6135-4a0e-a671-541fba4d2a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724887050, "uuid": "b234cbc0-9ea6-44e8-9759-91ef9625d793", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfa73f2-6545-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724853296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853296, "uuid": "2a322b71-dda9-4130-b95a-fed4fedc4ce4", "comment": "Malware payload", "value": "6b64382e0d7fe3d455c8065625d91ca3", "object_relation": "md5", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853296, "uuid": "73a6493f-d5b0-4b63-b7c8-5e4ed7586072", "comment": "Malware payload", "value": "4e692aa0c2b858917235b4cc2befe649c1fc3df90d6c42d0f329cde57156d752", "object_relation": "sha256", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853296, "uuid": "3941d4b4-7f33-4f87-87fd-1bb191835c53", "comment": "Malware payload", "value": "6111ec178472470244c7027aa46591a94c897b88", "object_relation": "sha1", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853296, "uuid": "367045db-3d22-4025-8f05-d4c0926e8ce0", "comment": "Malware payload", "value": "891bce3a013e28a6bd2a0ecb6017790ddf614834d93be65da1d5636dec56984c32653c69cb1a7d6f7fac0f7eaca8e11c", "object_relation": "sha3-384", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853296, "uuid": "c3628cb1-46ab-4e4e-a3f1-dd0d4bf04226", "value": "T198343B5272961DB2E893A1F47A8E712210ADD0B447E147D35A4A4FEF94803E49F3F2DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853296, "uuid": "b4cab31c-f331-48eb-bdd2-95970edd24e8", "value": "5ebbd30bc18572a08ac81744f48be919", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853296, "uuid": "50454a5f-72b6-4ee1-b80f-e40663d98a2b", "value": "6144:vvV/g0FYbSAOSVbzzFUBSkaJPawk60HPs:HV/vP62ADcdHPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724853296, "uuid": "2d2f360f-015a-4e5b-8e96-4f3ec67be010", "value": 247440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724853296, "uuid": "0fc60ec4-0e0a-48c0-bca5-8443ed39bd15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853296, "uuid": "5b9551a7-10c0-4c38-951f-03d03a176172", "value": "iisutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ac6748-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840267, "uuid": "c68c20b5-7de1-459a-8fa1-2418954d230a", "comment": "Malware payload (Formbook)", "value": "aa368466970cf7d1b4cabe8acc08784c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840267, "uuid": "82e4f755-877f-4b1d-b31c-ad9aefe68b36", "comment": "Malware payload (Formbook)", "value": "4f5496e1edad1f8190cef6d8801cfe9f0f19063913230e413e790986b0e47184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840267, "uuid": "b36ba835-5a11-47cf-845b-d2765a9a0afe", "comment": "Malware payload (Formbook)", "value": "ff8e094e34861928dcdd1d8462cdde9536427f2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840267, "uuid": "06f4dce6-045f-46de-a65e-2d107dc59155", "comment": "Malware payload (Formbook)", "value": "ddbfd2aaba624d36d3e873a57482f545278f5928e9bf813d50ba638184de4493ba24cc20198fe6a404ee7b2bf58ff929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840267, "uuid": "d0c96d66-be5f-4a99-ab0b-3fa3bf189281", "value": "T1CA0512587619D616CCA1ABB81AB1F3B4277C6E9EAC02E3079ED9BDDFBC25B050D50043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840267, "uuid": "034f5684-fe54-4110-9629-a841abba2e8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840267, "uuid": "1243edbf-090a-49cb-81d2-8ee3737d77aa", "value": "24576:68CUU3gfXzNFTMY8ZEcG+yQW36oeGh0RoSt+Cwo:jPrMY8ZEv+eXeoSt+Cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840267, "uuid": "eedd4275-3165-42f2-8abe-f478773f4114", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840267, "uuid": "a87fadc8-99e8-4e07-b85c-653e3055a7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840267, "uuid": "5e8a1fb4-8dff-4986-bdb0-d053e7eaee67", "value": "Quotation.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5ffb0e-6565-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724867073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867073, "uuid": "fec3cdc1-547b-4206-8515-606ca324246b", "comment": "Malware payload", "value": "e139432302c94cd5e036e3af98d261d8", "object_relation": "md5", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867073, "uuid": "ef07a20e-5b17-4e8f-8c28-151ab809f86a", "comment": "Malware payload", "value": "5041819b1a61b35a0ebd3acefce78652853bfed40c31c76a49532a13a8858e60", "object_relation": "sha256", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867073, "uuid": "7e34f9b7-49a9-43f8-bc4f-532101fe0afa", "comment": "Malware payload", "value": "f0df9f2051bc8292810a92d35a8fa75990bc7f3b", "object_relation": "sha1", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867073, "uuid": "818620e0-483a-4f1c-b5e4-e756eb4f6032", "comment": "Malware payload", "value": "2a75b719e6908c2eb737b6cbb6e67eec7378110dbf91a6367652bcfb10471e883ea5bc7e529a490e073c49dd0000057c", "object_relation": "sha3-384", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867073, "uuid": "8a4c1b1a-fbb1-4dac-920e-3d74961eb4c0", "value": "T1EAE533EFC6EF1A5214D74E59A8817BB10835550A2A8F1262C5375CCCFAFB404BEC762A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867073, "uuid": "0b6272cb-e463-4473-b022-2a2a76f9f39d", "value": "49152:NYpH5IbClgpyXSApYV9rf0vzRlj/FoubsQNis8SqoNpHjM5AsgUDCCr6ky1+r2EF:Kl5e3wS4qrf03rwgljM5AsgaC9sa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724867073, "uuid": "ccee4305-307a-4ec1-939b-e58e40bb638c", "value": 3292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724867073, "uuid": "9a9d33bf-14ef-49df-9dac-15285fd224e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867073, "uuid": "d465aeec-60c7-422b-aa29-974203e3d279", "value": "!!SetUp_2244_PassW0rds$.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14055f2f-6592-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724886354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886354, "uuid": "a77df1ae-fe02-4415-b11a-b508a14fe724", "comment": "Malware payload (Formbook)", "value": "9fefdc75634dacd9a1cbf4b8fc833d0f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886354, "uuid": "7010b4f9-3bf7-40bd-a98e-9af9990877f7", "comment": "Malware payload (Formbook)", "value": "51eed6079bbb301daea7862f29e2b5da2d5fc7a54fe4251e5edc5e50216b1a1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886354, "uuid": "c4c2d4df-c35a-4d37-917a-3210e4e9691c", "comment": "Malware payload (Formbook)", "value": "6f74be724a3110b5786c30b2dd4cdbe888180c84", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886354, "uuid": "68ceef59-8dab-48c6-9998-0c60566d8410", "comment": "Malware payload (Formbook)", "value": "d59d8fbbfa62db860bc0f6ce7df755998059a802a97f80dd7557225d0b1c783e5174ca99207c2dcc90a9cc5eca13205b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886354, "uuid": "343fcda9-fba8-4c3d-8025-ead8620ea3f6", "value": "T1FAF4231DF4703DEC86229C58546BBAC76AE3AB14CAC6D4F0777AA2B559C05FDB000C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886354, "uuid": "601c4170-3317-449c-9bc0-f2b1a7faedbf", "value": "12288:VevtVD3nWE6XC1p8NR3EMHeHRDkEPe1Lb4PUoPaByC/nzBg51rge:wvtF3nWElmR0M++EILMC/nNMge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886354, "uuid": "f46eb797-8210-40f4-88c3-79aebc1e8a4e", "value": 733962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886354, "uuid": "e0734566-5a0f-480f-b27d-772e2cb6c6f1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886354, "uuid": "fca79598-7024-4063-9a8b-7472cda47725", "value": "nRFQ.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7328f583-64d5-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724805339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805339, "uuid": "4784920c-eaac-4d97-9f3a-b8ceef34fc95", "comment": "Malware payload (Formbook)", "value": "c2aefc95431cb935b006e996872d24da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805339, "uuid": "06fa9991-4325-4683-b177-1e5df9775773", "comment": "Malware payload (Formbook)", "value": "53a995afa76409442067b676be48a3d228ef8bfd10d967c6d0d02f0cbf97ae1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805339, "uuid": "fb6a0a37-8164-4209-b3d3-bdf3fccd7415", "comment": "Malware payload (Formbook)", "value": "0e8048fd388ea1c2b46411ad0a4c4cd3f383ff89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805339, "uuid": "56fdf8fe-ea5d-407f-ae30-9a1018c39636", "comment": "Malware payload (Formbook)", "value": "3b3632e1bf7bc1a816bd818ce80c9bb75a2b655bd0bebe7fd6542c14ae268b58d697c46e19bdea3747ad1d43fd978a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "XehookStealer", "colour": "#64848E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805339, "uuid": "a0ffc4d8-e486-4f45-9b6b-954a6c7917c9", "value": "T19EC41DDD325072DFC85BC4729AA81D64FB6074BB831F9203A0675AED9A4E997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805339, "uuid": "4f4d6748-814b-495b-91c9-3f77228ccd4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805339, "uuid": "f7d2df97-492c-4122-a6dc-5dfdfdde2d5f", "value": "12288:Kn6gekLYAkJnMm9+/MwpCEHI7mTm/4NzoM8viqwgbFAG/lFRdDkcAQiHtPUD9lv+:Kpek8AkehMwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724805339, "uuid": "73e5b120-8938-4460-99b0-7c764eb6e337", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724805339, "uuid": "c73429cd-fc88-4d31-945e-479319ed9b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805339, "uuid": "04d04fc2-5ead-4623-90cc-ff11f5a7c07a", "value": "IrisLily673Xander.msc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68b72a4-6510-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AsyncRAT)", "timestamp": 1724830765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830765, "uuid": "6fb18260-087c-4a2a-a9f4-1558da58a7c2", "comment": "Malware payload (AsyncRAT)", "value": "4269b91b4c2c00e8d28345e3cc6cf1a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830765, "uuid": "3af7078f-851e-45a6-8bc5-f001e88b7984", "comment": "Malware payload (AsyncRAT)", "value": "545687c9f5fcfba81ee854cc83694b5b2e27f9e16e435662b5194d45d07e0f57", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830765, "uuid": "2081fe1b-2df8-444d-abd7-10739886fb3f", "comment": "Malware payload (AsyncRAT)", "value": "d4ebd822c7bb237127df4bebd9e176938060286c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830765, "uuid": "658277d3-e676-4db7-967b-cc0d45dd8765", "comment": "Malware payload (AsyncRAT)", "value": "460e931d84c60919268cc46461d8be6ff92fe698bbdbe937d025cb49a15278ba5d95c4b038b3323eb22759621db6c750", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830765, "uuid": "a92b5068-223d-4dcf-912f-1e21bb89e6de", "value": "T1F7170F680BC34B4FF24D847DA34306256DBAA8BEAF69F496845FBD7C289D3099173314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830765, "uuid": "7eee0c14-53b5-4128-98d2-aa436509734e", "value": "384:DKD/JsA+gpLPeXyo5eGG0cqsOFHfxDkwce1FbYk9DQnRDwq6QEZjnuHkFhFylhNY:xqrDo5Aai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830765, "uuid": "eb13a87f-e1e2-4bae-83b3-2c9f27c8b4e6", "value": 19922944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830765, "uuid": "70a716e5-160f-42b4-b143-74bfc72d0bc4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830765, "uuid": "2182614b-34fc-4b17-a743-15d12bac6226", "value": "new.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b2da6c-6591-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724886270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886270, "uuid": "0c2c160c-d4c4-4a4b-aa2a-c21f9d5e4411", "comment": "Malware payload (Formbook)", "value": "25e1487c5e0c2104411e5685cebcef84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886270, "uuid": "bb7122e7-804b-4ca6-bc9a-d43e10bb2361", "comment": "Malware payload (Formbook)", "value": "54a558117c34dfe73a8b8dd478e89679b26214dfde180482d6d928fe53cd6ba0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886270, "uuid": "911ee6c4-051a-476d-bf5b-d66f77a66f67", "comment": "Malware payload (Formbook)", "value": "dcf784755960e85aa5ef8bb1ef989f3a090ee33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886270, "uuid": "5aa293de-0627-472d-b987-6fd698d33141", "comment": "Malware payload (Formbook)", "value": "b78d7cb090cb5668c98cb22428e60dd06ed59df6125ee976b5b80ca74b03acf2596c12a375de63fa68231b98c3313b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886270, "uuid": "7fc35a59-0419-40bf-aab5-87b76b0c39ee", "value": "T13E55CF0273C1C062FFAB92734F5AF6115BBC69260123A61F13981D7ABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886270, "uuid": "ae10ab1b-6718-4b9a-9e55-e9ca258e4546", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886270, "uuid": "79dfaa6c-4f2a-453f-b2d6-b6a4a86445ac", "value": "24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8aXMW6/RDztYOoadSnGbT:OTvC/MTQYxsWR7aXMW6hzBSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886270, "uuid": "662884a7-ab14-4e2b-8dd8-ecaaf0cd4e2f", "value": 1321472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886270, "uuid": "644455cc-1c3d-40ed-9b92-fe24efe6852b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886270, "uuid": "8c86a7cb-0940-4611-aaef-cfa93f70a0f8", "value": "z11SOAAUG2408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5075910-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827756, "uuid": "2750a594-6030-4bfc-aac5-ff390ac9d71a", "comment": "Malware payload", "value": "1e31e08286f749d3ca69b71f3f99ecbf", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827756, "uuid": "c8f39e3c-32af-41a9-8b15-a08ea3547a09", "comment": "Malware payload", "value": "55f320d121ad957231010e08a3175060c6f49028087e45520e43ef360b9ed464", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827756, "uuid": "1950423c-3430-4218-a270-cc0e282b9b01", "comment": "Malware payload", "value": "e98f27ae7ae2d33f47c9a93c9c1db2bc343b725a", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827756, "uuid": "bc115724-8c65-4429-836a-c913278c7cf0", "comment": "Malware payload", "value": "e260bc2417a309c18a22e1975938c875388425097178f771781a6c635dc7ff6587a79fe1c2b999c860d7dbfaadbcb436", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827756, "uuid": "5fe863ce-f594-4f92-b297-31667cd4ce17", "value": "T1AFE58D17BCA145B9D0AAA33289A252977B75BC480F3223D72F50B73C2F72BD45A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827756, "uuid": "e95f7b20-40ea-4678-adce-c5781ae90a24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827756, "uuid": "de0f3a81-f81f-46e2-ad29-efeeb2397b65", "value": "49152:CkuaZkmz1Y1NLG+IwGfliZdlsZ6fwm+b6wE30WR0e:CTUKOliZdo6fwzbq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827756, "uuid": "e9fd8d6d-8998-4575-9b58-33def6536a39", "value": 3211776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827756, "uuid": "0f3cb9ef-6fcd-4db9-971d-24675d5db5b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827756, "uuid": "8dae72a1-117c-478a-b7c9-2b84ff2f4f3a", "value": "55f320d121ad957231010e08a3175060c6f49028087e45520e43ef360b9ed464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b88b0b-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827751, "uuid": "7bdd3f66-5e49-4f71-a93f-033c57103c46", "comment": "Malware payload", "value": "4ea81ce7f3d7bbd5ffd45e6f78b811d8", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827751, "uuid": "051dee11-983e-4236-ad15-83a0cd9fae83", "comment": "Malware payload", "value": "560f9f2809ca67889919647461b544e5726c3f5db13fa5bb5840a39f6d4768f6", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827751, "uuid": "96366535-be28-4603-8b68-771aa6733610", "comment": "Malware payload", "value": "0efd1552ccba6dbb99dbc57272b716d04961d9d6", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827751, "uuid": "b89938fe-8c6d-4747-932d-a9e0f0b27ddd", "comment": "Malware payload", "value": "e45ea65134f46b221ae5c0e9d2a247a3d497b96d312a740c30d375cf0c5f7c4180d6855bfb5a1afd1d1ac526cf4ac25a", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827751, "uuid": "ff1c2474-93bd-4152-b0d9-d36d2dfdab14", "value": "T1C9B5E9036A8B4E75DDD23BB461CB633F9734ED30CA2A9B7FE609C43599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827751, "uuid": "0a432003-077b-4d3e-b2f2-aba7c26dbeaf", "value": "468e80a4a8ce4d6e9e8e29d85706b7f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827751, "uuid": "d3706171-5fe8-457f-82e0-4636c06abda2", "value": "24576:j++qcrT+Hm82z0LmlbKTXoMe+09vvc7081W+vqe7ZtFuQ5r3h3Yb:jIWKmGj1WHkZti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827751, "uuid": "44fd4a26-a1b8-4339-b10a-8a0571b08773", "value": 2337354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827751, "uuid": "53e21bf0-a926-4954-ad5c-c969c477c591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827751, "uuid": "a93cc10e-3c8b-4be8-bbe2-f7ef966af982", "value": "560f9f2809ca67889919647461b544e5726c3f5db13fa5bb5840a39f6d4768f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f2b3fd-656b-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724869626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869626, "uuid": "792dac49-71da-4fcb-8cbe-40bcf040f498", "comment": "Malware payload", "value": "4d58a1ae27c8f25df51735d34e45e6bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869626, "uuid": "1aeadc9d-ef38-488b-aab8-b65169787491", "comment": "Malware payload", "value": "587410fde1130b6119f270803a3a402c774b7a08371dae395609f5de2ca502c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869626, "uuid": "a664bc0f-f544-49b9-b15a-711a0f72a27a", "comment": "Malware payload", "value": "0cef0154b2df879a6e3568167c3100aae769c207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869626, "uuid": "97edb1a8-9aab-43d8-95f6-5f81c5846e58", "comment": "Malware payload", "value": "94d3d1b9f81a14cfaa5afd29ad0684536f6cf431f66babee22d16a2247c9aeed60c5b6eb58f1d28552bd03c81dce0093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869626, "uuid": "84a27c9c-5d27-481f-83e2-a0075557c795", "value": "T1A5159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869626, "uuid": "16ae4072-3399-4e70-af53-34bbf7ec62a1", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869626, "uuid": "3f8925be-30a3-4cba-9e86-e7d4dd4b61b1", "value": "12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTf:vqDEvCTbMWu7rQYlBQcBiT6rprG8asf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724869626, "uuid": "d7650818-99db-404d-8935-cb9e6cba1f28", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724869626, "uuid": "be05340e-afc8-473e-8f42-0fc6a0b0dbca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869626, "uuid": "69c20256-b678-45de-871d-67e264c0387d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42426ce7-64d5-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724805257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805257, "uuid": "be21c7cb-8ccc-47c0-911d-d7dbfd0fed16", "comment": "Malware payload", "value": "5b8e048a8f6beb47333a006a28680c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805257, "uuid": "e601ddb7-09ca-4fed-a93b-cc663eca51fa", "comment": "Malware payload", "value": "5b47793bc7d7330b9c24947b1ecba09445567baa0007d1ede2555b7ae66c27d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805257, "uuid": "d409c3fb-0b48-46e8-b5d0-25306947e7b5", "comment": "Malware payload", "value": "c88eac4a159d1d3c0323238357f8e41b3b29662b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805257, "uuid": "7060f754-dac4-4d12-87e3-cfd4d3838170", "comment": "Malware payload", "value": "e27b8f0b64db50d001da1734b3dd467a729002ddfa528aaa38ba7b7969fdc3fff7653368aa0b082e8911b7cb14ca0c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805257, "uuid": "a1190ea5-0557-42e7-9beb-223cc7f9fd9c", "value": "T160159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805257, "uuid": "66eef714-0c60-4d21-a335-799c5a57d13a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805257, "uuid": "d2002dbe-a78d-46f6-9229-dd94cfb2f175", "value": "12288:3qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTU:3qDEvCTbMWu7rQYlBQcBiT6rprG8asU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724805257, "uuid": "e3043ba0-8b26-43bc-8d18-72e32d2c4344", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724805257, "uuid": "9973c691-f3a8-4042-8b78-bb26b9f44902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805257, "uuid": "a3563502-5e90-44cc-888e-f2e47b4efe96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f528bc-6510-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724830837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830837, "uuid": "4af645eb-c0cd-4975-a829-c99e313a80d3", "comment": "Malware payload", "value": "5f252eb99b5c4996c7dfe0284aeb4745", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830837, "uuid": "88a44a9e-98a2-497b-b1cf-da87d1514357", "comment": "Malware payload", "value": "5b9dd334072395a3dc9bf5abaa257b553086689a67ecd2cae1058edbdb848146", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830837, "uuid": "b3e1126a-d590-4835-ab10-3945dd950424", "comment": "Malware payload", "value": "ff8aace11cfffadb659d8e26ddf2e7a25e4c0282", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830837, "uuid": "d6a54d4d-3b7f-488e-ba90-bec17005f3cc", "comment": "Malware payload", "value": "570eb4150b38339234e1970cab6f19bd6b5d22692f19d68ac12b0cab0f970f5d7ee78810deb9197d1c893e8394182d9c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830837, "uuid": "12a83fcb-5bf6-4c98-9427-843a75a21ddf", "value": "T17721AB1127F89A60F6BB0A789CF767258BB6BC03C910CF2D400841581CA8A50ADADF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830837, "uuid": "85418d80-d7ac-4559-bdd0-816fb091dea0", "value": "24:89lBBVJO9J+3fuAOc8PAMYWDvvdp+4CnB+uGy/N0ReVVw5kw5hwy+cImo:89lBBVs9of1Oc9MnvvdADBL/KReQZbaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830837, "uuid": "e4238409-ecd7-4780-bcdb-d713635be0af", "value": 1228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830837, "uuid": "0cb61e65-a299-46e3-9020-509bba7baabe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830837, "uuid": "a766ca41-8a2d-488f-8145-e435c55b5b36", "value": "1Z45379364_PAYMEN_DOM_pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5b86bd-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724840280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840280, "uuid": "cec4f03c-32ef-4338-bbad-491bc20c371a", "comment": "Malware payload (SnakeKeylogger)", "value": "bc83d85989ca4b6b145c1ba7f383ef87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840280, "uuid": "d22f3af0-cfe7-41dd-8f74-ca30bbd5f208", "comment": "Malware payload (SnakeKeylogger)", "value": "5d6e59de735aa24c42ef1e17b51af9a61333921fea22fabfc2be0d3f780f67ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840280, "uuid": "bdd10c73-eef1-4767-855b-de2bd42a38df", "comment": "Malware payload (SnakeKeylogger)", "value": "9081dce833554b73a3947714c2a3560b2410b619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840280, "uuid": "eb2fcb53-372e-4f20-afaf-04adf8d01e18", "comment": "Malware payload (SnakeKeylogger)", "value": "be0c63acf2eebd99d42964eab44649b95179c97308b2765cf774d2cbc0521e674ee17e45ea65c9e624b95d2819b5ddbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840280, "uuid": "5755ab29-ae7b-42a4-9b35-182cd2fd84ce", "value": "T1A8F4F1D03B62631ADEB544319529EDB242F51EA8B004BEFB5DDC7B4B355D220AE0CF86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840280, "uuid": "c7d725ab-1cfd-4c5c-8ad3-0b27e4e4151d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840280, "uuid": "793ce9eb-2458-4f69-8839-c5306a9aec4d", "value": "12288:TmN6EPCLLWH+H9mP+B8GJzo9ppiN5WeGhJZZvwgh3yHs3NuY2d/jvIGc2t:TmN6EPgLVH9mP+5ubiNchsHs3NqVxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840280, "uuid": "c65d7841-3f6d-41ab-9274-7f1920db6921", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840280, "uuid": "f92f60ff-1ae9-4196-84af-209621da2af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840280, "uuid": "700635ce-81cd-4ee4-9937-bc0ad153194e", "value": "Request for Quotation No. KTC 56376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3460bb7-656b-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724869844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869844, "uuid": "3f942977-0250-4890-aa32-8a4e1a05fb9f", "comment": "Malware payload", "value": "6cf063919156a1a045d2e624e0450af0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869844, "uuid": "d5eed441-8e8d-43c7-883b-34c74f691d33", "comment": "Malware payload", "value": "5e9ba24639f70787e56f10a241271ae819ef9c573edb22b9eeade7cb40a2df2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869844, "uuid": "e2cb4678-79b6-4332-9781-eadc543d618f", "comment": "Malware payload", "value": "d620f14ee2252aa51e0370d61f887a55ebb5ea6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869844, "uuid": "0c8dd348-ba5b-41f5-983b-7851d579acf9", "comment": "Malware payload", "value": "88b675675679835f1010ea3fa6e44c1a3cf913bb77572839a574475e3b22910424feae1a1869daaef280a9ea76456cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869844, "uuid": "39a9c78e-7a00-46e7-8167-270c079157e4", "value": "T173B64921FAC715F6CD430835805B637F27389D05CB29C79BEA247E6AE8772922C77249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869844, "uuid": "b333604d-151a-4980-9927-d3f6f4631785", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869844, "uuid": "9886c5ec-2be0-425f-89be-97a6b6fdbcae", "value": "98304:FQaxwTlRQMzmTSsA3WNQddbjUx8yMsNqHgJ5:588Tild2QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724869844, "uuid": "54f6058a-a16b-4cb7-b22b-b6ba563ef40e", "value": 10823680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724869844, "uuid": "01786468-49e4-43ee-886d-08fc017f36fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869844, "uuid": "19edcbf7-5fdb-4140-bce8-58dd04ebc345", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3f6479-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1724846368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846368, "uuid": "e875d978-d752-4820-8055-18aea223a64e", "comment": "Malware payload (RemcosRAT)", "value": "a7cf853aab7a489baa2e3fc8e31ab25f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846368, "uuid": "1833da60-9d05-4ec7-9f8a-4f0380cf69a5", "comment": "Malware payload (RemcosRAT)", "value": "5f6652b2b1984430374890d518550109bcef83b980557b985e502e70e80a7392", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846368, "uuid": "e4157d6c-ba30-4420-8295-e4f1a7b62d47", "comment": "Malware payload (RemcosRAT)", "value": "b114e9292f9c733594bc058fbec8f7ed63bfc208", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846368, "uuid": "618efb96-4176-4384-a0c2-03eca30a86c7", "comment": "Malware payload (RemcosRAT)", "value": "8f457c677d64e6a86195254fb4b099b610bf725c40304e1a623804eb982a924d8a9834d8bd8798f139f496c862051727", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846368, "uuid": "5aaeb53c-9fa3-44c7-9fb8-a77ab67bd124", "value": "T1D391195B1C5E924D85648E144C19D6881AE6C686F10B0F0BE39CD08A0B9DE283F3FDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846368, "uuid": "fe32ce63-d18e-4f82-b0b4-1273a082c19e", "value": "96:mMHCq5motGI0XJ+lMd7XaHtAtY/w58ew0LAQaBC:mc5motGI0mMd7YtFwCewpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846368, "uuid": "fdc5dae9-1ef8-45cf-8c21-75f209e682e0", "value": 4349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846368, "uuid": "95fbf594-dd0c-4345-97e2-948af988cfb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846368, "uuid": "f76c06a4-12b0-4128-9470-ccf0af78d0be", "value": "PO_GM_list_28082024202003180817418280824_purchase_doc_00000(991KB).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffc4786-6570-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724871906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871906, "uuid": "b0b977f1-bd9e-4325-9e55-edc726572f28", "comment": "Malware payload", "value": "65f547fa91cdec44ca6bb62c3bb9386e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871906, "uuid": "8230c67f-276e-48e7-a3ae-f049d515695d", "comment": "Malware payload", "value": "6033cd79dc7abdfa1bf302561eb34cb3e916df414104f52073a96a18ca830e0a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871906, "uuid": "22146937-d059-46d7-b646-fc06cc6b6773", "comment": "Malware payload", "value": "a1f117cf4c64b7dc53a871490d89e2a63832e9ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871906, "uuid": "96e146b3-d9db-4e1c-896d-ba9375f9c450", "comment": "Malware payload", "value": "872ae5066e7993e5c0946048312699edc10ec22fa7057492498517804dee731c59d9487a517f5ce1037cb822e0206422", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871906, "uuid": "b9afb5a4-52da-4aa1-861b-75d65a7797e6", "value": "T172F52136CA31FCD4871D3640A7281C9E21A8695793F74E28D7161CB63E32B62EF65D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871906, "uuid": "76629052-2e56-4207-b4eb-2cb66d829c13", "value": "49152:ZxICRL6XLRMEzaztox/8kvFJbeiO98i2VNcoKdaEA29jZkLyWkQ1E2OQUpCXupOZ:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724871906, "uuid": "d3a2b6da-f271-4cbe-ba19-91242976f0aa", "value": 3332566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724871906, "uuid": "ad11ddad-8b1e-43bb-b1ee-b322458ca394", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871906, "uuid": "66cff03c-3028-4ed4-ace6-1eab82031186", "value": "cd_v2_x64.xsl#", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e75634-657e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724877877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877877, "uuid": "8c2594b4-53a0-401c-bffc-8ac71e89d6c2", "comment": "Malware payload", "value": "9f88234068d7abad65979eb1df63efb5", "object_relation": "md5", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877877, "uuid": "23cfa32f-e771-48e6-b977-28a96ce15341", "comment": "Malware payload", "value": "6174276f94219bc386bdc628ca18eaec261998b7bd03077562fe93c268b42446", "object_relation": "sha256", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877877, "uuid": "13136b75-9c01-4721-b41c-6fcb7d8db5ff", "comment": "Malware payload", "value": "7509b4c506c01627c1a4c396161d07277f044ac6", "object_relation": "sha1", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877877, "uuid": "29e16729-63d7-45f1-8dfd-fb46918c9b14", "comment": "Malware payload", "value": "6de629b7584636527f6d874b18ed3b7bd2d6bcb413552a59199874fb6db21f499a5891afbecc9aebd80e7ff0f3f43a0b", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724877877, "uuid": "b337bffb-8b72-4baa-b787-ed8336f0f49f", "value": "T1D2C5F136CA8A77BE0B38FC9CEF4554A95D0D108FF50895CF1A0FA6F722B90608A5DD61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724877877, "uuid": "e6646a1b-5350-4c93-9176-973e5a7a8329", "value": "49152:9f+nXRe571Bm1vj7BqlsvULD/r1k36c68:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724877877, "uuid": "b71606b4-da5d-41c3-a353-75f3bd4ffc1d", "value": 2709687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724877877, "uuid": "387529af-e7f8-410b-8b44-8ea984d3c360", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724877877, "uuid": "55f609a7-40a8-4d23-a84c-ffeef3acd15b", "value": "input.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11510451-6592-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724886350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886350, "uuid": "ab30a747-261e-44da-9e9f-ae33db9da945", "comment": "Malware payload", "value": "4bfebdcf04ca30126f19f5c99edd0a9c", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886350, "uuid": "e0f5e05b-c3c5-44ad-bcf0-d50e7dea7445", "comment": "Malware payload", "value": "621cf6ebe42633e491e3b5cf4f7b1659053d46979f77a54b4d2fe17c041c27c3", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886350, "uuid": "a234d5c3-049d-4bf0-881f-f20ee60f7072", "comment": "Malware payload", "value": "74f647ff840ea21aaacad8bce6ce143d419763e6", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886350, "uuid": "4dba107a-dbbb-4489-b4f4-85b9f0f013b3", "comment": "Malware payload", "value": "7e2aff3e95dca4978f4c19e7399bdac3e453f57e374a36889d5656eb06d1088ccd050bac7211cb35be13553ca7fa428c", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886350, "uuid": "4ede4591-05b5-4b90-bced-7f7d70a4b252", "value": "T15BE423DD5233B029A935F7B37037A34A87B4725FC299DF72181127427A6B87A1A0E3C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886350, "uuid": "ed2ebc53-266f-4149-8c73-ebb348ed885b", "value": "12288:koEUMzHYM6dqw036gXo4kGnflB4eObaIUwGkNO6pGslCJKmPhMB5au9r+7x+:zEUeHx6sR36NGnflmzGARss2ML7C7x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886350, "uuid": "aa557256-9e85-4e73-94e2-2a53b439a648", "value": 682208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886350, "uuid": "4ef1c170-1ded-403e-ac48-fd8f2a0a74ac", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886350, "uuid": "0f8995ea-9dca-4c44-b216-39186cf56ae1", "value": "nGP Design INV20230103 $68,320.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dba5555-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724827717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827717, "uuid": "aaa22fe5-41f6-4ea1-847f-6904d935901d", "comment": "Malware payload (Mirai)", "value": "8d01d6452f619bb72ba3e5a4ac0f8517", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827717, "uuid": "9b276f2c-8a9b-4501-9f8c-2954529b2053", "comment": "Malware payload (Mirai)", "value": "621f8db21ac68c7b549e9c306dfbd440311a19fcb49beb87766ce96ebba0e03e", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827717, "uuid": "ebbfe6fa-da59-4a8d-850f-c36bd6982e13", "comment": "Malware payload (Mirai)", "value": "337aba18e068b688af6351c496c6f04cabbe0bba", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827717, "uuid": "0bae98d2-1c31-448a-88c1-96672548368a", "comment": "Malware payload (Mirai)", "value": "25c614844178c2b1467eaebebfc22ab573b3f4bcf03f255e59046a224dfc2e6040ba87174e46795c1e9c20529ccc86cc", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827717, "uuid": "1e7c9dbf-2b89-4f64-82ea-4f6459fb7711", "value": "T1F8A2FD6E75A9CE3EC894E23866D7C130617074B0EB3352273A9093733C52B9C4A39F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827717, "uuid": "f94d54e7-42b8-4c02-a720-24d51a7353c3", "value": "192:R26FGwR3Kk7EH4V5xgJjvDbDj6DH5cauGGRWpCdh0Fvi:M5k7rmLnQ5caxGAIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827717, "uuid": "c20b52eb-7c52-4642-9071-66b15cf07b98", "value": 21336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827717, "uuid": "e00b4815-9f0d-429d-ba0d-4554d181aad2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827717, "uuid": "4b7ba33f-e1cd-42f4-994c-e0f390092a2f", "value": "621f8db21ac68c7b549e9c306dfbd440311a19fcb49beb87766ce96ebba0e03e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5237bf-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863601, "uuid": "7ab02a40-9646-4ef4-a26b-39323e1587c1", "comment": "Malware payload", "value": "3d1c6d7d8127b4bee872fdc3100efc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863601, "uuid": "e1d177f8-4258-47c2-9c0e-0dc1662bb349", "comment": "Malware payload", "value": "629463eeaf09ac3f51a7adf9c29d43b73f06bb92448243f6c9b8c7b9c1efbcd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863601, "uuid": "90e486da-ba98-4eac-8ff2-419f8df4bcbc", "comment": "Malware payload", "value": "119d54287ef32c14f1bb3fc3acc5671b5a912300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863601, "uuid": "dca3069a-5f49-4268-b0bc-f4baed1ecbc8", "comment": "Malware payload", "value": "5679af334946322ab3de681ea9a15f89c6d2c1882764411742f39cb146bb91324f4c03a9b297bc605292ce33f25e5e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863601, "uuid": "9dacf9ba-a623-48e9-ad8c-12aaabd1daa1", "value": "T18F25396262F29F9BD11B03BDA6E7A71A7775E810A787C33383103444B8D57E0D7894AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863601, "uuid": "f79dd794-319b-4e55-a898-7f10b74c41d2", "value": "b65a7f2a765c7f52bfc71725fc89d43f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863601, "uuid": "5514620b-453f-440f-8195-0c2104dc83a6", "value": "12288:AZ/oDqUctQOtY1TOu55f2bWlikyQjf9+Kofx8JqyT4AYG0p+E+kr:AZoDqBcSu66NygVoFGGb+kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863601, "uuid": "5947ffa2-c0ec-46d6-a7e4-eacaf620cfec", "value": 1015824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863601, "uuid": "1b16c3ad-db81-4d40-850b-6326452cc70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863601, "uuid": "513aecd4-49b1-447c-a540-be850a179676", "value": "FakturaPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac6f611-656a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724869320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869320, "uuid": "2a0a44c2-81a7-4e11-acc8-c250242a9091", "comment": "Malware payload", "value": "34515310aa7bffd5dde5451325c570bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869320, "uuid": "4344cad3-12d1-4531-aef0-5e774bee5e58", "comment": "Malware payload", "value": "6321f30a6d04163a90add4422582af207499e91bbb32e7b3fdf03223a3ab9ec9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869320, "uuid": "ea2e6cf9-611b-46eb-9449-541311a17196", "comment": "Malware payload", "value": "8f80000161b90bd62d4c9ab11d961c86f1de0dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869320, "uuid": "ecb3c402-3489-4861-930e-950ebc00f426", "comment": "Malware payload", "value": "b2ecc3f790ba2e1e32b5654677ac90897149f6d2db7eaacc5cc2876bce38cf244259bc17841f03dbef38620918095d12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869320, "uuid": "03cdc6b1-8bb1-4482-a3ac-a203ddbf6de7", "value": "T1A234E80DFE1EB915CCC5B4386D0A5312BB3968882775D35731318A28FED76D89F3AA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869320, "uuid": "ccc43e5f-1657-4648-a644-5a56dbff042b", "value": "6144:e7FzQl6Tqs9Wn9OUfT4toCDEhL0zi/7NOK0D7ueGLRuUbQZ0KqmJCboCrGDwTOPM:9RuUbQZ0Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724869320, "uuid": "4f5e70bd-b1e3-40a2-9bb2-9b2e0641d1b4", "value": 231512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724869320, "uuid": "ab2e21ef-c2d5-4e23-845e-869c796fd31b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869320, "uuid": "1c4f6e46-b52b-46f3-88cd-1fc243a75d19", "value": "SecuriteInfo.com.Android.Banker.5117.19232.32315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8461a50c-651a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724835003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724835003, "uuid": "4554bb8f-13f3-4474-8868-6a8141cc194e", "comment": "Malware payload", "value": "3e2da7be0bae852fd8be27e3b0b2c5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724835003, "uuid": "6deb8ae1-57a1-4812-942b-95069f6868bb", "comment": "Malware payload", "value": "633defdc371a3cfd3641fd09c17ed6c0c9b8634ddb8d2de5c24a9393ac37e05a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724835003, "uuid": "408da38c-ef19-438c-b1b2-6f68cc4fc033", "comment": "Malware payload", "value": "134e1f6951393ebe1037361d03a395231da2db99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724835003, "uuid": "c166823c-b43d-4245-8d53-c91f8e70f1d7", "comment": "Malware payload", "value": "6edc511b0e89d9f225ee49d44f35b6fa5aa1a997b59de02ee5004f4cb91cca16b71a3b42e96617609d922f9ee15498e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724835003, "uuid": "a8fe948f-c418-4738-b44f-a2bd6d186610", "value": "T1DB35BF027381C062FFAB96334F5AF6515BBC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724835003, "uuid": "d4807e25-f5da-43f0-94e7-db694775a995", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724835003, "uuid": "8434217b-7e95-47c4-83f1-e943ce1938ea", "value": "24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8ajPa7PUv8l:DTvC/MTQYxsWR7ajI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724835003, "uuid": "75fa17d2-a00d-41fa-86b4-c31e58a7b2f0", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724835003, "uuid": "20a089f7-4219-49dc-a462-91c1881e27e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724835003, "uuid": "705a01d0-15ad-4b52-bba5-0660a94f6ee8", "value": "Payment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69ab690-6519-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724834631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724834631, "uuid": "670bf2cf-cd15-4b03-b27b-4e45b3e5bb53", "comment": "Malware payload", "value": "a409ef028bd0160f9f0f8d033645aae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724834631, "uuid": "8f7ddefb-b587-4277-ac88-3326bba7dba3", "comment": "Malware payload", "value": "63e2c9ff5ec9021541e8b44038688643ec47c410cf67ef6feb82a0f1e4405623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724834631, "uuid": "a20fc68b-cc42-4c0e-bdc7-c21a24c913ff", "comment": "Malware payload", "value": "8a08e79dde396ea2102361fe90ef0a95034cf410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724834631, "uuid": "21855557-23a2-4bc1-9bd6-73955ff2f61c", "comment": "Malware payload", "value": "d0e641f66e059a433feaa049636b4a60aff9ba2f0788e0d601a938d87586aaa0bd620065ee8cc35be7432916d8aff49c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724834631, "uuid": "70400c58-7fc1-4059-961f-9bede2ffa8ea", "value": "T101159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724834631, "uuid": "4e5e1332-aa81-4349-a6c2-cbb50bf2de42", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724834631, "uuid": "5bba7ae7-3a65-45b4-82ea-daf3b409c9a6", "value": "12288:EqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTK:EqDEvCTbMWu7rQYlBQcBiT6rprG8asK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724834631, "uuid": "d091892b-d8bf-42db-b663-4dbdc91a4b0a", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724834631, "uuid": "4d2176b9-dabc-4cfc-9dba-65113f25f3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724834631, "uuid": "88f058d8-fe12-4d30-be8d-634fb70004c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12afc2f8-658e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724884634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884634, "uuid": "3b9d07cf-8398-4187-a17f-7ff3d25ebe90", "comment": "Malware payload", "value": "1135e17339577c5144553ae78797789b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884634, "uuid": "a99a8d6c-00e7-4c93-b1f1-32b504096893", "comment": "Malware payload", "value": "641a28ba1e71e665159e54073d390a5e02a729f271012e7ac6125eb9aeed87cb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884634, "uuid": "93fe79ce-0b89-4f01-9608-bdc2861b58a2", "comment": "Malware payload", "value": "9eebb74d562d4bd123bdd6008b573c8d1ce22bb5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884634, "uuid": "831b89bc-04ba-4604-99d5-a88ee6da1bd9", "comment": "Malware payload", "value": "3beec2eaaf6533d6496caced00806c263c7661f9471e29c5b0ce72734d6c658042fb428058df1e211f66cb6dd918848d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724884634, "uuid": "a9f64980-6435-4752-8feb-761273733411", "value": "T1B7C48D1073D6C936D57E06B03A2AC3675969BD604BF1C8EB23C85E1E0DB25C25276FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724884634, "uuid": "bf4014c9-fbb5-49e6-880d-214653eb750a", "value": "12288:0BnYiFIWlAJPlP41dpd5e6mBLUVEVWE72W8wrxA9wO:0lYiFId/5IqVXCWJrxA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724884634, "uuid": "22c8bb03-cc43-4eac-be41-8eb3dfb900d1", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724884634, "uuid": "ca5fa189-adda-4f96-8e1a-219ecf4eb843", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724884634, "uuid": "d65f4cf6-e654-4a37-84d0-f097cba8b5d9", "value": "SecuriteInfo.com.FileRepMalware.7532.6621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3d25b1-650f-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724830346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830346, "uuid": "715ea2b1-483f-4386-9a83-f0f41c39a548", "comment": "Malware payload", "value": "ecdbcf8ac9adecb68219a0d391bac2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830346, "uuid": "05722c3f-3428-468a-98d9-d0beef45697a", "comment": "Malware payload", "value": "65e5c0f09b2d0cee57e685c230a8a248f2b094d98bfe2447f0b8efa85589f2f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830346, "uuid": "e97c8998-61f7-401a-ae75-af24af9d45e8", "comment": "Malware payload", "value": "e01a8e57872675d354211393d791f9b849b4816a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830346, "uuid": "ae0dc34d-b0fe-4b11-807d-3154f92903b2", "comment": "Malware payload", "value": "6c22d54c09299b71f0e25bb22afc20ab5e9db254ac6cb28af0ca571b7aed5b38e57a63a897b2a34e6430d07384596a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830346, "uuid": "f6847d1b-cf50-4f65-ad2a-866aa227e238", "value": "T10D143A1178A8C1DAFE3E8732BCDA56E61D28BD7A5E50801B75E1BBDF0472312C913D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830346, "uuid": "cd18c2be-c6df-4c66-8a30-f14eaad3be5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830346, "uuid": "6ccb9f37-b721-4529-929f-171d700959c3", "value": "1536:uu4xtpuhgDc+skyGz2V7G9+38VRO+3nt22jNVxWXU+5i9Xq6T:F4xruhgDc+skyA9vVjZVxh+E9PT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830346, "uuid": "939e6c0f-bcfc-45ef-a576-268ae4834226", "value": 197432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830346, "uuid": "e0b22258-ea5a-44a6-9384-fb513a9d00e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830346, "uuid": "01a21471-fd77-4b76-9cc4-f16272ebed22", "value": "SecuriteInfo.com.Win32.Malware-gen.7804.15728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1819c994-6567-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724867893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867893, "uuid": "ba6d6d04-ae8c-4ced-a5e4-ad5c924801a3", "comment": "Malware payload", "value": "248efb59a223ba854803752dac53d470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867893, "uuid": "80efba37-0aa1-4b63-bc59-9b7e435c1e57", "comment": "Malware payload", "value": "6a476615986eb5eef5b4ea2324d9dc1ca886364456e7f7fbdb063101c6c3e915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867893, "uuid": "699e3f31-a5a9-4f0f-ae8f-2ed3990545cf", "comment": "Malware payload", "value": "5780e6aea2f10f55271ab5515f81e6b44775a03f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867893, "uuid": "397bb00b-7d17-4ddb-b1d1-add02480948c", "comment": "Malware payload", "value": "766bcd9e8fbdc8b231fa85bd33470d58908206ffe8664e8df1dc37b2fbb77615d42710109c29be8f647cce4d1d99f303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867893, "uuid": "f63acbe2-c307-4093-8ff3-cbe8d3da0d83", "value": "T1B9F63A45F9C7D0F5E903483840ABB27F2B345D059B28CBD7E7947E2AF8772921936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867893, "uuid": "e3123288-47e8-48ab-b3ae-89fdec7163e7", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867893, "uuid": "3a86bd79-6aa5-47a8-824c-0e14e74a6584", "value": "98304:GurhNLtwJoK7Fl3OFFpu4Qo2g+F785e1WNzafqdMhmJatiD45bD:xRt8uvc841WNzar0Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724867893, "uuid": "cd69cc80-9718-41d3-9a18-0cef232fa774", "value": 15585280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724867893, "uuid": "91f2039c-545a-42a1-91b3-8094e3d8fe5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867893, "uuid": "e259c810-7f4d-4116-91a0-f86a144eaacb", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bd2bdc-652a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724841874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841874, "uuid": "a38bbc74-77d2-48bb-9932-d77781770b08", "comment": "Malware payload", "value": "a3ca8f5054f1fcea9b47baf8f778613e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841874, "uuid": "56b1a49c-1cc1-4e08-b9ca-de8061c4c231", "comment": "Malware payload", "value": "6b1e79f604411c76589e4f6b37c2f2a729006b3335aee9e41797c86fb1facc6d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841874, "uuid": "1690c2fe-796c-4f23-9374-0fe0832b3363", "comment": "Malware payload", "value": "074b04ce8ffd2d32a43e318c7f64e5ef5cc30309", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841874, "uuid": "4786e981-ae3a-41fe-9595-7ff04beaba0b", "comment": "Malware payload", "value": "2e72a61c5cfffeca3c0f806150be274df464ab931d4e9aaf9b52656af689f99bac4641a2660c2dff899913c1d7355c71", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841874, "uuid": "50cd438d-9d2a-495f-bfe2-ed571ce85981", "value": "T1F7B63368F20BBE928232782E4DD8107F4987AB635294B3179174BCC5D897DD2C631EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841874, "uuid": "296dcc31-129b-484c-a599-7ea02295da22", "value": "196608:mCB+EtxQ+cO3zu9GZOh88JfMGOJYNOcacoHFW3489MId6bcWV0cbJ2qzO45NEnDp:zX6+cO3ydJUeNOcKHQ3j9MImnbb4qzW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841874, "uuid": "7292e0d3-5fd1-4e47-bb50-48a9493aad5f", "value": 10436053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841874, "uuid": "3e1ba839-8bd1-4fc9-aef8-73c690bc3bca", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841874, "uuid": "c5163a47-3815-4519-901f-0cbc3692d0c1", "value": "f8442977ead73ad6c052fbe838bea90e17f7a7ff2352c5a57ad02215eed460d6.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75d2fad-64f9-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724820915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820915, "uuid": "c128c617-326a-4833-9a0e-de0fc517dfd6", "comment": "Malware payload (RedLineStealer)", "value": "6699b6a704f40c24f206f25c3eb801ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820915, "uuid": "a18447fe-a851-4841-a634-b3013b92ccf2", "comment": "Malware payload (RedLineStealer)", "value": "6e16b45647ffa0f8bdf7e97662b51be911fb4470176cbac1b07bd5464cb940ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820915, "uuid": "40141a26-7915-442c-8f05-b7225c948610", "comment": "Malware payload (RedLineStealer)", "value": "25a718491615845ed1529a22799a60b880b62ebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820915, "uuid": "e794f1f1-989e-4a0c-ba98-e9e770c03a82", "comment": "Malware payload (RedLineStealer)", "value": "6ee79094b92c546160ddc175756aaddf23cef411f16cf95ac38fbe9d1834c02aefd36b6f865ce9eed33ee5a2b898c99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820915, "uuid": "35562411-7f11-4866-9322-cb988a444461", "value": "T12915230A766997F0E03CCE7498A0965A2272E01B7DD3D7BF8CCB2214AF78B585015D6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820915, "uuid": "9820b22d-bedd-4abb-a951-1d8d10e143ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820915, "uuid": "078cf91b-acc0-460a-aad5-885281f79c9a", "value": "12288:B6ETVlXcXDudfTASE7gNsOJQE37c+9eJrv+ojkbHWbZMPWOuJgDQTHlDlA9Ohmie:FMX6u8NsOJj9WdjwHlPW7JkQta9vjNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820915, "uuid": "743a8ecf-f455-4ff8-92a7-3732f379dd91", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820915, "uuid": "4bc47d4e-b549-4095-9ade-282a11f90271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820915, "uuid": "7b3c412c-46a2-4de7-a0b0-65df8afd7232", "value": "USD 510,800.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a052926-650b-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724828516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828516, "uuid": "3d12f1ce-8f66-4631-8c8a-d88587dbec41", "comment": "Malware payload", "value": "f9a57c9d0169399db948fb0509c38b5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828516, "uuid": "5dbb8b2d-784b-47a1-b3f2-ed31b3e63f2a", "comment": "Malware payload", "value": "6e6e0f85b332495222793b669771cf4306ff4dcaf43332b01c82aa9fef804a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828516, "uuid": "40362b9a-3329-4260-9d1e-664b148cd5be", "comment": "Malware payload", "value": "f91564a517f274b8230cbe28a82ff27d52d921d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828516, "uuid": "7270efe4-dd3c-4e3a-895a-a5ca807a8361", "comment": "Malware payload", "value": "0e38a926c6b136532dd8c03e4de94e05b374678448dc91ba09b380a3d1048d880e9b876acf434be46092dc22e4d30d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828516, "uuid": "36a3970e-18f3-464b-996b-5eff80f9c3fb", "value": "T11F146B27B19490F8D05BC0B483575AB2BA32B4C90B3679FF13D106752E6AAE17F3CA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828516, "uuid": "a88b7bab-2b57-4399-bee9-1ff0171f1442", "value": "0259493a3001eae78ed4785e8c39ed47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828516, "uuid": "d20b1ad7-3674-467c-8d0b-6fd1722c80c5", "value": "3072:0ziTIl9Kg9hqlvUoGnjHGeC77TQ3LqeKhsHORP8WWB5dHZiy:0GIl9KShqlvpqjHGI+eGTP8WWBrUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724828516, "uuid": "a3aad7de-0918-4cb0-9c9d-0299a884e23d", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724828516, "uuid": "415decac-4713-43ac-9f96-5ffda7cc3ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828516, "uuid": "cb7a0d72-a3d2-418e-99cf-4d319d65ae35", "value": "rustycry_v7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f196232-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846000, "uuid": "979c1a55-c399-4206-b480-6ace973bc5ca", "comment": "Malware payload", "value": "3d01ed0fbd007ae72097e0054e330cbd", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846000, "uuid": "49897000-bdc7-4056-b7e9-7865b4330f51", "comment": "Malware payload", "value": "701fdc68ee894bd3579c91efc19f287b748ad744f49b1ec27774c47e7c24215f", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846000, "uuid": "74ce623e-7502-454d-84a6-fb9187cd4214", "comment": "Malware payload", "value": "78720870c21366c6713b8f1d776f3497f8beaf4d", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846000, "uuid": "7e6512ef-90b5-47d4-bf7f-e734b3fec57c", "comment": "Malware payload", "value": "d42ad78ae47e2a40e39fb45125276d7b844ce547db0ac782dfe25df095d7281d49f9706a18c5bbde9a2813fa51f1ca7b", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846000, "uuid": "45e65d55-fd60-481a-8bbf-1d782d1886f7", "value": "T1EB33135DD78F41A1CF14A33303660E4942BCB23EB7045676702C937137ADE2E89A68BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846000, "uuid": "0a5edafb-1f26-410a-b501-846b9f799177", "value": "384:Y3Xgs583QWCpK6fVGe7VnSBPu8hMfbfz2L8qvWAR3sv3gAOFd8geI7YTsfuImRkp:gZSb6nnS50bLAvWMJ7IkWgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846000, "uuid": "6f2f40c6-66fc-4a02-aadc-bd2407a51492", "value": 51640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846000, "uuid": "7c78a83d-b943-44ba-940e-ddc42393a738", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846000, "uuid": "5bf86341-82de-4ec2-a736-93077469d94d", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.32304.23264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65feeb5-6591-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724886304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886304, "uuid": "9c1725e7-dbf7-46e1-b9bb-2394fd3b9fc1", "comment": "Malware payload", "value": "f7f4bfcd83d9987631beb58d27d1d30e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886304, "uuid": "8fad8b1a-1e5d-462c-814d-2249937986d9", "comment": "Malware payload", "value": "705dd6f078fb10d234b659a7b663d29f40725e7631b25714ae6d7789853202fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886304, "uuid": "00a82250-6dc1-4098-a41b-bdaa2ef26fb9", "comment": "Malware payload", "value": "f5f8ddbddbab7cf57e9755c9b42cdc536c7391f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886304, "uuid": "91bfd4de-52e8-4bd5-b001-5846e96c5648", "comment": "Malware payload", "value": "0c6582cac9fa714ade5581de0cea25d0df97d81b3eaf2f40111fce9e66e7c7d8bfd16887e72ff251a92882a20ea4d110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886304, "uuid": "dee2c23d-046b-4f18-8255-1f4ff9d2680b", "value": "T10745C0027391C022FFAB92334B9AF6515BBC79660123E61F13A81DB9BD701B1563E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886304, "uuid": "f191c424-0fcc-407d-8c03-5a04853b7925", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886304, "uuid": "f8740d1c-6ffd-4416-a30c-39c42abee4e0", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8azFjq88okgA4:UTvC/MTQYxsWR7azFO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886304, "uuid": "1ce5bf36-4718-445b-bfe2-2120ab0a67e7", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886304, "uuid": "9bb2c745-ba28-46c5-ad08-bac085d1b0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886304, "uuid": "4b9a2170-d8e3-4874-af27-6276acb7fb96", "value": "rARKMONEY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51772f3e-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724818597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818597, "uuid": "8ee9db94-cc0e-4284-b726-dfab481d7cb5", "comment": "Malware payload", "value": "6d9f3a386490c69c6d6a49a5d1b756a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818597, "uuid": "f25675a7-bbda-4e22-ba03-56a4bd96de7b", "comment": "Malware payload", "value": "70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818597, "uuid": "7fe11bd1-75a4-45fd-ba91-61ef53ee1536", "comment": "Malware payload", "value": "7c49c3a73e94674c803381cfd199e4f6bd9c7d60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818597, "uuid": "04f1d184-55a0-413e-b841-e91343ffe946", "comment": "Malware payload", "value": "5e03e46a699f7ce7656a8ad78c5a2cd679cefb1c891a6337a92d40cf700f31eb0a38f893cb4ef398140b7b04e69a73db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818597, "uuid": "1ec88435-0530-4d4f-9be5-dc910c37cf27", "value": "T17325129463EC4A2AE7FE3FB8F8B015250B31B916B936D35C8A0460ED5953B81D870B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818597, "uuid": "2ddb057e-614f-4773-84b1-56170f07b7cb", "value": "24576:HZGtMXDHVI7ZsW2oXWWIAi0+NDP+k1HkT6vN72rgJ/n:HQc1QuW2gd+ddlN2cJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818597, "uuid": "e0f6fcfb-89d9-4a44-b372-ed1d0f0fd3cf", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818597, "uuid": "17a61bcb-4085-4b4b-aebd-f7f7a41e3e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818597, "uuid": "10f633d4-5267-4d6c-9786-97db8ad1cb02", "value": "0101001010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22e1613-655e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724864366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864366, "uuid": "b4945a44-a659-4f1e-82eb-e04b498f3035", "comment": "Malware payload", "value": "d99853af411fc221e0da7319f26fbc83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864366, "uuid": "81d081b5-36eb-4938-ae32-b70887826648", "comment": "Malware payload", "value": "71392cfcefe045250fb9388cb914f0e758f99a1f2b81965d71b088f50fb367d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864366, "uuid": "b867d23b-e29b-491e-b055-c3d1df58704a", "comment": "Malware payload", "value": "a4cb6b47be181a4c83bd42e3d3181b206746cc9f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864366, "uuid": "bf018ff3-faae-422e-809c-11b17241b64d", "comment": "Malware payload", "value": "d9b81e36f230a2f6fd3754ff8976e79843f017a99352858d37ee17aa4b9d25cd93ce8c2843c637b4764eaee7718b45a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864366, "uuid": "b9ab8b07-7862-479b-9d3b-bb078e62ae0f", "value": "T1EA67233A5A7EBA50D662F27D20994FA621F3B4A6C709D8FFF3F837961514442023E853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864366, "uuid": "ae5590b9-3c9a-45b8-8b91-717c2257dca4", "value": "2b3999cd35a0b27bc0e98e38cac91cce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864366, "uuid": "a050a9b3-d82d-49f8-b272-ab72269ed735", "value": "786432:RuUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0y:RK7xVLYjsp+ikJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724864366, "uuid": "9627c600-a7cf-4c51-b9d4-b4bb12239173", "value": 32404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724864366, "uuid": "6cc6dd85-81c8-4c67-b37c-6494b5dcea4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864366, "uuid": "61c89103-4b66-4ec0-bad2-bc08b2c965c9", "value": "71392cfcefe045250fb9388cb914f0e758f99a1f2b81965d71b088f50fb367d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d620705b-657f-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724878519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878519, "uuid": "fef51c1d-5b6e-467f-b9e1-5f44a91a59a6", "comment": "Malware payload (DCRat)", "value": "34c1dcf5ae13cf8bb19dd4238d1a69eb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878519, "uuid": "c236bc66-c33c-4420-a627-56072482c445", "comment": "Malware payload (DCRat)", "value": "71692ef79be48ddd6f27fc7d11d32f58988d833974eca11740c92511b3b6edbf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878519, "uuid": "bd785691-55a4-44be-a0e0-ff613b60565d", "comment": "Malware payload (DCRat)", "value": "17e89cb0dadbf84813f8c6c8627e102182054595", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878519, "uuid": "1a988737-bc2c-4486-ba21-217ffeabb631", "comment": "Malware payload (DCRat)", "value": "d803c0f7a2268f1c7efb0a4302817ca45fc47fad7c4174c251d71357bcd10897a24096387a1d4b28dbf3df9da711ed93", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878519, "uuid": "22f5d0b4-6cf6-4348-a572-b1d4265a9508", "value": "T1C8D5E0027F048A99F0089A73C1EF42084775E9516AA6E31BBDBB73BD55123973C1E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878519, "uuid": "536a76af-8dca-4404-9c93-5a6c8029c717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878519, "uuid": "ada48c36-29ea-4135-931e-383754223b12", "value": "49152:Na/DYiWP3ZEiINj4/7iCuyxT55IjHhWMP/73rOsLw50T2SCJ:Na/Du3lIS7/uyxV6jHhFPzfLwhSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724878519, "uuid": "9ab1449e-1ac4-46c3-a077-57af5a6b59fb", "value": 2826240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724878519, "uuid": "194e1b7b-2076-417b-8cf8-bc12ebef0a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878519, "uuid": "cd9b3a02-ba46-4c5c-a2ae-4643ec498106", "value": "34c1dcf5ae13cf8bb19dd4238d1a69eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9101722f-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827723, "uuid": "10f0443d-26ac-47af-a0bd-9b7ee802ec6a", "comment": "Malware payload", "value": "372ad55125beba59b22bb0d075f57968", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827723, "uuid": "fe5b9eae-2993-49a8-b942-0eb11ed41568", "comment": "Malware payload", "value": "7320f330d4a41b74bf05367316ab7bb7aa49403a578343266f914ac477bc2b5c", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827723, "uuid": "6407c33e-8b46-486d-9651-4442a9dc7b2d", "comment": "Malware payload", "value": "03360ca36dfea1ba40e6d5f80a05d1e9dfb2275e", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827723, "uuid": "74541de8-c7a2-4ef5-b929-01cb1aa0c3ff", "comment": "Malware payload", "value": "09626ddd5afa3a881a988e24937acbc67d295621ed452be293f29e6e05815d964291eef5c89a069b8363a838b43ae1af", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827723, "uuid": "40ecdbbf-fad2-4466-9461-b7e27b1e2ba8", "value": "T161723717A7A1CF3BC4A8623445FB4E2561B17470B7735327262091B77D83B884F39E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827723, "uuid": "c4abd983-499e-41e3-b04c-f4abcdfb3151", "value": "192:RFRPcwPUUU7YBQ+tJXhuDrPFhtOC0qvi:P9RUU7H/RuDrPFhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827723, "uuid": "822c4a7c-e1f0-4408-bbbe-b5c84a0cd3a4", "value": 17016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827723, "uuid": "d936db7b-bb3b-4a48-811b-5d1600605f64", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827723, "uuid": "e6ba73a1-e7d7-4bd7-84ad-b4f066f32d53", "value": "7320f330d4a41b74bf05367316ab7bb7aa49403a578343266f914ac477bc2b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecf496f-6579-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724875796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724875796, "uuid": "ba88de67-74e8-478f-8d8a-9aae5b9a8de5", "comment": "Malware payload", "value": "836818e56aec7caf282287d9cac4663b", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724875796, "uuid": "c26098fc-ff55-4d71-8a18-f960d42fd2e0", "comment": "Malware payload", "value": "7363086b152422c99618377e384874a17a708d9eb217c0a7c6f8b6f3216f1e4c", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724875796, "uuid": "8eefafcd-271b-40e2-b366-6788dabafda7", "comment": "Malware payload", "value": "457dc99bd92cee8ed86c9d171f1223e1f7a9f8da", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724875796, "uuid": "085ff360-b66e-4168-8260-be148b3c1fc8", "comment": "Malware payload", "value": "27e950044a7932708f9f822ad6b3f3e96bbced790f703a11ba7ec8a741f2d0e5b1b5032782724d8f0f129cab565623cf", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724875796, "uuid": "e244f404-4abf-4cad-93c2-6ade5c363116", "value": "T1C77633F96E90BA94F7981C3195E969C5E2D0F122A27684FE21F12B5F8857103C3D18FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724875796, "uuid": "378f66b3-88fa-4ff7-99e1-f61795656c94", "value": "196608:o/F2ycANIvCHbhxKHhEvtbzMLoW4gJkwfQduph9:o/frvbmHh6bz8JtfQduph9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724875796, "uuid": "c010797d-98cf-4e29-860f-5c7bf7212b43", "value": 7439934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724875796, "uuid": "9efd1d81-d408-4785-8f2c-f6bae681065f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724875796, "uuid": "2ecf5f67-0f9c-4e57-b242-87a6d5dce421", "value": "Update_3310585.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e8c2f8-64f9-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724820752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820752, "uuid": "938edb5c-c28b-493f-a216-29464eb17863", "comment": "Malware payload (SnakeKeylogger)", "value": "11a8dbecbeb35ba5652b8fd4a9cefc9d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820752, "uuid": "cce26857-9f04-4ba0-b4e4-89ff59870a08", "comment": "Malware payload (SnakeKeylogger)", "value": "7441ee61db5f1ca3b26cf09df0763fed9f959b30970be46497e17f8470cb57a6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820752, "uuid": "b80b88e8-f3f5-4b2d-92c1-535e26928f05", "comment": "Malware payload (SnakeKeylogger)", "value": "8ec32ebe929a907ce8c19433e5c5a6f48f7639c1", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820752, "uuid": "0ed0e874-e83e-40fa-b457-4d9dd5fa5342", "comment": "Malware payload (SnakeKeylogger)", "value": "ef7b0bd230ed05af781d58e6f99e3b687617882a362534907fdd72aad50bd6bd057f2733601341e8a6bb56d8f08b8734", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820752, "uuid": "f71e9f18-bf21-401d-9d50-0aae94dee29c", "value": "T101124E94ACC8D16CB82DE504FE8C6B79837D15F532B56BB8CC7262434905AFB239374A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820752, "uuid": "9d804cab-33eb-4372-8026-f60c4fd87ef6", "value": "48:FeuekJeueheueRFF0euejzFF1Le8m3eNeueo:0jkAjYjbjM8mO8jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820752, "uuid": "971cfeb0-22b4-482e-b1dd-a2630cde8d7b", "value": 9618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820752, "uuid": "1177f53a-7f6e-49a3-a0de-39fe514b7d5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820752, "uuid": "b8dd7622-70db-4d21-881e-b7f302ce04e6", "value": "Bukti-Transfer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bea030f-6512-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Pony)", "timestamp": 1724831419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831419, "uuid": "b5cd71f9-2f20-4ba0-ac78-ed3fbaa4310f", "comment": "Malware payload (Pony)", "value": "40e31aa0f8e8b20d83f72ee9b974e7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831419, "uuid": "b802851e-f2d4-4b6e-a9e9-22472ab5b004", "comment": "Malware payload (Pony)", "value": "750e79df07620a8b81b5283f76d98066489e1f7429f6a7f121679f7534793e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831419, "uuid": "1be2b1a3-b138-4ae0-b6db-98740212bfc3", "comment": "Malware payload (Pony)", "value": "af4bc0bbed7b0f0f7bc4c480c5aafe0d82d71b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831419, "uuid": "64824739-4b0d-49ba-86fc-e83f74157572", "comment": "Malware payload (Pony)", "value": "13f3c6f12b6cc617d9523c97bf151cfacabf67fef9758e8266639aa9d1c0a1c971b6acef398601bb7f181b058a0d0774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831419, "uuid": "9fa3b970-fb77-43c0-b1a1-82e40780235e", "value": "T1BE931943F985F0F1C0A226713BC15BA1F3F89E68787A4D4AEF9D644579A3287AB13042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831419, "uuid": "26fce866-e4ef-47eb-8a02-a8344b0d5ac5", "value": "d6cd9cecc12ba283fd2bf86a18ca964e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831419, "uuid": "c56aed80-1076-42fd-8934-d12230b36a13", "value": "1536:qNEGOmG7Gf4qTB/UBbM6QFZrz5Eq1CRylhOwcmTvPkzb6/l:srJGQlFZfuq5hOwo6/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724831419, "uuid": "f4b895f1-e66c-4d23-9956-887ac00121f1", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724831419, "uuid": "aaf2373d-cd8b-48fc-bdf0-7985f98c3099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831419, "uuid": "dc756500-324e-4197-add8-4c0f6e423a0b", "value": "40E31AA0F8E8B20D83F72EE9B974E7DF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8413443f-6570-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724871939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871939, "uuid": "0a38bb56-d570-4bf2-8882-8f918ab6b9c1", "comment": "Malware payload", "value": "116f14c7b7678bb45231a1d6cab61edc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871939, "uuid": "4ba83258-c6e7-4603-9279-96a1d4b897e6", "comment": "Malware payload", "value": "757ca7051b6755e91043bed0b0e8096b5d2c65c0d818e3cb4c3e14ca9b1fa974", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871939, "uuid": "78147f2e-3f90-4efc-9340-7b11f76d5608", "comment": "Malware payload", "value": "bbdbb0fe30b609549f69ca1433fe09e40336069c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871939, "uuid": "a88079df-d039-4e53-bea5-96a49ea01621", "comment": "Malware payload", "value": "1eaf9ba72626ada0f9091444a00c573f86300a3479e3c8dc980435adc5cb3bb0785432202f2512cfaefe58f43f6c3425", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871939, "uuid": "29890474-9f00-4829-9ab1-72829a6b3b0f", "value": "T1CAE52136CA31FCD4871D3640A7281C9E21A8695793F74E28D7161CB63E32B62EF65D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871939, "uuid": "b377d1dd-8b78-4748-9cf0-0dac106e1222", "value": "49152:TsubCIS4JSSaMQEdzFfwBMH0aHOpkjFMcCfaqkrpu8656lojq0SboASFpTv+LtNg:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724871939, "uuid": "3c60392b-d898-4fdf-bcb6-fa4808b9978a", "value": 3317476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724871939, "uuid": "39a90775-b035-4b48-a12a-41b36795b959", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871939, "uuid": "d8a4ff84-e379-4f5a-8864-dea0f3fbecfe", "value": "cd_v4_x64.xsl#", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4819af-6561-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724865618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865618, "uuid": "16159cba-3dfd-4a7c-8af2-abd558bf8dd6", "comment": "Malware payload", "value": "e3a08541070dcb1f4fe7d82af869c3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865618, "uuid": "5df3794d-4d79-4ce7-a093-4899e8191c08", "comment": "Malware payload", "value": "75f3aeb4ec5be62e718a0f3c32463af4d055a09151a3c79b16afb1daa6f537bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865618, "uuid": "856cfcf3-83e0-41cf-bdcf-a5d9143ab758", "comment": "Malware payload", "value": "6b4ad3774d42d4eead3f0a63a8afcfdf559bb557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865618, "uuid": "b4436314-78b4-4423-9656-8b156ffa4e87", "comment": "Malware payload", "value": "25fea54c8d12e053224337d837c637306fd7ee7a474bef8f86f61aa557c870e8fc1f342d8c9b817234c5e8a42b6756e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724865618, "uuid": "c08f3ec7-ca10-4cc7-93cc-a8a122012c47", "value": "T12935128130E2B265FDB39B715AB1D6943B1B7E97577241CF22703E1F69732900886BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724865618, "uuid": "014b79fc-0087-4827-84c4-07a28def35f2", "value": "310f529f7ceda238fd1a8dcd68dc8454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724865618, "uuid": "3ac0409b-70e8-457e-8658-6de7b0019679", "value": "24576:XNPRWzRyOt2F2qXR25d8L0yFlmxYG7Kf/2C9:XNwn2FNR2XkyGX2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724865618, "uuid": "2b53f70b-f2f8-43d3-80bc-313480adac11", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724865618, "uuid": "40ff3d30-11d9-43ec-bbcf-7ba3708cdff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724865618, "uuid": "9c6a0eb9-56d8-491d-a4d2-bf8b2859dc27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1babd417-656e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724870905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870905, "uuid": "8c0627dd-c118-4f8a-98b3-141664ada18d", "comment": "Malware payload", "value": "cda36abc7f8550168c6e78c3026c5213", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870905, "uuid": "e4b27872-1c08-4e7a-b554-0d7c3f67d839", "comment": "Malware payload", "value": "77bbf883dc365ca72fa4e5cd203055a2e14787fc363fbf3409ca266c0607185e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870905, "uuid": "e88760b5-1b5c-4f29-bded-72f2ef83bf06", "comment": "Malware payload", "value": "156abbb2686a91253c0f5cce52d7229b2c2288e6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870905, "uuid": "603706f8-4c1c-48ff-b7a8-938971db5941", "comment": "Malware payload", "value": "e361d1359305c27cb33f5ad8539d54635eda6a7c87c690fb6418b951a2f2704a72fe1c55de3b891979638cb5e1c49193", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724870905, "uuid": "9b92b56f-939f-49f6-a51a-0dd1cda66a98", "value": "T1BB77230091B3B515F76BB2BF2AB95FE48559BC6A02F59DE7637173B806F20920433893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724870905, "uuid": "fdab9ffa-8a98-47c3-a92c-19b8877c44fd", "value": "786432:Ht9bUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0yXE4i:Ht9r7xVLYjsp+ikJXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724870905, "uuid": "8c1fc4b6-7c02-491c-81ae-c17f2ecb7546", "value": 35910144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724870905, "uuid": "0c0a65c9-0245-4efd-9cd6-e3ec6132b4de", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724870905, "uuid": "d83bb4aa-6eac-4b4f-be21-4f251b50d468", "value": "x64_installer__v4.5.6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6a5421-6573-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724873243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873243, "uuid": "22f24e30-7760-4a67-84ae-e77ad6a5ca0a", "comment": "Malware payload", "value": "15519ca3cc825efc4740105095bc0e19", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873243, "uuid": "93f4204b-d386-4775-8e46-250ec2ba85e8", "comment": "Malware payload", "value": "77ead4e46e614e0a3bdfac44e0d25744de58efff7d3c235d061e0fc03fb7204c", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873243, "uuid": "1606c152-c3d7-4bc6-a923-70cda242d70a", "comment": "Malware payload", "value": "b6d6ae9c14957e2192e32d42f959cc14a3c5e986", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873243, "uuid": "3478fa01-a9e6-4b97-b1bd-03c6224146ff", "comment": "Malware payload", "value": "1f819dd9a9f43340de46d72c65665b669c1cb1b8aaaede6c676ffb6c1006e6e150bb6099ee7af2883e89f4f018c4e349", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873243, "uuid": "2f99b2e5-e273-4d6e-ba5c-ecc4217fd2e7", "value": "T102C4235473E8CF07F487AD7098CCA2CF266DFC056FA6C7677154B389E434E825A82629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873243, "uuid": "706911a5-eb8a-4259-93cd-66e49a7d167d", "value": "12288:U+vQGJ95vnS07h1m0P2ringUiv6BVZhi+m+p5RdzVPVIWFCoD3xRBIW7:UMB3h40PhgUNZhiT+DRpVPbFbDBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724873243, "uuid": "9ee72eee-ae5e-4926-9f5a-89be939b949b", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724873243, "uuid": "00707b12-1d26-41d5-ba1e-eefbf24544bc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873243, "uuid": "7c964b03-d731-4b9d-8e8f-644b87500aaa", "value": "August Shipment - Inv No. 041.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ec62e6-6521-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1724837801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837801, "uuid": "4b7615ce-23a3-4860-b926-825ffecc142c", "comment": "Malware payload (RemcosRAT)", "value": "b8896a4d1adbefcc7fe4cac53b134968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837801, "uuid": "82985c21-42d3-465f-9fae-de018189bfe0", "comment": "Malware payload (RemcosRAT)", "value": "7815d02dd41dd657438b4b226f4ac1a33d6a37159e34448627088e1354f9ab69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837801, "uuid": "ff40b5ff-a30f-4f25-bd3e-8d0af7d10038", "comment": "Malware payload (RemcosRAT)", "value": "e7a68f4c1ac47ecc6cc43b12dc82651cff63f670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837801, "uuid": "69791501-90ef-4c38-b25e-d824603cb5c3", "comment": "Malware payload (RemcosRAT)", "value": "a282a5112d80709b5f203b27b99accd67057441f03066a89228d33c2b5f9ada44e04c67f35f02b2ae944ea3357ebc3d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837801, "uuid": "68f6eb72-4912-4df1-92ae-775983de8456", "value": "T1732512A43A16DA02C9A453FA0DB2FAB4177C1ECEA501D7568FEAADDF7572F012D40183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837801, "uuid": "ad343dca-9e8d-45f0-893d-22ae96dc2bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837801, "uuid": "7c7bc47b-3cbd-44a1-984d-d048c14ee711", "value": "24576:1q7ngtNkKoxK5AP2EwiRcsgL5UNs3hpJB3FcU8Q:g7g7kKoKAOEF8UNYhpJ5F/8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724837801, "uuid": "6a1234d9-94d1-4c98-a9cc-ee89f97b45c5", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724837801, "uuid": "54c10a4e-be5f-4d67-a8f1-3c00d9c7a2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837801, "uuid": "f4747cf7-476d-41ae-a0e6-32c343b54080", "value": "SecuriteInfo.com.Win32.MalwareX-gen.21416.15434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9455a590-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827728, "uuid": "534d7989-cb71-4532-bafe-11431230c91b", "comment": "Malware payload", "value": "3d0e84871180514dc284ce6c2e3c3b18", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827728, "uuid": "a58dfb97-e328-4ced-8772-8fcf65e652e6", "comment": "Malware payload", "value": "78f199841d1270d158d8c8d89c8d998a88a0718c37767ab5d07a18603a24c0e6", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827728, "uuid": "5b0a74f7-ff80-4d75-b04f-865cc6f3b697", "comment": "Malware payload", "value": "f2d28e72b92cd0c796d0185ce84e5185cb10320c", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827728, "uuid": "08f05747-2488-45c0-8b9f-d679f5418ca6", "comment": "Malware payload", "value": "22bed5cb32b612f28f0498fd1802f3171c72a8105c987ccd5e444de74a99fcfb58257ce675659316f42e6231c73b4f21", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827728, "uuid": "c7f89f1a-9985-4621-8966-7eae636eb4c0", "value": "T19DC3A653669B8CB6ECD1677D60DB533ECB29FC60CF360BAAA74494349683254346B383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827728, "uuid": "8c73af8f-523e-4cc6-b8a4-34e5e02a1611", "value": "64eaacc77f10e57934aebf0f5d095b0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827728, "uuid": "5db0aae1-f51f-40af-ab8d-00eea41723a9", "value": "3072:rzS5yCK7q3lC9xp6X3ZkweaQrIRkhxdcbFOgr:r97clCZ6X3ZkweaQERkhxdcbFOgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827728, "uuid": "9658a7c9-18f8-4a4c-9cc9-9ebc3a40764f", "value": 122858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827728, "uuid": "01d0fd93-8b17-4350-a204-0a2e4be0a814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827728, "uuid": "059bcade-7c04-4eb4-ba4b-620771939475", "value": "78f199841d1270d158d8c8d89c8d998a88a0718c37767ab5d07a18603a24c0e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c977eba8-6571-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724872485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872485, "uuid": "d89f8b52-6b72-4584-b171-578171f31693", "comment": "Malware payload", "value": "6d90f5899ff47cd3519ee0f53b8900f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872485, "uuid": "033c7089-0e74-4b4a-8562-2c487def7003", "comment": "Malware payload", "value": "7935b5b0a3c2fe6391fad0065809fbdd361af8a34fce890182a63a312f1703ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872485, "uuid": "c1d2e324-d033-43f3-8dd7-2214b3c763df", "comment": "Malware payload", "value": "1c28f0a93e4258f2370b14c58872ef1987109a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872485, "uuid": "984c8241-09ab-458c-aa13-8d47de30c604", "comment": "Malware payload", "value": "1c2ec5119c6b16e88ce5d10bac198caee865a2db45d3fa0deb316223b1866944fbdad7d890630b2a79ca293586579ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872485, "uuid": "5fe11bb0-44af-435e-8687-dcd316f8a30d", "value": "T1C76423E1FE14214DF3B4B1F468829852920215B6C49EDB6518E5FCE3B1C6F90AF68ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872485, "uuid": "34d79a5a-2698-47aa-9792-040003166637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872485, "uuid": "a6c6aaab-39cb-45a1-b6b2-bb2b4a6a8277", "value": "6144:YvVkn7xeQf6QF0gNW12BTKjV2hRh/SLyzNVkJPvZh5oB4xbHfORnJpwmA0BAGJS:1Eq4gclkhn5V8PD84xrm8WFJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724872485, "uuid": "e232aa8c-69b0-4aa5-92f6-69c13fb4c7e2", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724872485, "uuid": "79ddf170-b893-42b3-808d-62b08a978cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872485, "uuid": "959c3e87-a19e-453e-9f05-3acbc293a009", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260a3857-6545-11ef-b7c0-42010a9c0002", "comment": "Malware payload (PandaZeuS)", "timestamp": 1724853313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853313, "uuid": "663734c4-e14f-4dc4-be62-24ff6e8def18", "comment": "Malware payload (PandaZeuS)", "value": "f60f1cef4b37ff6d39bd7fc8546da1c1", "object_relation": "md5", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaZeuS", "colour": "#A70528", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853313, "uuid": "7677ae45-0f50-40fb-ac31-e1f825ca1530", "comment": "Malware payload (PandaZeuS)", "value": "796f76ee23f02b3ea7db98348e5fd13f601f4843f27277ac64421732c273df58", "object_relation": "sha256", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaZeuS", "colour": "#A70528", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853313, "uuid": "f146a158-d0ff-4054-8bbd-98555b0dee7d", "comment": "Malware payload (PandaZeuS)", "value": "d07d0ca99697ebe5893cfb37ccc3c111bb7e7517", "object_relation": "sha1", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaZeuS", "colour": "#A70528", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853313, "uuid": "2dcfd488-3b6a-4d4d-87cf-d6c9f28021d9", "comment": "Malware payload (PandaZeuS)", "value": "917ffd133274e9c2f42e91de24b923e69d237f33940c60e09a6784f788d4dd2a2d8b5df066aef5e6fd56c0120c729c39", "object_relation": "sha3-384", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaZeuS", "colour": "#A70528", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853313, "uuid": "e2040e2c-5bad-4dbc-94eb-7755d11ab00a", "value": "T1CAA49E10E7A1D124F0BB07B146B2869469387D309BA5C4EB63D9B75E8634EF5EC3270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853313, "uuid": "738065d7-144f-4993-a3d8-5f27417e067a", "value": "dea1060528cb7c9d6273fa68c5d84b05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853313, "uuid": "ddf36cdb-8a32-468d-a849-b0ac5a59fae1", "value": "12288:9432teOjrnveZDAD/mJsX935SSi/HMj0n4cHRo:632te6bAD2Isjkdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724853313, "uuid": "8e2360b5-f6bb-47f0-8a39-a14eade5d9a7", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724853313, "uuid": "86bfb439-2349-4889-8ae7-b3cd526425cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853313, "uuid": "ca029f0f-679e-43fe-86dd-35d7ecae098c", "value": "796f76ee23f02b3ea7db98348e5fd13f601f4843f27277ac64421732c273df58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72efb8a5-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822518, "uuid": "3273d6bf-1c9b-4327-b597-81eaa1b4d4cb", "comment": "Malware payload (Mirai)", "value": "cc8f0630bf944d121e0cd9699ff53186", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822518, "uuid": "54f34cdf-172d-479c-ace5-1a9efdeb2ebb", "comment": "Malware payload (Mirai)", "value": "7c485ffda333072ff00cbc94821d57c33e090fd98650bcba46bfee0960d2667d", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822518, "uuid": "e6ee8438-286b-4746-9a85-dd8e5d2185eb", "comment": "Malware payload (Mirai)", "value": "b35d25d84e8bf99c5aa7ec8b16b13f3b6731bc99", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822518, "uuid": "e8ba55c5-0f9f-484e-8776-e9c4d8aeb027", "comment": "Malware payload (Mirai)", "value": "93f9e35df70508c47f7fa2ad49c61805cf75eaa39b6145d1273b8713051684d42261b3ea79f887930c397ad62785dd69", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822518, "uuid": "ad02b45a-8608-4b3f-84a4-db0408154c0f", "value": "T13DC32856F8808B52C5D616BBFB1D828D772B176CC2EF31039D196F61378B96B0E3A406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822518, "uuid": "27ccb2a8-808d-458e-b855-b779f6b963bc", "value": "3072:oVkofkbp67lNaQQaiivrP5IFsdVjjyNsBomTR9jOcHGk:UkofuE7CQnvzNdV/yNIB/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822518, "uuid": "c352e4b5-86b4-41d2-9bcc-943070236e0e", "value": 129076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822518, "uuid": "73357c3e-baa6-4a7d-a070-1d918d2b4550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822518, "uuid": "6fd20934-9c19-475f-b77c-896d61ce7b68", "value": "criptonize.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe85689f-6507-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827048, "uuid": "fe2fc8ef-e58e-4161-8f5f-fe2ba9b819cf", "comment": "Malware payload", "value": "975f3ce304477c196fe71b6ac3b33c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827048, "uuid": "7b6ed748-11de-4e15-9139-5ce6a722062a", "comment": "Malware payload", "value": "7ccb0d8ec4caaaa85c38536797d66c90b95e278c243607ddf4aaae5461dd2e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827048, "uuid": "f7c1d941-c518-49bc-8c2e-12029236e065", "comment": "Malware payload", "value": "96d183106edc5a8a46b4d1d33903030bdd9091c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827048, "uuid": "ce04f1a1-e79a-4df3-847c-38b01086b41b", "comment": "Malware payload", "value": "5396413c876d280170a854a6d228d63fda00a98bc181d13128f95d3f2050688cca02351957c95ebbecf0c1e1cb5bab79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827048, "uuid": "1cdd222b-82af-4ba7-9264-ec2e002b17b0", "value": "T16B223B08C7E45175EE7E4A319CB322014236E3258C87EF9F62C986271F776E11AA3B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827048, "uuid": "86691db6-4693-433c-ac86-b89144dcc9ce", "value": "192:zoL3UkMIRvzwvQCjU2LVxRa3s8z65UHbDCFaENxD2j7f:rLxcs665QvUaENxD2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827048, "uuid": "42deca60-d75c-4551-a352-7eb284096fa7", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827048, "uuid": "5c9fc3a1-86ab-430d-a8ac-ebbd91a5d779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827048, "uuid": "f9a98e4c-76cd-4808-bdb3-8e910df1c76e", "value": "7ccb0d8ec4caaaa85c38536797d66c90b95e278c243607ddf4aaae5461dd2e8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ed6866-64f9-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1724820676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820676, "uuid": "633da339-88b3-40ad-b549-924190639b3a", "comment": "Malware payload (RemcosRAT)", "value": "7d6c11d30d7322951af23907572b81ea", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820676, "uuid": "30d01720-e12f-4189-b021-dbf9bc0aeee5", "comment": "Malware payload (RemcosRAT)", "value": "7d919f1cc55ce5ee6cdd40968757296e07038d7cb676205d77bacff65baa672a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820676, "uuid": "71d9f948-c891-4d8b-96a7-576bb6213306", "comment": "Malware payload (RemcosRAT)", "value": "e48456f2059d8eeaf2b9a2788cbe53b160dbfc3c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820676, "uuid": "ae58d17f-f8a6-4c0a-9718-34b6c625e775", "comment": "Malware payload (RemcosRAT)", "value": "35d8dd6c79dee831d66a5a1b1ee2766bdf16ac1609a6686d3b49e8c2595d11a6814dd9dd27967fcfee410c998e676b6e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820676, "uuid": "380a4f7b-5e21-4cb5-9095-2751ddb10f74", "value": "T194C4232C32CAEF0BD68B08394DDC695B1FD5AD995F61C85332A637AF2C306E24291C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820676, "uuid": "13ad954d-3c24-4a77-9c9c-fab617a8d9ba", "value": "12288:X+a2GbfPRQaJGEcTP7A9DHHCWoJX5WOJ//Cz6BAiZ3IHV:XlddJDcTPk9jCWw5Bb4HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820676, "uuid": "7d64cc41-6c2c-4508-895a-8c73d92a42ea", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820676, "uuid": "0d5fa354-cf08-4a45-8160-87c00a64a42d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820676, "uuid": "4dd66704-f705-4445-b6a8-e1e8103dc9b4", "value": "RFQ No. 109078906v.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b35bd2a-6507-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724826720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826720, "uuid": "2a30b4aa-5ede-40c1-ace3-cbd9456a2abf", "comment": "Malware payload", "value": "eae570f6f6eac4864a9c648d81c274aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826720, "uuid": "5bd1082c-1aa7-4032-960f-ffc10aaf7804", "comment": "Malware payload", "value": "7de8180e9f1ceca40237aac18aad65a1b77cd2ac6b5d5e62313de3d5a7beb69a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826720, "uuid": "fcbf3b72-61aa-47d5-afab-95cc369c6138", "comment": "Malware payload", "value": "199f5e14447a8c3ed91400774bb57e14aff10cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826720, "uuid": "5a8b2af1-e7a9-4b22-b494-5b9570d1c658", "comment": "Malware payload", "value": "ed43e6303f83b912f5dfef8b10e13cdf5e8cefbf683df401edb2505a06091b0e152740e37d434c43aefffbe4477f02a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826720, "uuid": "3bbd43b0-eaae-4083-a352-19549ca67346", "value": "T1C81733213B558274C5FB14750EF8BA7504BC76A502198EFF0EC9231B4EAC4F2DE299B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826720, "uuid": "6cdef83d-5b76-4ddf-8d2b-1067118f5899", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826720, "uuid": "e760551d-9469-41b6-9693-6e87488a6f0c", "value": "393216:BrV+jxMXcxLYi2nZRjbdDjQchr1sLZAg2zIW64Ld1ZTbqg0B1ffb:7+jxScmfnZpNjx1sLXgLLLxT2Hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724826720, "uuid": "6f9df9ea-b0a8-48ae-8fef-265610d7bc7d", "value": 20197376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724826720, "uuid": "ea5e5d8c-5c5e-4c59-91d2-ca65e2f6b97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826720, "uuid": "d4e2771a-138f-4572-bbeb-83dd4a12ea0a", "value": "00120948320943020320948329038902202\u00aacharged.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbc09b7-6522-11ef-b7c0-42010a9c0002", "comment": "Malware payload (MarsStealer)", "timestamp": 1724838587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838587, "uuid": "1800e920-79d3-4064-ae7b-a5d8290d16dc", "comment": "Malware payload (MarsStealer)", "value": "e70f65be8f27c08808e881aea3f0c9c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838587, "uuid": "7483a0a2-c4be-4a9b-b049-16a05a609de3", "comment": "Malware payload (MarsStealer)", "value": "7f8ea1e8897f9af7a5ced22e8c6a7e07811700220ac2c3ba50375c2c4926d7e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838587, "uuid": "e6f8aa02-9d9b-4926-a94b-d62bfc942305", "comment": "Malware payload (MarsStealer)", "value": "b1069d3bc8cad48b783244c6fef36f8c833bc44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724838587, "uuid": "79fc36ab-fb7e-4138-9f4c-9db8acf75786", "comment": "Malware payload (MarsStealer)", "value": "4527657bf0e8ee1b20377ac01079159d1d48cc3d575828af41275b9c3e89b70b618ae64e00870668f6ebb9fad42196eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838587, "uuid": "9691d684-0356-4cf6-a75e-b1c5d6160f33", "value": "T17D8533691E1459A0CC479330A3E3D116D2ED764254EA52303F5D7BB2E8BBD3BB701A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838587, "uuid": "1968a71c-49ba-4a27-bdf1-3fcf347ed33a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838587, "uuid": "39c7d3e4-4cd3-4de2-b0f3-df221b1ebe0d", "value": "49152:XdUv22NoQU3muYknCReQ48Ci/2b3mCy1OvK9fpqZJF6s:NUv3NoQHt7fCi+oeCfpqzFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724838587, "uuid": "c40f3fa4-dd04-4416-a9e0-d20e70ee1c35", "value": 1804288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724838587, "uuid": "a1897596-d8d2-445d-8c16-0b19d75edd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724838587, "uuid": "87d8a1f3-bc1a-4c64-9bbf-9245adaefcdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1ec97c-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827745, "uuid": "cc6fca68-618c-49e9-9026-2e0ae089ad1b", "comment": "Malware payload", "value": "9cc224098f877ff2b1ef75503c8e732c", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827745, "uuid": "4a1f8c62-f730-4c6f-816d-27dbf1be54e9", "comment": "Malware payload", "value": "8109eed1c7067f6d0f23cb381943a15dbc5b5d2cc24454eb2dc2635dd78dd024", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827745, "uuid": "796d67a3-c50a-4823-a8af-2a3f549e3edf", "comment": "Malware payload", "value": "b0e952bad41fb52d853978c44fd934d1dae8e447", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827745, "uuid": "eec0c7c2-b57c-489e-91ec-e452c1b371fa", "comment": "Malware payload", "value": "31b1421d399ec0829b6f7174fbb0e18cd7cdbd87d36cb8d88a23632c8fcf81b5428b6f47ebdf3acb4a45aab6a5a8836a", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827745, "uuid": "2c0c8efe-f5d8-4d82-8dcf-23114039f28b", "value": "T14BB5E9036A8B4E75DDD23BB461CB633F9734ED30CA2A9B7FE609C43599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827745, "uuid": "5290d3cf-8f68-4c6b-976e-34152750ee0c", "value": "468e80a4a8ce4d6e9e8e29d85706b7f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827745, "uuid": "1c279825-6ef2-416c-8e77-9cf2137d5865", "value": "24576:F++qcrT+Hm82z0LmlbKTXoMe+09vvc7081W+vqe7ZtFuQ5r3h3Yb:FIWKmGj1WHkZti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827745, "uuid": "c6926dcf-4184-4571-904e-02a023819e72", "value": 2337354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827745, "uuid": "4c528829-4296-43e6-a385-8ed43b1ff99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827745, "uuid": "9ca72001-3100-4273-bc4e-60ebea1a884c", "value": "8109eed1c7067f6d0f23cb381943a15dbc5b5d2cc24454eb2dc2635dd78dd024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e00ae23-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724818484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818484, "uuid": "b8cc81d9-e221-4f3d-9b1a-17c11b08e0dd", "comment": "Malware payload", "value": "05ef958d0f0058507de4ec8937820f96", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818484, "uuid": "fb328fc5-8ddf-450b-bdea-14bf7d3dcbd4", "comment": "Malware payload", "value": "81b7556c522c4cf522e00f1970354404f10c2722bb09a63943c47790c779d3c6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818484, "uuid": "c4cd1052-201a-419f-b325-743762e2d809", "comment": "Malware payload", "value": "1457663ffec9ba96292fd087a6112862bc0ce558", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818484, "uuid": "15cdd4b0-8e3e-4f3c-ac96-56e3d584d6e6", "comment": "Malware payload", "value": "3c9db146ff0e416373a98f207a25c929076fb354d18b50a2164bd81c278494e7f0be30109ce218c88036b906d05e6b2e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818484, "uuid": "e8b62ef4-afaf-4b37-a7cd-bd053c85ab39", "value": "T1BD961247F758A82FC47790F649AE5732114B0D068A83D7476E58331C68B79D83F9ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818484, "uuid": "b4413277-541c-4061-be24-4e15438b4098", "value": "196608:9rKHXsmKcXPOoAqktYBeAa2Fw5nQMLMwfkOrJ6hm:90vfjADtYBv2qMIIrchm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818484, "uuid": "2da368f8-bfad-4351-bd01-514b1f9285bc", "value": 8992599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818484, "uuid": "e33b9407-a71d-4643-aebe-ca0801d31208", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818484, "uuid": "5de667ea-df1d-4763-8f80-c18bb6070e70", "value": "wdfe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd67b348-6591-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724886263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886263, "uuid": "e5179c0f-a0d7-4a9f-8415-903145796064", "comment": "Malware payload", "value": "d64bcc000feb58a339000dc069a02efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886263, "uuid": "db86f9ae-ae3d-4375-93b4-b1b9f9483ca8", "comment": "Malware payload", "value": "81e8bab67673dc5fbba053c17e2f985d9aa05a8df2d2ae06f081ef766e15e23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886263, "uuid": "6aae2810-f78c-49bf-aceb-5ee6e8566dde", "comment": "Malware payload", "value": "047406570ae843ec7b7750a65ee4077573dc1cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886263, "uuid": "ebab2346-9770-4c74-96f7-a0ec297b3018", "comment": "Malware payload", "value": "5d27a2ce69857552b757d24df73daf4d91d41afbd352b7f555ee8a033d7ffbacba6d0a26d4dc08d477025183defc39de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886263, "uuid": "9b793be2-17d3-4783-bc8d-2e57aa3dbc9d", "value": "T1F8F41258AB08DA16C1D007710661F33566A95E8DF822D3A7CFFDBCDBBC36E166884312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886263, "uuid": "b6037a05-ae87-44e7-a2a6-ec9a2f4bc218", "value": "12288:3JBZ8G1w0TwxCFvijGiFj1SISDaNSwMRndFCCPee0KA4DJMVjM6LRHizSL:3JH8EFvIGqpS3aAr3FhWe0n4DSVBRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886263, "uuid": "b1336874-43ae-4ded-b448-e38632f64804", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886263, "uuid": "22e6c2bb-173c-4d76-b96a-eee04b1395d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886263, "uuid": "5b22228d-0f13-4e02-84f6-cc295c995011", "value": "rSOA-2024INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad094a6-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827739, "uuid": "dad520fa-206c-407d-998c-a15e90c5358a", "comment": "Malware payload", "value": "f87f739750953deb8962840343721119", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827739, "uuid": "7eecd2e2-fcec-4d25-b7f2-34b16bda69ca", "comment": "Malware payload", "value": "828b4892032347f10b4da66b64e6c7361bb27edc03496ad9a288758d0c7abc35", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827739, "uuid": "84b57ed1-1c4d-497b-a73e-3e55f1d976c0", "comment": "Malware payload", "value": "13571ffeb39ffa1a6e1f082758d2ee8ea3b380cf", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827739, "uuid": "28effece-304b-42b7-a74d-74ba6ff7297f", "comment": "Malware payload", "value": "c96dae1501d20041b25d4d3ba712f55f01f95c672acc6dd825be8b8833fcd8ec02231369362e2c98a9aafa3f59c5f4b6", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827739, "uuid": "df34d964-e12f-4c6b-bed2-552c390a2794", "value": "T1ED23F895BA648CEBEA51633E84EBC3775B7DF1818B235B53B734B63017137923094246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827739, "uuid": "7b516339-c8ea-4c1a-b8d9-fa29f2515df6", "value": "0cd785ec9a8b789119b2f9d9ba6a6091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827739, "uuid": "2f062a3c-d618-400f-9b82-41c3d89959b7", "value": "768:GnqxE87N7qFL4M9QFMmM1JCPP3lLuzZPKqgRrtsSnru:NN7q+MSFMmM1JCPP3lLuBZgF+Snru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827739, "uuid": "5cacf91e-e439-451b-b9de-e0fbf0fe069f", "value": 47349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827739, "uuid": "0d3da154-5c4b-4d93-87d8-6200997c913a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827739, "uuid": "35f685a8-e9ed-4639-90f8-750939e41680", "value": "828b4892032347f10b4da66b64e6c7361bb27edc03496ad9a288758d0c7abc35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9aba48-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AgentTesla)", "timestamp": 1724840146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840146, "uuid": "320ad05a-d752-4f95-954c-35ded4bcbcc5", "comment": "Malware payload (AgentTesla)", "value": "f00b2621ba35e3cb7e4eccf8b9dc6328", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840146, "uuid": "50dc078d-1d9b-4ccd-aaf1-8cb6dfd1c004", "comment": "Malware payload (AgentTesla)", "value": "82903347dce74dade6fe581fa776ac312af0bdf508c42b66a36c09ea439c1bbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840146, "uuid": "ec10227d-22dd-445c-bc14-96d205f30f96", "comment": "Malware payload (AgentTesla)", "value": "4d56f4cc97feaa2a0811814a2e0df436d1ccc2e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840146, "uuid": "78333632-4227-4bd9-a16f-59ee0edd1e9c", "comment": "Malware payload (AgentTesla)", "value": "13ca55ab64523fdfd021849543da05f435454588d9998fe6e23a7f539db86551ce6f789e43da35c5b95c77748625c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840146, "uuid": "1c7551c4-3581-401c-8946-1c66b28925dc", "value": "T14FE4234957882607DFAC4EB351526889D432FBBBC012F2875CDC9AF58F6539CC212E9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840146, "uuid": "ea92a59f-c58f-42eb-88a7-ddf9cc427a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840146, "uuid": "a3300f60-d363-46aa-bb87-de94bd36c759", "value": "12288:znPmsw4E9d7xzFoitQVJsK5qIoEFMz5xrZcyG4Z5Sn2lCm3N:qXdftQIKa5xFcyGQeq3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840146, "uuid": "9d3643ac-ed87-4bba-ba81-c18f2c810cf2", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840146, "uuid": "c0e8ee9f-56ca-4ef8-acca-4e1e9e366171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840146, "uuid": "21f624b2-31cf-498f-a312-916130802155", "value": "Revised PI 28 08 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2fe48e-64f2-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724817726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817726, "uuid": "cffffcbe-0949-4ec8-94f9-06d1add92e7e", "comment": "Malware payload", "value": "58a9f75587814d01d91d0dae34bfdc1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817726, "uuid": "35427bc4-c691-432d-81f9-911189dbbac5", "comment": "Malware payload", "value": "844f95588f8c5c96f0c7c51589d6720abaf0baaf6d5c1ab419c026e1e44baca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817726, "uuid": "b0498211-429c-4649-9c41-b871222fe4c3", "comment": "Malware payload", "value": "dc720df7a587598fcfb509a8836c64c9187c35e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817726, "uuid": "45a82cd8-dce7-4628-a530-5e0fded12354", "comment": "Malware payload", "value": "cb61297c0a106edc2cbe336309dfe11c1599a99334b871aaca4d66ee2e044466955a706f295e93cc2d7523dd6403e64d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817726, "uuid": "83fd6be6-812a-4eb6-9e23-0dba46ef7884", "value": "T11416137AF5D18437C1336E7CDC6B6754A83A7EE01D28208A7BE81C499F39781352A2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817726, "uuid": "acbe735f-9a0d-4a94-992b-7aa98f740a2c", "value": "8d08b9aff260461badc1821f4f717247", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817726, "uuid": "93de8b6b-3573-40fa-a57e-d93ddfe0fa53", "value": "98304:bPOAdd/yzt67OU7apTPOAdd/yzt67OU7apv:i0azg7DSa0azg7DSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724817726, "uuid": "e155c516-abbd-4319-9b31-c5073bae8567", "value": 4158464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724817726, "uuid": "25f0071c-da0a-416b-a100-3cbe617cb267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817726, "uuid": "84a4eceb-8880-47a4-90b2-070600752329", "value": "simulator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6e0b66-657e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724877891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877891, "uuid": "9894b947-240e-439f-bbe1-b7cb00539172", "comment": "Malware payload", "value": "b14ef85a60ac71c669cc960bdf580144", "object_relation": "md5", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877891, "uuid": "256e7b1a-f36a-4a5a-afa0-09b755791ed7", "comment": "Malware payload", "value": "861911e953e6fd0a015b3a91a7528a388a535c83f4b9a5cf7366b8209d2f00c3", "object_relation": "sha256", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877891, "uuid": "660e40f8-07b5-4836-87f8-d4f86bc92376", "comment": "Malware payload", "value": "08906644b0ef1ee6478c45a6e0dd28533a9efc29", "object_relation": "sha1", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724877891, "uuid": "69186b24-0f7b-4b7d-88e4-21381c89826e", "comment": "Malware payload", "value": "6cd560b9bf1775e9e777fb0abe681351a0e36271aa248fad4d6f2b4522bf02ba6719fa473a58b9ec138ab9eb36a1890c", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-60", "colour": "#F85DB5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724877891, "uuid": "6dfe66c1-9931-4479-a13d-03b689e907cc", "value": "T1E8E36B06B480C072C56E29350574DA726B7FBD30DF64ADCF67980A7A9F702C1CF25A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724877891, "uuid": "4d6fd0eb-71b0-4b7f-870c-d3143f7de361", "value": "2634f378ea222ed85ede1cf7f9951bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724877891, "uuid": "d6b0bf47-1198-4604-8b83-1b157b009b6f", "value": "3072:X3ri+nr4ciRGSuaHUCO25obTBhH5P1KCJN6hkf1GYn3:X3rv2RGPwUC5o3H5PVLln3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724877891, "uuid": "008702ce-b0c0-43d8-b7c2-0a8b58789829", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724877891, "uuid": "a8414b06-fdbf-497d-900c-68ef1f368fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724877891, "uuid": "43726e00-9ed6-4f68-8723-15be72769854", "value": "Dll1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f63992d-64f7-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1724820016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820016, "uuid": "2a666d99-3a02-4b76-b763-6255c35f1e99", "comment": "Malware payload (RemcosRAT)", "value": "c93e3ceba7ffac7233a34ea7a200dbc9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820016, "uuid": "14655431-b4ea-47b4-b3d8-86d131981924", "comment": "Malware payload (RemcosRAT)", "value": "8836480326749607ec6118cd896936d6cb1f4ea233276b96081e104e24bc32c5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820016, "uuid": "ada3e4f8-89db-4f08-8b47-dd7df5f60d57", "comment": "Malware payload (RemcosRAT)", "value": "59df224a669cf7126117164d43467f25d7899693", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820016, "uuid": "2f0cf7c2-3844-44cd-8bd3-b2717b1a2066", "comment": "Malware payload (RemcosRAT)", "value": "8814469ab9477383fbafd66a5e9d66c73ad005237f7ebf2b1139ed164557001c9e4919d9063e6519a65ff5ea758dd288", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820016, "uuid": "1ec4845c-1805-43da-9645-ebc4bab76da2", "value": "T1D4554BA2E1E00433C91115FBF487B3953A1F7BA55A1E65C1A6BE2B344E35EC82411FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820016, "uuid": "25ca372d-7dbc-4338-a3b2-2123276ce242", "value": "24576:2yVUtUIs676KRrJLtUmJvYlWGFCMk6EUwQs/mSEMnq4aQVB0lUv:2ysbVDjfn6E1SMTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820016, "uuid": "873e4c89-7f02-4b1a-98f6-a708fa1b8777", "value": 1342931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820016, "uuid": "88637b91-317a-47dd-aba4-5ac2dd980d1a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820016, "uuid": "75297f1b-2112-4dcf-8d61-16c9b16f2735", "value": "Doc34&Payment478975.txt.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6322201f-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822492, "uuid": "59f92bb8-40de-427f-b926-6dceb67abd90", "comment": "Malware payload (Mirai)", "value": "de9fb2ae1eb3ed922602b1c1667553ed", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822492, "uuid": "8082b6b8-9b5d-46f5-84b0-5e2d970dee07", "comment": "Malware payload (Mirai)", "value": "88c010036965d27752d431a59a7d29f6a9b4a663d7b332af1329bb1b33e86788", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822492, "uuid": "99194870-94ff-4690-b5e3-6bd12012625d", "comment": "Malware payload (Mirai)", "value": "01c76bbf48626b6590488e549e2afebb9fe60e19", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822492, "uuid": "7b6beef7-1329-45a6-a614-aba7c65b444f", "comment": "Malware payload (Mirai)", "value": "e381169066b466aa31741977c54215558ce5927be966e95ed90238899be427f24ea30f9f51a81b281de432280d7c3401", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822492, "uuid": "b0b76a25-64c9-490d-98a2-5020a9fc7c90", "value": "T1EB04E80A9F620FBBC86FDD3742E9061235CC955722E83B763578D928F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822492, "uuid": "4b16df07-2023-4294-91b0-afb7cd9463bc", "value": "1536:tzPvsDJrPlYzZ7CLwL+mOgjCxOdHuxNGlcHi7p/6Wwb0kSCviyo5zbsDOlRaNNo/:ln+JpYtmb4nzdEvordLwwTkRcV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822492, "uuid": "c588364d-ffb2-4abd-9ca1-6fad04623b6a", "value": 177776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822492, "uuid": "e4ddc3dd-8bae-461b-8ea3-132e1796c283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822492, "uuid": "b66267fc-66c1-4b27-bded-58cf6e74e08d", "value": "criptonize.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e9a312-6505-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724826171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826171, "uuid": "c84f9f2e-1aba-4bbe-879a-859f3242ae3b", "comment": "Malware payload", "value": "a09d6619f763a901af3b8cd473556937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826171, "uuid": "a689b84a-0f22-4ed5-8dc0-da3a43dce53e", "comment": "Malware payload", "value": "8a076222fcbe733eb3e729f12117a23a3062642f47e9bde0aca1712e1996e568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826171, "uuid": "daa7ef43-295a-48a7-8327-f26eb80a5272", "comment": "Malware payload", "value": "32684069866deb1bd1669996caa8ff34c02f84c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826171, "uuid": "f0d6430e-5bb4-41d7-b753-67a07c33392b", "comment": "Malware payload", "value": "46538f15bbe08def5460569b4451597f45db341d66247ab111236296cd530909baa3af7f8693321ab6bdd62b143dff30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826171, "uuid": "cd587e76-8981-4c12-a8d8-993a00039fca", "value": "T18977197F66A48179C12DC13AC2978F48EA337C751B33C2DB52D936684A729C49E7F221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826171, "uuid": "999b26e6-6b6f-4419-835c-924491267d3a", "value": "a103cc658d452603d9847cbdd37a50c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826171, "uuid": "c4499d44-4482-423c-83f4-8debb1b74317", "value": "196608:3BN2+VYsIb5pJBfAl7TNaS4QMis14ZZk6ioeo2k1X:3eGioeo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724826171, "uuid": "214b7dc4-5ded-487b-8793-089f39d7e68c", "value": 33584737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724826171, "uuid": "4a9b03ea-a44b-4621-955b-ea8bae18771b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826171, "uuid": "8b4cf820-0b34-4088-9c1e-d808e4a64e24", "value": "8a076222fcbe733eb3e729f12117a23a3062642f47e9bde0aca1712e1996e568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9604a4a-6587-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724881907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881907, "uuid": "3a8ae795-3e1d-4f52-9c8e-01627f4a29a5", "comment": "Malware payload", "value": "4d64dc26add3df7d8fbe10f48e8eda25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881907, "uuid": "303ed2a2-2b40-41f3-9dab-5a8ab4c4e051", "comment": "Malware payload", "value": "8a31ca87b44095b2d642519cb949c944e2ae434f6652d1ee8772ce1e1168dae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881907, "uuid": "50580da1-586d-43a1-9aea-10fd4531b158", "comment": "Malware payload", "value": "b085e74be196cff9e00c2273f10bd3cd919fa77b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881907, "uuid": "c896efa8-feb8-42c7-9621-48c9df91161d", "comment": "Malware payload", "value": "e4a4710d9b3c54eda9fc6ae5a7b9498975e24cf9b1d5b3e164abc44e3c28ceabebde00a7116bf1dfd660359a4d219879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881907, "uuid": "dfb9d5ba-320a-443b-90e6-ddfc41a39974", "value": "T14577339627A71CF5EE2467746820A0E05F476CB83BD0605D7FF9F98E89387C8247C962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881907, "uuid": "d37839ac-f6b5-4a5f-abc8-e318146b61f5", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881907, "uuid": "bdb5fdfb-c4b3-40ee-9189-e053d30cce08", "value": "786432:dUafUN8vBN8vJOd3k9Q4sfA3Ui0AUkmaSC4vrWpiVh/XaM:dUafUuZNcJF9jGfi0NaSrYij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724881907, "uuid": "bc28bb16-e505-479f-bbb0-ec4da446d2eb", "value": 35793984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724881907, "uuid": "0f15b114-5be9-4093-9f2a-6451eaf7e6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881907, "uuid": "0020c86d-d261-492a-86b7-5b118c9db083", "value": "3644-navicat150_mongodb_en_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f63bafb-64dc-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724808312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724808312, "uuid": "8ca78a9d-7477-47a7-9d47-5ee180bbf675", "comment": "Malware payload (DCRat)", "value": "6025a81b50a121ec04fa647263b2c7b6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724808312, "uuid": "64ccb2c1-1ace-441e-80d3-ff7337c61c83", "comment": "Malware payload (DCRat)", "value": "8a542076ec9b9522127f2c63954f51720b7a933e701a902c853e8abb37bad7e0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724808312, "uuid": "5fa1fd3e-f225-4864-9336-3758c26fd23f", "comment": "Malware payload (DCRat)", "value": "8983c09293cc8c71e07c900967240f74b9e2f476", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724808312, "uuid": "e9722e10-087b-4c66-9a9e-eef6e5663db7", "comment": "Malware payload (DCRat)", "value": "eb343f7ed8e39e19d092a0442d00ee89a418d89c5f2727e845854bca23e1e533430a8ba38efc22a6c8f97f3c44c26fb7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724808312, "uuid": "43be9ff5-447f-44ae-b09c-22b1549651a2", "value": "T1EC759D027E44CE11F0091233C3EF498857B4A9516AA6E72B7DBA377E95123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724808312, "uuid": "2a092685-9676-40be-8458-8cea604f1227", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724808312, "uuid": "73e3dd45-9092-4b1a-96ed-236e14e3cd43", "value": "24576:ruHwIVX/tL/8cF0hrqjyR6ugwyYKkxZNPGsW1xDRJy1jlElhpM9bkT4u:ruHwHcF0GWjyYRnN+sexvyLEl3M93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724808312, "uuid": "9974306c-aab4-45e8-b5ee-7131efcc95ae", "value": 1686016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724808312, "uuid": "12aab603-dbfe-48a7-9292-c08db10607d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724808312, "uuid": "6f1e9ea2-dc04-4803-a21a-057c4b5b6131", "value": "6025A81B50A121EC04FA647263B2C7B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439db0ca-654e-11ef-b7c0-42010a9c0002", "comment": "Malware payload (NanoCore)", "timestamp": 1724857228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724857228, "uuid": "26a55d54-c633-444b-9718-fedac9b66012", "comment": "Malware payload (NanoCore)", "value": "15bd4ca6b9d238c9eca4159e5ac550c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724857228, "uuid": "b78de87e-60d0-40bf-989a-7857c8c7f360", "comment": "Malware payload (NanoCore)", "value": "8bdde20f5655fa32fc546f3b4e66b3b2a2872c0e55a73c377245808ffd218829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724857228, "uuid": "fb909e61-6709-4a0b-853b-9215f8db13aa", "comment": "Malware payload (NanoCore)", "value": "b184f22c346fc02f7eb98d979434cb5ee945cb05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724857228, "uuid": "ca492795-54f1-42f4-9bd9-5e7d84c41f13", "comment": "Malware payload (NanoCore)", "value": "e9d7c8c6bb4044363b7cc1469a09b0dc132eed3250fa52b60b71e8741abacf7712ffab442c105e81ef87a5bfbb95adf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724857228, "uuid": "24d0c46a-64dd-4c04-be26-af4fa8f5c51b", "value": "T14A2523E77585F6D3E3BBF8B9680376A2C8EE170C1F37293949D89805460A7C019B77A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724857228, "uuid": "71fc3ebe-d346-4c69-8ed3-12ef4f0e21b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724857228, "uuid": "1738b08e-b8b3-4c95-a84b-05c68b97b156", "value": "24576:Mnpn/lsoEJvYWVX7UiLS2z+Q++D00BKidflm3ilPm:MnpnN3oYALU12z+UDjBKQl4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724857228, "uuid": "64a57d81-bdaf-4e97-bb92-4d000e15d6c7", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724857228, "uuid": "a3bddb69-c8d3-43c0-ac18-db13f071e7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724857228, "uuid": "4e5b2c3a-404d-4976-b1f4-3a114868d983", "value": "Accelya NDC SPRK.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf03677-654d-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724856974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856974, "uuid": "f86ee07a-59ae-4487-bf2d-6427c8648dd7", "comment": "Malware payload (Formbook)", "value": "1965f06fb4c6e169c7014c90c5b93199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856974, "uuid": "adfd44f2-56be-4f33-85f3-b8901b0e5ba8", "comment": "Malware payload (Formbook)", "value": "8c92b39496a1f938d9c16ad3e1a7948b48923fd028e23a422c5bf8f0b7e1138b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856974, "uuid": "81b6eebd-a043-4db4-946c-566b42034e40", "comment": "Malware payload (Formbook)", "value": "a8a949da0262c8165e52fd84276b0f299a86db2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856974, "uuid": "413292aa-9ae0-49fd-b2db-40b6a32e359f", "comment": "Malware payload (Formbook)", "value": "81dcd5048cd223e984c3ab5646a377ccc336ea09239d4941027559e87ee7ef5b00b52281812fc655f9aadfc82e07b195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856974, "uuid": "b116f85e-dc5c-402a-a42d-fbc71d2d9733", "value": "T186E422895ABAAF33C5FE83F1D041145A03F4DC54A062E7772FC650E26F6978089C7A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856974, "uuid": "3b61108d-0313-4e77-b7cd-f700e5358f0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856974, "uuid": "239428c5-122f-436d-92df-9d0cf25a8fee", "value": "12288:z4UkfadvMq2bjiwAszlTRPipvBjxOqEEtMcLsfSbASQi8N0DjmEuv3/s0z3/rO:EUjVKmw5TZgkItMcLsfSbMqLwPb/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724856974, "uuid": "2030a76f-7e22-4288-8588-070c3f02c727", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724856974, "uuid": "edee65ee-28d0-40ac-bd56-a27eae81ccf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856974, "uuid": "1db9c1c2-6ed8-4884-95ed-49bf538b684d", "value": "Ii4XtPGi5n3AWmt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d351998-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Meterpreter)", "timestamp": 1724827555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827555, "uuid": "e55a5be5-315a-4543-96a4-ea6a9ccbfa56", "comment": "Malware payload (Meterpreter)", "value": "9b398f5a75e3df8c14177e5b54709df9", "object_relation": "md5", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827555, "uuid": "5665ff87-1304-4115-9a13-59435a1c5509", "comment": "Malware payload (Meterpreter)", "value": "8d89a1e4a3e6bfbf7f1e71a7437d62babfec32c5d3326ae14b2642cd24b4be6a", "object_relation": "sha256", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827555, "uuid": "7835dc43-7292-41c8-af65-b3adfb67fb14", "comment": "Malware payload (Meterpreter)", "value": "01c20d533a34ddbefd59363131317f2a589bf6c8", "object_relation": "sha1", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827555, "uuid": "e5d18547-2cab-4723-a3bd-d0d436143798", "comment": "Malware payload (Meterpreter)", "value": "b1bf91494cd785d4d2f0af2ae6632fa8cf895d74d0e2037db7b7df41634d188b538302ae0dc0dad6a6622ed6200b52b9", "object_relation": "sha3-384", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827555, "uuid": "c2549350-b363-44d9-a319-0fabd1d75bfa", "value": "T188C3FE9C766072DFC857D472DEA82C68EA51787B832B4213B02F15AD9B0E897DF141F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827555, "uuid": "b4993e5c-5736-4eaa-95ce-195188ac5fc6", "value": "768:Cz9FE2QitHEMPukehR3wRuu2U++eLXQ38BRL049ldXfV1pJU9t2AXBoLijlrncI:IfENsEMPuv3SMBZldvVLJA2AXKMTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827555, "uuid": "bf5ac9b0-5610-45bf-8e87-2bf007070296", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827555, "uuid": "6b635b1b-9cc2-4d1f-9ee2-7fef82f3026e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827555, "uuid": "8d125356-cefb-41f6-83df-0814e6e8c370", "value": "update.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51229c80-64e6-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724812583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812583, "uuid": "9e28222f-21a6-48b0-a7de-5b258404d722", "comment": "Malware payload (Formbook)", "value": "e397cbb1c3415c22c208e017e3033add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812583, "uuid": "9643aba8-8373-4b44-9584-576f7de4169d", "comment": "Malware payload (Formbook)", "value": "8dd71775cbcce704b0ba2bdb6ef5caf68a3ebdabaef0c7e9cf2feb83f8bfb83e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812583, "uuid": "f592ee63-7ef1-46aa-a903-567f47e0bd08", "comment": "Malware payload (Formbook)", "value": "182d199915b3c1bef993fd15feb9603d2a34c7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812583, "uuid": "38fce3c6-2ebc-41a5-86ca-4b811b82507e", "comment": "Malware payload (Formbook)", "value": "0a3c19cf6f6227635982764c3459660edf5d3cd9a2e5f961bf3faf7d58f53632f4ef22485f2c52ff13340504a4a93b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812583, "uuid": "b4a0ddc7-ebfd-427e-91d7-ea0426e96a85", "value": "T1BF45BE0273D1C036FFABA2739B6AF64156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812583, "uuid": "d8481a47-e762-4860-86f1-986873f3bd09", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812583, "uuid": "4c021221-530c-47a9-a096-67163991bef5", "value": "24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaq0nQyPFA71fMXw5:ih+ZkldoPK8Yaq0QKokG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724812583, "uuid": "0c8048b8-2d44-4fc0-969c-cdab2893bde5", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724812583, "uuid": "333539a9-64fd-47c3-a6a8-9a9eb92042ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812583, "uuid": "a24cc904-956b-4fcc-84cf-04b551f03da7", "value": "Inquiry_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd50a5f-6577-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724874799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874799, "uuid": "136e4240-e86a-4eab-a55f-3daad7fe72cc", "comment": "Malware payload", "value": "c7e47553b94c0d18ecf9e03b5ffec68b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874799, "uuid": "987e903d-9f81-4acd-abba-2f6de7bb3970", "comment": "Malware payload", "value": "8ed7810c7c48d274f4b845cb155ab61af9ac0297fceb2f356ad5557434977b5a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874799, "uuid": "032c750d-ce3f-4d23-9560-99c77e73a211", "comment": "Malware payload", "value": "bfb60db9ad9e0bd41ee2335acaa6316264c0b638", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874799, "uuid": "495ba2e1-597a-4aa3-b7f7-8f2b07ddacba", "comment": "Malware payload", "value": "6e6a2a2473c612dc8ed4a6f5863d9c5a658c3e705c7910bc8225a18e8946e5f567d13c3a55756e03d016e236885615e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874799, "uuid": "de086506-6bc8-49b2-a147-feed9a2777d6", "value": "T1AAA4D62BBEE39DD09D2801952EF60C2DDD645F5F46E2A1BA5C8662D03EC114CBEC98F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874799, "uuid": "a86c5cc8-fd11-4260-836c-4490dbd1a64c", "value": "384:JeeeeeeeeeeeRReeeeeeeeeeeReeeeeeeeeeezeeeeeeeeeee8eeeeeeeeeeeRe4:Heo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724874799, "uuid": "23b34f6e-2055-4e20-b56c-971eb9bea01e", "value": 451976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724874799, "uuid": "64a90533-8351-4058-b430-7f424de93bb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874799, "uuid": "cac1f04e-1ba6-45c4-b013-30a4f5a7032c", "value": "New_Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fdce87-6592-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724886379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886379, "uuid": "bd00571a-75cd-4eb4-8a4c-6fc8d90130b2", "comment": "Malware payload", "value": "3977f99d25b05899eac55bcc92d40cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886379, "uuid": "87a481b8-5990-4850-b08d-a88a3aedbc40", "comment": "Malware payload", "value": "8f66087a136da4cc49c15eec3b25f784077bb2fb1f8b583765a6f0236fbe71fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886379, "uuid": "e18d219c-2ca6-40b3-a98f-96a1847c23aa", "comment": "Malware payload", "value": "7f19beeb331f5c224d46f16abe143af3332d56fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886379, "uuid": "ddc5f617-a891-4322-bb2d-9ef91f259a50", "comment": "Malware payload", "value": "0f8e89e9cd7b37b42ce95bbc9a1a8b0dfa3f6f4fea034c450a085d8e83fb38381d87c1ca064ad0fff7897424a192c8c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886379, "uuid": "44034c81-477a-4a08-8dbb-d7adf6c215f8", "value": "T1E8554A95E2E04433C91105FBF487A3A07A1F7BA1961E64C1A6BE3B740E35EC92415FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886379, "uuid": "e606768a-47b7-4b59-bc2b-beaf14432d17", "value": "5faae8ff15155ab8458161fbe501fca8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886379, "uuid": "63417e73-540f-47a7-8bdb-dc3603a523b7", "value": "24576:7OVUtQcs67m2R3FL5YCJv0lWeF2Sk6AMskY/m2AIvO4+UVBAlUz:7OkzhjHLF6ApqI/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886379, "uuid": "15048a41-7284-4635-b3c5-7053f39b26bd", "value": 1342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886379, "uuid": "2936f1a7-eb5a-44e4-8b4e-ddd035635978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886379, "uuid": "7715c028-c01a-49ae-aa28-1cf10115daff", "value": "z1209627360293827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2909417-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827350, "uuid": "989e5a81-3802-4c79-853c-67222c29c0c1", "comment": "Malware payload", "value": "59c049d2b99f5e6f079c6ba16f1cd596", "object_relation": "md5", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827350, "uuid": "53fe4a99-978d-40de-8756-4fa20c685d16", "comment": "Malware payload", "value": "9131f8c69d17d94065f3eb94ffab122f349f573f1cd9b81c73150bfe3e334ad3", "object_relation": "sha256", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827350, "uuid": "980566e2-d08d-45ae-b426-47746c5b697e", "comment": "Malware payload", "value": "4c1c9828cbf1ac915e0196ebd47017f1d8624288", "object_relation": "sha1", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827350, "uuid": "b1941282-c653-45fa-9dbe-7180759e21cb", "comment": "Malware payload", "value": "3968b61f14e207c11a30919957d3487c02bbffa456b7afb5efb8d7bcda4034537e2f37aa90adc4cc2b0f0f8086651151", "object_relation": "sha3-384", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827350, "uuid": "bf9a2e73-6012-4418-8864-2adf84231887", "value": "T1F285494B7CD458B9D0AA83328976A1A17A71BC180F3227D72B90B73C3F72BD49A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827350, "uuid": "65a84afe-a10a-4cd6-8be5-1bcca9320a31", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827350, "uuid": "339dfc45-61dc-4fab-8260-dcb89daba351", "value": "24576:xgL05V1SFxdsMnYA9oCeUwVjJ9kYVdTgN8ws6nYLdfw2b:xgGV1CxyKgj1wspvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827350, "uuid": "79ddc6f9-9dcc-43c4-9012-db4c6e0f3159", "value": 1830912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827350, "uuid": "90786d21-b217-42c6-914c-aa0f01ecedd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827350, "uuid": "08dfa705-d72a-4b6d-9560-fc06cc2ceb31", "value": "9131f8c69d17d94065f3eb94ffab122f349f573f1cd9b81c73150bfe3e334ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8897fe06-6587-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724881825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881825, "uuid": "591c652a-d7e2-4ffe-83ed-6bd0267bbf4a", "comment": "Malware payload", "value": "4b90b9879e014140ac5aa1f75fa616c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881825, "uuid": "560d1ee7-1572-40b7-ae56-45f27b25b46a", "comment": "Malware payload", "value": "914e669ed71f3fb05c403dc2fa460b88fea99cfaeb034d2fdb76fc9736b2febf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881825, "uuid": "a3fcd2ed-c710-4fb4-939a-3a316dc2d8f3", "comment": "Malware payload", "value": "4ed19e9a983b9b3d6980cd76cbc46da1d32b2ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881825, "uuid": "6d96b187-37dc-4732-9491-34705700c0aa", "comment": "Malware payload", "value": "731b66a9bad404d6eb56a4a6361706e67db4a57cb8cc23b4e796dd31206b0a0cb8107457ffdd3c0d031ba60d0b420b17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881825, "uuid": "fcab541f-626b-4a0a-961c-3cbb97436bbd", "value": "T1E0263303E3C38132E969B93DE23A90601E5BB81509F571192EFED78F5BBADC95530722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881825, "uuid": "0f5af83f-3cd1-4cb3-8445-076a46da59e7", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881825, "uuid": "b7156f40-bf17-4ddd-9ec8-1f136fcf23ac", "value": "98304:6491//V+v6hY71mAgLhkRLUSjA6y3q7+qdjoX:64X/VqYY71mAqkbjMq71c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724881825, "uuid": "4f57ac65-2d61-4e3e-92e3-f4a3a1f40f67", "value": 4762120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724881825, "uuid": "4104cf20-bc68-47fd-9aa3-0a0ea51679c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881825, "uuid": "421a728c-731a-448f-8282-072ed8b775f4", "value": "16-bitlockerrecoverytrial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fa832b-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Neshta)", "timestamp": 1724840289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840289, "uuid": "fae713ec-2c1a-4a2a-a869-5aec24c385e8", "comment": "Malware payload (Neshta)", "value": "5f370b24761ef8ab26041180045b23b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840289, "uuid": "479970a2-b064-4ab4-b2ae-f934363a92dd", "comment": "Malware payload (Neshta)", "value": "91b8af35769f15b481abd67149689496ce24e6a68e6922a9c229d7a5201f4842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840289, "uuid": "42dfb64d-6c56-4149-a481-98da0b142ca3", "comment": "Malware payload (Neshta)", "value": "f5ce75a16de948fae83d3147a33fdfdcb9034cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840289, "uuid": "73abcaef-9480-48e5-968f-0dc5c5f849dc", "comment": "Malware payload (Neshta)", "value": "1a0df3915d6093b661bb4a2a396923fd3ed80effa0726d5635ff2d4690de12f7f10c5ab2e76c7ed5d30e66ce2f66fb86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840289, "uuid": "c8a9397a-f206-49dd-87c9-73ea8c6e015e", "value": "T10455C00273C1D062FFAB92334B5AF6515BBC6A260123E61F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840289, "uuid": "322d0683-4c42-4dfa-97ce-5227ccc8121d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840289, "uuid": "27b202d4-ff09-43c7-a0c2-e1999f7db033", "value": "24576:vqDEvCTbMWu7rQYlBQcBiT6rprG8avybQAmXNYrCasiDq1/247:vTvC/MTQYxsWR7avy7INY6iGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840289, "uuid": "ae077224-0e75-4474-9142-4e56fcb8efaa", "value": 1364992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840289, "uuid": "3df3b92d-bd5f-4ab9-8d97-708dccb22561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840289, "uuid": "4f297f09-8add-4fa8-9a27-03ce6a6c6be9", "value": "TT51109240018351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f94fb1e-6506-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724826244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826244, "uuid": "b0d0a7c1-febf-486a-8245-f0af0adb0496", "comment": "Malware payload", "value": "f4c9aa398a861b5ab07889a38d62f0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826244, "uuid": "1e7f9807-3264-4a12-8022-1727a891f06e", "comment": "Malware payload", "value": "92395b0ea05baf1e929cc16b4d0aacf740757470d393797b5756b006db64322e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826244, "uuid": "6a854bb0-4168-48db-8121-25fc7ae730db", "comment": "Malware payload", "value": "1a8be26d4f99918d64b6bdbdbe0ef052b26833d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826244, "uuid": "e3d84a11-98a4-460b-af1a-47a0a876c7e2", "comment": "Malware payload", "value": "2f12f64b814a0b989d87e0e931b52ee9787b900694448ff29526fde7f0e4c0ab2a55571afe67b10b777d15cab7030ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826244, "uuid": "f6b263b6-92ba-444a-8cd7-a215b72bd78f", "value": "T13C57297F26948269C16DC13EC2978F48EA337C755B33C2DB12D936684A729C49E7F221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826244, "uuid": "538ae9f3-020d-4634-917b-e44e7395a3c2", "value": "56978157d7efb61db46e183df887d622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826244, "uuid": "c6bae7a9-7ab8-440e-a639-b7832229c5bb", "value": "49152:RxZpshNlgPo3Gmh+dmgEXI3opBZUOSAnlrkXersaYzQ5QF5oeoTTSXHX1P:bZU8dmVX4kJMzFoeoyH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724826244, "uuid": "5da88701-b43f-467a-b60c-5a7f52e92a10", "value": 28035733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724826244, "uuid": "b59ec2c5-8333-4349-815a-98056314ce46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826244, "uuid": "65468f02-b976-421f-b169-7585be3e94e0", "value": "92395b0ea05baf1e929cc16b4d0aacf740757470d393797b5756b006db64322e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec760c1-6528-11ef-b7c0-42010a9c0002", "comment": "Malware payload (LummaStealer)", "timestamp": 1724841221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841221, "uuid": "7badfba6-1746-48a8-85d0-d52d3ec33b53", "comment": "Malware payload (LummaStealer)", "value": "82b950149d07c90e2838964836a3c908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841221, "uuid": "d2113778-b9be-494b-9c15-0699a1dcb34e", "comment": "Malware payload (LummaStealer)", "value": "9244b06d820229510f26a9c2d8e54bcd222344cc633af301ed8f2aecb46aec62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841221, "uuid": "1c5b8eea-78a9-4b88-a651-8c1e92e0064c", "comment": "Malware payload (LummaStealer)", "value": "71f7695cb76a09abd084dd91c12f42bd9a9a5e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841221, "uuid": "53c11535-6466-4b41-9d3e-473d2dd9f764", "comment": "Malware payload (LummaStealer)", "value": "f27f7912507cf49822e256684b4e372d3ce09c503a129265e2022db22a2be498a4495c1a0fcfdf71551d768bc788fd09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841221, "uuid": "bf08444f-4d7c-4f50-aa64-2962b1bb405a", "value": "T1B3C63803E8A545E8C1EDD13085669267BB71BC884F3523D72B60F6293F76BD0AEB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841221, "uuid": "df0048f4-67b7-4aae-a4f4-84fcdb0b1216", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841221, "uuid": "01776d8c-67cb-444e-8231-dcf0b6ccc52c", "value": "98304:HUX6xsNFYsBVJ8l0aE2lfhQSqPEE8Jqh19coU4S:7szB7W0aEGfhfqME8o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841221, "uuid": "80b0d6c5-f9e3-435b-a2d7-4aa9202d9ccf", "value": 12261904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841221, "uuid": "bff094cb-1fb1-4d18-8a7c-ae7d60d8b76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841221, "uuid": "e3e46c42-22dc-425a-b3c6-5b9509a3450a", "value": "9244b06d820229510f26a9c2d8e54bcd222344cc633af301ed8f2aecb46aec62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59941d4a-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724818610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818610, "uuid": "1439f022-f72a-4998-b6c2-d6d49686b46a", "comment": "Malware payload", "value": "28257981080cf624cf057c9271ea8e7f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818610, "uuid": "64dfcd41-dcc1-43a2-aeb4-8deefc63ccfb", "comment": "Malware payload", "value": "9257cb357d53c2e914b3d071e46bce1d4132b7864cceaf7d9dbecaa552a1858a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818610, "uuid": "991a0289-468c-4524-81c5-1654e8e9fbad", "comment": "Malware payload", "value": "636bb9c4b85f62edcdf3f55cf362dfd0e3c76ca8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818610, "uuid": "b3a09322-69c9-4436-9164-327ef690cbd8", "comment": "Malware payload", "value": "ccab6381592345d1a0537bc9e8b4b8af6605e7f0b305a12cfe68468f6f069f55449792f47260b4971ace6669995ad011", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818610, "uuid": "bbe653ab-333c-4af9-b926-73de6cf0b48a", "value": "T176F062D602870C06C3420B3ED2B2A39E0A64146E5069D7EEDE1BE8D11CB3ED41C9210A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818610, "uuid": "a9831ab7-6cce-4087-828d-3dee322a6c89", "value": "12:5jfKLNDtUnOcwaOzPsL5NBdC2VBZuc9iGn9n+SC48yNtNwaPnX:9I5UnO3QL1XZueis+XM/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818610, "uuid": "2dfb4b30-57b8-4428-8e08-dc958c905875", "value": 641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818610, "uuid": "cff29b2d-029c-485d-8093-a4ed95338e7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818610, "uuid": "c5ee34d5-31ec-4830-ab03-45d00d4b86d9", "value": "LIVETRACK.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de01271d-6510-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724830859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830859, "uuid": "6b10efa4-5996-479f-9dd2-4b55e2f3dc4d", "comment": "Malware payload", "value": "7204638f43e45aa4416db8f4f6de348b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830859, "uuid": "805f3828-8258-48a6-be2f-7b1a3da86c8c", "comment": "Malware payload", "value": "93ab4ab3709ea26ca94fbb7645d20d66b33eab8d77f28cc94fa963d202296376", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830859, "uuid": "0bfb3056-2522-4631-995f-644bf1798726", "comment": "Malware payload", "value": "4f5fcdd02e90e7be5ceeb4f62c042c4f5c4566c1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724830859, "uuid": "7fe9e38b-dc22-4371-a415-59b8678d7f46", "comment": "Malware payload", "value": "2c228efa07f2e487385b6e72ed8ba63b883c3d28c1b66924653ce0e75bf3bc8cea4d0c7ede3644fa9c5d8549442c87c8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830859, "uuid": "2cb0b84e-8d0a-404a-aec0-080425f10e1a", "value": "T19421A62027F98B74F7BA0B7888B667258B76FC03DD108F5D400841981CA9A50AD69F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830859, "uuid": "a6f10f16-0c30-420f-8a84-61b432395871", "value": "24:8VlBBVJO9J+3fuAOc8PAMYWDvWp+/5xdp+jwQwm2Gy/N0ReVVw5kw5hwy+cImo:8VlBBVs9of1Oc9Mnv5dA0L/KReQZbaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724830859, "uuid": "de1acf1f-609e-4dba-8225-9b5eb9460234", "value": 1286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724830859, "uuid": "d3c3d043-e85d-4157-983d-200fe3103794", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724830859, "uuid": "8af414a2-8a7c-4672-b0cc-ae91c2f1cafa", "value": "E_9456278930393_pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96f1755-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827334, "uuid": "6adfb89d-7a34-43c6-8ba6-7732a4bad58f", "comment": "Malware payload", "value": "8dea255184373ca01e8735212506abc0", "object_relation": "md5", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827334, "uuid": "e1c394ae-4cf3-4c19-9f65-93cf70be7764", "comment": "Malware payload", "value": "9485880ffb469cb20d80721ebb2e1bccd3d25324bb30de5707d7a877260d74ea", "object_relation": "sha256", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827334, "uuid": "0689d1c8-0a77-4998-9798-1cf9d93dd752", "comment": "Malware payload", "value": "b25585007590abc12533592e7dc2b6e237fc886a", "object_relation": "sha1", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827334, "uuid": "8e36e758-e3ae-40ef-a717-d33fbdfe45b6", "comment": "Malware payload", "value": "8510d9f78e2da5c66b6a10717915c8e1553d043f6a78e9048ba54a2ca97d509a27102995b6e00689a72384fda78d80c4", "object_relation": "sha3-384", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827334, "uuid": "f601331e-e56e-48c7-bbd8-c6bcd93aba51", "value": "T1FA11B71305297020C6F427E7C3A0D91EC94AEFBF320A78F4439A023B28208005911C90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827334, "uuid": "faa19a6d-eeb7-4865-9376-472a327e8f9f", "value": "24:capq9KkmcsGtRqsB7QlPFDw45SssYiSEOrrLjGELT6:cR9m3shQlJpBsYi4fLjPLT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827334, "uuid": "51f7fafd-9b3e-4cb0-b4b4-1b347d403d20", "value": 890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827334, "uuid": "75f956ba-5838-40d8-9404-4005ceeda5c6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827334, "uuid": "7be703a1-1106-4dfc-9619-5a8371cdee3b", "value": "9485880ffb469cb20d80721ebb2e1bccd3d25324bb30de5707d7a877260d74ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dab4a73-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846159, "uuid": "f5681e3a-0e66-4368-a5d7-3650d4f36dba", "comment": "Malware payload", "value": "76fcc34ca114d2461987e79d4ba74426", "object_relation": "md5", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846159, "uuid": "3edc8320-689f-48ca-9f1b-a6c644a252e1", "comment": "Malware payload", "value": "968085e9697d39f4bdb330d1b18e7c5903e55abe7fb4ebbf8e3ae816d7af5dc2", "object_relation": "sha256", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846159, "uuid": "347d2311-b366-44a0-aa05-c6685db17449", "comment": "Malware payload", "value": "60498c15d00ceffce1fc000798cfee4fa414c56f", "object_relation": "sha1", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846159, "uuid": "7210a751-3e95-443b-b7dd-d592cb28c4e0", "comment": "Malware payload", "value": "4aa4f024e0e72757fca993475ca93099f34ae3ec099d85b328d9fa872a13f11d3ca30bb6361093e9101247d079ca06d4", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846159, "uuid": "bc2d4cb6-b582-46a2-857c-c2ba0b0b504c", "value": "T188E73372B18B8116FA7D5176A93AEE2F44BE7F73033140E73764BE1A09B98D0A1B5503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846159, "uuid": "ab53627a-f2d6-40b7-af95-afd4991641bc", "value": "1572864:nWvXF+e76KJ9I4OzKvmTq4aMh6zGORvApErPLpcNRc3xBKeB:AP5J9I9GWhC7vApEXNCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846159, "uuid": "d15764f7-3524-40bd-8944-c184b7c90fc8", "value": 67692544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846159, "uuid": "b739efb5-9218-4b5d-9e18-a62dd82e5042", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846159, "uuid": "8e8f9ad1-1b02-4812-9fc2-b78e1576d06a", "value": "SSCBOLGZFXVJMEICRNQMJOCDIF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263ade46-6549-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724855032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855032, "uuid": "0144aa77-13df-4a32-ba5e-ad27b2ee82d8", "comment": "Malware payload", "value": "2fbc696f6e87a76007164c4fb93e979c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855032, "uuid": "b53d10df-bc01-4aa0-8af3-de6250c64812", "comment": "Malware payload", "value": "9744124ecb0bf5965384c19407753b1068551c2fe4f15a104b11f03ec1737626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855032, "uuid": "0ae8b590-0098-4ac1-93e0-634e8d0e1b9e", "comment": "Malware payload", "value": "265c3bf21255a528723ec4e2b701341e119f0be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855032, "uuid": "59ca548f-0df3-45d5-ba2e-77ca440a536e", "comment": "Malware payload", "value": "6961a11b39eba8d3cf11d331a4a033aba349a2dfd70eb7a9b6c7b5a4910f95f7740d0c76d23c2f7af746a1e2f62144e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855032, "uuid": "4371a7a9-eb88-4c0f-9cad-83f32967c828", "value": "T19F2412DA2A891B33FDDB4AF5B0C1D1395AB9CB4568831BEFB14985338B8330156B5B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855032, "uuid": "32bb2753-c0cc-44bd-8e28-d822d933e523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855032, "uuid": "7b0d1786-d9ba-4a02-aeb5-2e77b0fe9ee6", "value": "6144:T+f9Bky7DGj809duSvdsVQ+0W9Tm6L3PAEO:TsT708Odu2+Bp3oEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724855032, "uuid": "a38a1593-a09d-42ea-a5a3-891ddc8ec2f1", "value": 212008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724855032, "uuid": "29d55cb4-ec16-4ab1-8452-87317a664514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855032, "uuid": "7c055055-cb71-458b-8db6-c73139ce5a5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c89faa-64f9-11ef-b7c0-42010a9c0002", "comment": "Malware payload (GuLoader)", "timestamp": 1724820668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820668, "uuid": "8f4a50da-bd16-4b95-a73f-d63a675ffd89", "comment": "Malware payload (GuLoader)", "value": "0afb5bfb1d8d7668a5cce238da947f98", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820668, "uuid": "324ba1fe-cf81-4e6d-8d25-afc3f998ecee", "comment": "Malware payload (GuLoader)", "value": "98ad896fba17899465c642cc1e0e745ff5a081f5871fc091c0391a5929192ca5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820668, "uuid": "82d47d65-42d8-4e6e-9bb8-4905e0836d02", "comment": "Malware payload (GuLoader)", "value": "c0c607e334c4b31e3cc8d5703ec16faa9b4766d4", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820668, "uuid": "4bc6b48e-5a0f-4b01-a492-4ccc4ab2446e", "comment": "Malware payload (GuLoader)", "value": "d030edad4cabf3929315935655fb08522fcbbd0d7bbe9364dd9acf0226094a2002cb6f6cb8875cb191ef95f97221680e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820668, "uuid": "2f0ca11d-5e6e-476c-8272-183e64945be2", "value": "T136C4231430D2FF8FF44BEDF54108259B1A0DEE248FA15967A8AD7B05877C28A0E1B8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820668, "uuid": "f97720ca-0457-4d2d-8469-472f61855c75", "value": "12288:0bT+qNuNGn4wsFXTq0eLpGDFtYzfqxVviBs0fyleXDZvdUKh:0bT59nnstBmGDomVvYs0yeN+Kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820668, "uuid": "1a9f6f52-599a-4465-9d3b-32664184f49e", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820668, "uuid": "4e968ec6-f50d-40d4-84d1-1e2927ea04e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820668, "uuid": "4facfc9a-b166-41f3-b9f2-c5251dd6e188", "value": "Thermo Fisher RFQ_TFS-1805.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cc1139-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840263, "uuid": "84375f3a-7b41-42ef-97fd-550b26208ba3", "comment": "Malware payload (Formbook)", "value": "679a202e07b40265d5910bd05d7fa5aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840263, "uuid": "3fc16638-9266-4ed0-b7c3-9f5021e027ca", "comment": "Malware payload (Formbook)", "value": "997a3c0757e7f11c133e68525b02e32ce23552bb309c82213e59f77a2d74ff35", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840263, "uuid": "ae09f4a7-829b-4c0b-bb1d-a3ebad325fb1", "comment": "Malware payload (Formbook)", "value": "801f5c344f75a3c3db83da9f9532131e8afb01df", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840263, "uuid": "fdb6d53d-fd43-45b7-ab35-fc74a16c7f6b", "comment": "Malware payload (Formbook)", "value": "f650ad967915d82be9cae299f45508522f1186a476566b052fe2e1b6fd735de0c43cc59a25eaf4207a73207f77b55cca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840263, "uuid": "9b8db4fe-9158-4e04-84df-397be0e0c78e", "value": "T194F42314239C32E9CC7BB75342A9542ADF5168FDF6CBF17802AA77002F8552CC1799AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840263, "uuid": "b9100fb0-81d2-48c3-91a2-c8ab6ef752b6", "value": "12288:SJc/tUsHUlHIsXYTfw3no6jhPmwPC50ve6qYHFf2uXl7nqFLT9hyFN:SItxHWIsocVPAGvecFVXl7qFLTSFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840263, "uuid": "e373efc3-0230-4a88-8cfe-457cbc35dfaf", "value": 731669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840263, "uuid": "b798333d-11e2-4e7b-b5b3-1280ff02a4cf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840263, "uuid": "d590ddae-4f25-4daf-aa96-2e9f9bc0c39c", "value": "PO#8631286Q.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3078e44f-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822407, "uuid": "ec2d3d27-9e4e-45ad-a8be-992264465b3d", "comment": "Malware payload (Mirai)", "value": "2de7ca23f739f17d0be3d795d9530a7a", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822407, "uuid": "33be7507-e729-4673-a08d-bdf60c4302eb", "comment": "Malware payload (Mirai)", "value": "9989f363c7f102cde0af26ae9ea2da8642438b416a6fa231bdd3e70fe0b2c261", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822407, "uuid": "d5fd0149-7186-40c1-afed-04a47b04d51d", "comment": "Malware payload (Mirai)", "value": "338670e0e2ce355bf63e2f03d9a7779edbdc96ae", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822407, "uuid": "6324f162-a1b7-4847-980b-9f2496488812", "comment": "Malware payload (Mirai)", "value": "c80f87d807026f9c5210daab22fec59b9cef544d0b8b3965e3de877b5802d4c8a7d0a987372e18390cc556b33f4a809d", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822407, "uuid": "26ad3db8-f413-44ac-8378-b0037cfa7026", "value": "T1C92291AD1E7CF0B9ACCF7445723CE7CAA60F9171E5A4F794B96058C684E3C146C22DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822407, "uuid": "4105735c-d41d-49d3-a5c8-70b60c6e48c0", "value": "96:lwW8OSO3yxPnaXsgys4+dPurYw4N4Bd0PX1u3kJIkAgS2/seOwTwaZ2MM8Rk9Up6:z8OO8F/ICvL7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822407, "uuid": "79eec61e-222b-4d01-85fc-8d0cf8b5706e", "value": 10017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822407, "uuid": "5cdf6737-4b1c-491d-8a5f-1c1e18337f82", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822407, "uuid": "77350acf-5b80-44be-886f-d5cde8caf4e6", "value": "criptonize.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07d781c-6573-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724873275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873275, "uuid": "ce589e3e-ebfa-4ffa-8c5a-bdb10608aaa2", "comment": "Malware payload", "value": "bc190c0ab1a4c6839896c02a654552a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873275, "uuid": "03978c6a-4513-44b1-ac70-99a155aa8056", "comment": "Malware payload", "value": "99a52990f2fe3c23fa578eb3a88358e2c08ee3594db4d11f1e7bf2b786cc7e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873275, "uuid": "af0d2e33-61dc-425d-a573-ba8597d2319f", "comment": "Malware payload", "value": "52a71df6c0cecac2da8e24f51a15b253a69ec7d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873275, "uuid": "e4fd4b3a-9d59-4214-af8e-dc62d6c792e6", "comment": "Malware payload", "value": "fad74127a6e1814eade5faff2fa8fa125f77c85365932863637e8730a5c70cc68cf6b5e39de44a5c60c8296a230950ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873275, "uuid": "15393927-e9eb-4e14-8b62-699582b5a6ec", "value": "T117742362E76A1018F47DE8B5C1A7669E4F07CE19F4510D3E2EF0393106B07ABD6AD0E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873275, "uuid": "59db5978-1939-4dac-bf6f-a0c41570abc7", "value": "fc2b04aa9fccf3704e1290ff59feb5cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873275, "uuid": "db0752e9-2327-442b-8efb-11b180bb480f", "value": "6144:nLUPiwLYbuv5+y+AsZlxPFhOiJ2YUGFbf7GRljyH1yUfJfhoS:LGcb7y+AGHhOiHUGbfclyH1hfVhoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724873275, "uuid": "64c428a6-af07-47b0-b9b6-0b32562f61e4", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724873275, "uuid": "a7cd245b-535b-4885-9075-31cbee9a28b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873275, "uuid": "afad8586-1976-4144-9c4f-d9441c9094fc", "value": "SecuriteInfo.com.Trojan.DownLoader46.48074.21382.27832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c6d3c9-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724827353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827353, "uuid": "4be1537a-7227-4465-b80f-ac6041aa9267", "comment": "Malware payload (SnakeKeylogger)", "value": "cbd1eddc103af5a8424c94d4b4fd96da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827353, "uuid": "c8e47741-f94c-4315-8058-45bfcfc9a180", "comment": "Malware payload (SnakeKeylogger)", "value": "9a318a246c633d4630bec3b499961573e035ccbb070827f9fdef90298dcfccc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827353, "uuid": "071924e2-0de6-4883-b9a2-9665ac3fa683", "comment": "Malware payload (SnakeKeylogger)", "value": "c3b278dea8f489394a9c596bc0b9b6b8ae5dbfa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827353, "uuid": "d85a77c7-aeeb-4c8c-ac8f-ea6c09f54a11", "comment": "Malware payload (SnakeKeylogger)", "value": "5477b1fa1419bf206f215105557f3e95d26f753bc02e8260f4ae7a25fd3e98896e905b6f951de9699ed0276b823ea7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827353, "uuid": "d1d68ebd-bd69-479c-aa50-e51d28498e93", "value": "T13A35BF0273D1D022FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827353, "uuid": "d8b344ac-92e5-441b-b159-2c44ed82ed91", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827353, "uuid": "e7245e44-a5f4-43f0-be02-4bdd42883e4f", "value": "24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8av6PcxpK6:5TvC/MTQYxsWR7avKOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827353, "uuid": "445252fd-9c2c-450d-bc26-2f87e9278fe3", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827353, "uuid": "d78f1106-3cfb-4d2c-b136-e10ad56041b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827353, "uuid": "34435aa0-e115-49a7-99c4-cc1633cf8c1c", "value": "Scan000406860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be316c8-64f2-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724817621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817621, "uuid": "239212d9-17ce-4c3e-9d7e-d9d6bc65f854", "comment": "Malware payload (DCRat)", "value": "6a5688fcd37a6abc27d171c6e9233535", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817621, "uuid": "e542305c-4383-4b2b-9a6d-2ddc928d70f3", "comment": "Malware payload (DCRat)", "value": "9a8d32303b8d57fb3d81c6ec012fe524f169dd4e262f82b9e835bdc18fe4c4e8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817621, "uuid": "c485cbba-b6c0-4654-8f4f-7822700c3cc4", "comment": "Malware payload (DCRat)", "value": "6a593b1db071a3b8274ffae94098d6e76e0ff19a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817621, "uuid": "92c8192d-6bdf-40e9-961e-3e2ad97fb945", "comment": "Malware payload (DCRat)", "value": "1c58857f9cd38016b4126bbf4d2e4b8b6dc682380cb39ca2dce6d73b14da1e358df055df09d238ae1afaa5f0de2524fd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817621, "uuid": "9224a54f-7455-4a08-acce-10dcaedde583", "value": "T1A4C733B21F3B7665E702BD734EE79A528E01522F46D6DA2ECFAC74F28F655031284C44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817621, "uuid": "996363ce-e1ca-4313-9f36-2c49890f0aef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817621, "uuid": "692e10ce-b5f3-4489-a915-397fa0882dab", "value": "49152:cAtblIlnqtKm/Rzk1R7oOaPQ77I3Oy8NyiNCd+0q+ydrn+Qqh6:Fae5kAOkQ77I+LX8I0zyhn+QU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724817621, "uuid": "233846a2-9683-4a45-b5d9-9e4adfe14eba", "value": 53477376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724817621, "uuid": "3e8a11f2-edc8-4c23-94c3-657c8ffa8892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817621, "uuid": "6114581b-1b74-4e93-afa2-4fd8e43cfd2b", "value": "6A5688FCD37A6ABC27D171C6E9233535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce693bb-652a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724841889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841889, "uuid": "d4858755-3421-42c6-9879-2baeb78bc249", "comment": "Malware payload", "value": "9a8706afce541a5ef46c68990b895429", "object_relation": "md5", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841889, "uuid": "b617adf4-227b-41ee-a3fe-5fdb8e571858", "comment": "Malware payload", "value": "9b6cc89b422168cf3e6c3fe6af902b603192faa63d5d9ea57ac6f01d00a157f6", "object_relation": "sha256", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841889, "uuid": "eb971da5-9bd0-4a52-a13a-5102d00f8439", "comment": "Malware payload", "value": "59b63de1b4475786cac7994e98bf4a77a86ffdc9", "object_relation": "sha1", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841889, "uuid": "1c7b3413-b1fb-4995-aee5-67c25e60ea8a", "comment": "Malware payload", "value": "5962a55d17a21b233126dedc4e0fd6cf146e177f2d24955bc4be565eabf85aae9d3977881f543bc7848045fc2c9a2b28", "object_relation": "sha3-384", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841889, "uuid": "1b44f7e9-a1cd-4221-8595-d0409c7d1bef", "value": "T1A996BF22726584A0C97B8076EA2F8647D7B2BC505F10CB4B11A4B7992F33B531EEF746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841889, "uuid": "79f66b21-e336-4ce2-a621-df9a8de68488", "value": "3f0a60f03c663d23f9564efbfaa0d6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841889, "uuid": "93c3394b-2877-49f0-9d17-3ff3a6ed1ed7", "value": "196608:bCtcGVQE2XmLX3ffGzJENyIqHnjUp9Z74kkB9kkX45P:Gtc0Q3XmLESyIqgpJIwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841889, "uuid": "03d86372-6fa4-418d-b0d4-673cbb941c61", "value": 9068976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841889, "uuid": "43674d83-93b1-4966-8996-dce6c5b967ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841889, "uuid": "757073ee-d0e4-450c-9937-a8cbae2d075f", "value": "9b6cc89b422168cf3e6c3fe6af902b603192faa63d5d9ea57ac6f01d00a157f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b65a84-64e5-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724812266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812266, "uuid": "ecb81698-0bb1-4b0e-8f6b-831914bcff5e", "comment": "Malware payload (Formbook)", "value": "df3a761ce4e89dd4d18ed22c4b9c3c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812266, "uuid": "7d4723f9-44c0-40b6-8a5d-840d6e655639", "comment": "Malware payload (Formbook)", "value": "9c0aaa80bb3482d11b56f8921836132a0c499d3aa6a3defd96a81d1a1b9a5ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812266, "uuid": "f0f745a7-ee48-460e-9dfe-9e06d4130274", "comment": "Malware payload (Formbook)", "value": "8c8d7f6eac1f2128f4cfb72103fc2d5e3583cc38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812266, "uuid": "e033fb9b-09bd-4c70-82b0-5b5413499166", "comment": "Malware payload (Formbook)", "value": "c7722b4bddc6b6f789e685f3a6dd3d28415f1f6c5c4092993303f732bbb941646ab4bb3077b9da7e7de23f9975abc80a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812266, "uuid": "f0f553d0-b949-4142-b4c5-b84299e4d95e", "value": "T1B845BE0273D2C036FFAB92739B6AF64156BD78254123852F13981DB9BD701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812266, "uuid": "72b96b6e-04c0-4c3d-85e5-63822d3197f5", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812266, "uuid": "81202310-0280-40bf-b79d-67323c21984f", "value": "24576:fAHnh+eWsN3skA4RV1Hom2KXMmHarJ0g0pufC0YcbufZ6bBI5:Ch+ZkldoPK8YarO38CYbuBwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724812266, "uuid": "9adf83d5-c1c3-47b9-be91-8bf3cc7a3643", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724812266, "uuid": "d9e5757f-9f19-4e6c-b574-fb4e68b25e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812266, "uuid": "a25941f7-94d3-48b8-985b-080ec332f348", "value": "Shipping Document_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d00da8b-64df-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724809704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809704, "uuid": "4ecb7d09-5cf1-4ad1-8916-05379209b33e", "comment": "Malware payload", "value": "0a82b882fa5e97d54f1a752a7c92a400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809704, "uuid": "cdb7ac20-a804-4c89-8154-cba8961a2bbb", "comment": "Malware payload", "value": "9c8750068f6abe3b98da6bd71e4c05e7455073af1f4dad5b6667f76ba4836b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809704, "uuid": "ea425218-c612-4a80-b584-9129edacec8e", "comment": "Malware payload", "value": "b30410cbbb5c9c6d2d28274311dc590ee9f068f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809704, "uuid": "5a68f8d0-ca23-4b63-8582-bbc8cdee48e6", "comment": "Malware payload", "value": "db22fc9ccceae21141c1914536802fcb8c95066a518ab6b9cf0a3fd0ac185fa52d83a217f9c33bbc3b571dd92af50801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809704, "uuid": "2022fa6c-afb6-445e-8938-20fb5556048d", "value": "T1AB159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809704, "uuid": "71f5f4f6-06bb-4e06-8a36-e22277c4473a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809704, "uuid": "1b99334d-b0d2-4325-a9d7-56be15211d0d", "value": "12288:+qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT2:+qDEvCTbMWu7rQYlBQcBiT6rprG8as2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724809704, "uuid": "f0a4be6f-37db-4579-a291-f59f5bc64ba9", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724809704, "uuid": "72c36030-85b3-4742-9803-7ed599841b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809704, "uuid": "3ab0f983-ffab-410a-a000-f873000a8eb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21573b70-6549-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724855023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855023, "uuid": "6885b0af-8cfe-4f52-8115-4b7485486602", "comment": "Malware payload", "value": "99fc8aa825d1814814de66088bdb9787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855023, "uuid": "1ec0a27b-2fe4-42a3-abf5-f65f67b065e9", "comment": "Malware payload", "value": "9e78165a00e2e7e9e5f81431bc43d5f254dd296e6c0629558f71ccabb5388a92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855023, "uuid": "80350723-8dee-4db3-9d00-b9a4fbe752c6", "comment": "Malware payload", "value": "382710bb7c2ff1708f5d39e383fb3812c67dde3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724855023, "uuid": "3d38511e-96a2-40de-a7c7-dcc157e8bb36", "comment": "Malware payload", "value": "2780dbcf5effb1b4917411e959284eafaa4438824bc6b669495e69be1e2b90339152c510c94afef40a94192c9235d245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855023, "uuid": "b99f89bf-eb9e-4f2d-9fd7-f30f66811873", "value": "T12E1412F913E61E00F5CE5DB93DC487306B7083C77983F6AF61469272DB9139938A91A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855023, "uuid": "475739bd-84e5-44fb-bc14-51546b8afaa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855023, "uuid": "a089d627-a6ec-43b2-a2e0-cdfedb8a87db", "value": "3072:Zl2h1cikMd8qz9q1ENGtlcOdba13DusG2Ej+dv7fEkoON3kQ8w1X4XRId897JvK0:uh1r95MEXiygh+dgk9N3hX4XRIdOEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724855023, "uuid": "62f3f0ae-e5b4-4b68-ae15-af4b02d60a0e", "value": 196136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724855023, "uuid": "bf0c769f-d1fd-49af-b74b-d329ecda71f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724855023, "uuid": "de2629e8-6f22-4080-893b-f8a828ed6bb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d4d691-64d5-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1724805176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805176, "uuid": "6027e38d-dfb5-4c8a-ae9c-e54584f0ef56", "comment": "Malware payload (AveMariaRAT)", "value": "5a2964a93da5e8a9726ab479814f012d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805176, "uuid": "797ef6bd-60a8-45ff-9bc8-f65c4af2f29d", "comment": "Malware payload (AveMariaRAT)", "value": "9f772e3b6f92a0f25a040c1fc12899847dfce0a8b0a331be87be264b536c446b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805176, "uuid": "28894888-b487-460d-aa50-4b884f622d88", "comment": "Malware payload (AveMariaRAT)", "value": "bb2599555ca21395946f4d0d828f6c78394d18c2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805176, "uuid": "768daab1-0286-45ea-ba44-2279965e8f2c", "comment": "Malware payload (AveMariaRAT)", "value": "4604fb4330891c7f013750a97014583bd82f364461ba8fa0ec89d08f2b85f2223388547ba5f9c2fa8396876a6dc2b94f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805176, "uuid": "c5ad68ed-0cf0-4bfe-bc62-52e0a711ff56", "value": "T1A056F11663FC266DF1B70FB6F539680969B1BDEE3E02D21E1494342D1577B20C92A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805176, "uuid": "3f97899f-99f9-43d2-a3c7-a26191c935b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805176, "uuid": "cdd38056-ee79-4b17-9034-9dee5a7d06a2", "value": "98304:pv8upB6APFAYS8ILk65Hxp44MVghKrVy+dr5/FtqvGo4T:18upg+GYCkf4qg4h/FQvGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724805176, "uuid": "368a3253-88eb-4f9a-ad34-b6e0d1a74258", "value": 5958144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724805176, "uuid": "57f60649-1a26-4a7d-b620-3d192a41e43d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805176, "uuid": "b9352bad-0792-4349-bf20-15bc03f4d54a", "value": "Apponde2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d767c68c-6524-11ef-b7c0-42010a9c0002", "comment": "Malware payload (GCleaner)", "timestamp": 1724839437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839437, "uuid": "e399c868-8487-4b16-ba67-9d8b2df8bb4f", "comment": "Malware payload (GCleaner)", "value": "e0e8e64dfad5b7dcae0d8c569c3995a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839437, "uuid": "3c8221d2-5945-407c-a33d-6476925168f3", "comment": "Malware payload (GCleaner)", "value": "9f860b523257827deceedaf7f95fba8e45e241602003ead07ad41727dbcd2f4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839437, "uuid": "0a1b8e63-3972-46d1-989f-251b31ef99b8", "comment": "Malware payload (GCleaner)", "value": "307aa823e40f082fb0ff99fb6996d4f34c5abb45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839437, "uuid": "576f18a0-5906-420a-bdb9-83347d3a8fc8", "comment": "Malware payload (GCleaner)", "value": "57ccf39dd79ae30b9647c69da811665153773f956608b4bd172a4afb30aba366391d76367dce799ed8e5d4bef0f9d296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839437, "uuid": "74b2ad89-2d66-4dd1-969c-7c75b54d7291", "value": "T19D54AD0176FE90E6EEA747305970C6A45E3B7D836BB6428F32703E1FAD732916560B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839437, "uuid": "d7c85faa-c283-4634-a960-ce88ceae3915", "value": "1d9d33e4f206a54f8ff0f700699cf53a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839437, "uuid": "29734c74-096c-4877-a835-0860a4809754", "value": "3072:xwySb8zVbbEEyNej1dI0D9R40DWbwtORdekyE22JsH/ES:xwySb8zCEyNAJD9/D7O651Ysf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724839437, "uuid": "9102ab05-af25-4678-bb30-db25637b7568", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724839437, "uuid": "cdfe8b35-9f05-407e-b426-71b5fc4ab8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839437, "uuid": "18e1b285-38ad-4894-abbf-723ed9900c73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18cd383-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724827348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827348, "uuid": "fdb70f60-5dc8-46aa-83d0-cface29caa08", "comment": "Malware payload (SnakeKeylogger)", "value": "028f4790b00f49d7505a6179d6cc9a4d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827348, "uuid": "e975d18c-0bfb-4830-8dcd-1e0ec7a83c83", "comment": "Malware payload (SnakeKeylogger)", "value": "a06a159d3fd47ac0698cd649205f983beef2d1718de0f8c5b2aef9450e2758ce", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827348, "uuid": "62ead2f0-fc80-476a-8f52-7c40eb111471", "comment": "Malware payload (SnakeKeylogger)", "value": "a6bcfbac880877d6149491490979461c4f940b5f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827348, "uuid": "9fa31eb3-f574-4c0a-9d2c-1b1bd12b9050", "comment": "Malware payload (SnakeKeylogger)", "value": "f31901dd0b1c46fa5fe12647aba3d4559f914e8217032aaebf4d518c4ab8b8d1709975c944e9bf14ad82599a44e4f546", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827348, "uuid": "656cf2e3-682e-49e8-a3e5-5c27a0823a54", "value": "T145C4235A5DA2B8794D7535368211F25EC976B8125C60BF0BE17F821AF343C2D28B39B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827348, "uuid": "995f5bdf-6b7a-4c05-924d-6ca768cef316", "value": "12288:G9YzPcXbr6iQWBRp2ecfp8LD9ZtYro7TadjVeYOnAiGW:dUXbr6iPnlcrQssAiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827348, "uuid": "9532e09f-ec7a-48d4-a1be-50910327aab0", "value": 549041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827348, "uuid": "92d3c8f4-62fa-430c-85e0-a29b7e1d227f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827348, "uuid": "031f62af-c760-451d-9554-24a2f7727b36", "value": "Scan000406860.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dae711-6571-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724872217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872217, "uuid": "7546eba8-4d8b-4dfc-a8bc-b2c570804880", "comment": "Malware payload", "value": "1ef9bbed957bcd2df5a639e04a67f8bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872217, "uuid": "5d122af5-ef45-45ca-9b7f-c6e2758aeec4", "comment": "Malware payload", "value": "a1259a67819bb78fb8d97596daeaee6d01f8cf984dd217c7bf10e1808f3d7c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872217, "uuid": "4e97f099-d5de-40b8-8078-2742e3b48346", "comment": "Malware payload", "value": "dea8af341746162f51e7c37486c43f484b7eaa20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724872217, "uuid": "1be2e8ae-a7a1-414e-8ef3-bd52ee7f8840", "comment": "Malware payload", "value": "e1c209f6d02739470ec3693be05dd18aad44ee0ffd73a7624c943771670fd79db3a1e9fd1b7714c2e85761a65bfbd5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872217, "uuid": "0732a488-bf76-470d-a81f-46fc4810fcba", "value": "T1A31412204BB64CB7CDDD88312583EAE6AF710A72F74B82D2351ED2B24F573693619835", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872217, "uuid": "1750d4c6-a36e-4e20-9205-772a18f40f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872217, "uuid": "3c2bf164-1321-413d-8930-519bbc5c2ed5", "value": "3072:eeevMXvHF84YMPwKf78nzuWqf5bNYy0v1yfX54yq3FFgJSSuQeYt7QaONmw7DBdz:e5vM/HDY8WqWqf5bWy0vuX5l5ESuQeYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724872217, "uuid": "08dfecdc-a8a6-4041-9740-cd3482a3f9ab", "value": 196136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724872217, "uuid": "1926f71c-6807-488e-aef1-b44bbd8c7aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724872217, "uuid": "648d0cbc-81a1-434b-b2b2-3a24f5eb14c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eaa0a28-6592-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Loki)", "timestamp": 1724886345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886345, "uuid": "95db01a5-b417-4b54-b8bb-e5f560e47541", "comment": "Malware payload (Loki)", "value": "f5b00636853231785277e324d4dc8403", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886345, "uuid": "ae244f9a-bfa3-4707-ad8f-10dcca65ff7a", "comment": "Malware payload (Loki)", "value": "a1ae48f33cc3de8406f8dacf5c725170b7921473308af2756939933500ea7773", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886345, "uuid": "2fb6b787-4022-4e94-9641-79e91b4f3c79", "comment": "Malware payload (Loki)", "value": "8c00f181fd6fba31014b1bad481c7b10e424b081", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886345, "uuid": "87d6ad2a-663f-4ec7-aed6-4dc0ce7e8a3a", "comment": "Malware payload (Loki)", "value": "f41344b09ffa4f6fa5d2c02e6fce1ff438f07467738f9113dc3497cb3193115b839d4e9d8a6d0b1b689ecdf55aa73a94", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886345, "uuid": "e4ba9c85-4aa6-4732-afee-d9ed34964e51", "value": "T177B423844E9286D18FF6966E27D07A3DEF9B43D0783B4802A137571B17E01D78B318EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886345, "uuid": "e796bb56-a3c4-4d67-9fb4-e59cc5d0baef", "value": "6144:n/zvi+VSXH7BnOBIKpINZw8V7Ao3r0wVfHINXxBVDA13JrSQsSIsKcMyEZ+kqo:n/LwXH7BOBGNyM77r0QANXhGJGhSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886345, "uuid": "b3d2a04b-b78f-4c59-8d75-3590d71929df", "value": 502913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886345, "uuid": "327262fd-d4ef-460a-803a-bc9241dcb786", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886345, "uuid": "05ec8262-ce55-4f67-a3a4-9d9b0222313c", "value": "nFedEx_AWB#53052032046.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1ecc62-6570-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724871923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871923, "uuid": "840c6b66-76bb-485d-b294-140b90ff4de7", "comment": "Malware payload", "value": "b2f47f6b2ac065def4d7e48f27e9a3b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871923, "uuid": "a04e9c57-660a-4652-955a-3cbea17336e0", "comment": "Malware payload", "value": "a3121b4c92fe3e00075bc74ca045c4939babc726c27b576ee25cb05718ac8541", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871923, "uuid": "64005e3a-ba66-45b6-9f59-b747f84ce3bb", "comment": "Malware payload", "value": "dd3b668724cfaf6db55af12b310bedfa8f51625f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871923, "uuid": "8e9fc33e-d77a-4f40-8124-157f0eb19fde", "comment": "Malware payload", "value": "a305502951b3c3f1a36b11daaeb4be207df98c0c22f8b3d928cd06236ba1d57ecbc21f574f1fc2e3791dd18430fdd9b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871923, "uuid": "8e204715-16de-4143-ac77-d097b2471533", "value": "T104E52136CA31FCD4871D3640A7281C9E21A8695793F74E28D7161CB63E32B62EF65D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871923, "uuid": "71d5a718-4cef-49ef-9141-2876d67af2fc", "value": "49152:tsubCIS4JSSaMQEdzFfwBMH0aHOpkjFMcCfaqkrpu8656lojq0SboASFpTv+LtNQ:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724871923, "uuid": "97bfb8a7-7070-4af7-a42b-2687bdbc1551", "value": 3316401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724871923, "uuid": "d8ba46b0-3f3f-4949-a495-954b2d86f866", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871923, "uuid": "c0cbbd90-ef9e-46e6-9220-9db7ec67f045", "value": "cd_v4_x86.xsl#", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a62115-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863756, "uuid": "b77cb374-ddea-4ac1-af83-721a4e9ce493", "comment": "Malware payload", "value": "f317a1eb2ac1cdd03d6a2dacb4245eeb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863756, "uuid": "18ba1bd4-7d4d-44f1-9790-3edf313bff32", "comment": "Malware payload", "value": "a35d6b9e7fbe09bfca401a00631178db88b34ef31c8b2adc02b52e2fb3bed905", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863756, "uuid": "88cdc480-9450-4ebe-b7b6-8ab759f5745c", "comment": "Malware payload", "value": "636cc5b67bc4e68dc1a501c2731e7613691871bc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863756, "uuid": "d8000043-4771-4dd2-9b13-a2a1a2bd1150", "comment": "Malware payload", "value": "b03538fdd1075b8d83c5072c016c2ee22121109ea876ad97c931971bdca5a020746c8868697b5e81a6502c748f57f2bb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863756, "uuid": "4f75c451-7424-49be-ab83-10abbf9b9b87", "value": "T1F177230091B3B515F7ABB2BF2AB95FE48559BC6A02E59DF7637173B806F10920433893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863756, "uuid": "0c84c146-8809-4ffd-85f1-76bfa5b86f18", "value": "786432:3t9bUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0yb:3t9r7xVLYjsp+ikJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863756, "uuid": "8b5658c1-8b4e-4872-a382-a17ad087f0a7", "value": 35909632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863756, "uuid": "fa7bffed-a565-44bc-87b0-a4c759468352", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863756, "uuid": "4ab9a3e3-ed80-4a25-a970-1d9bd712b2f5", "value": "a35d6b9e7fbe09bfca401a00631178db88b34ef31c8b2adc02b52e2fb3bed905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464c25af-64eb-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724814713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724814713, "uuid": "2f230a04-9395-4c16-94b3-59542f91c1ad", "comment": "Malware payload", "value": "981cab581be658c9511c10789235307a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724814713, "uuid": "ea58658a-5233-46dd-8284-3d7c3cb4ebe7", "comment": "Malware payload", "value": "a3a6a2dd6d3752f0001163416439d082c2a5d39ce0dd6be5d105da0b0ff8adfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724814713, "uuid": "aee45101-93ba-4986-8f82-c2e78f4eafcc", "comment": "Malware payload", "value": "95deba633bb86ba5c9e651769b60f4333fe29c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724814713, "uuid": "c15a3b40-2f31-461a-822d-619f9f189d23", "comment": "Malware payload", "value": "7ffa62bf4974ec39e43a56fd4f52e63823369fb63184b89c0dba3dd8cfcc8074b7ea8d3403d2d3e6670c8cf46785f99a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724814713, "uuid": "a91fbd1a-b0ec-4124-b2d9-439462ac5dbc", "value": "T1C5159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724814713, "uuid": "1a132746-c46d-4873-a62a-b62e887f8d5a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724814713, "uuid": "8cbd59a6-2ca7-4e21-ae44-0ca55fc12513", "value": "12288:wqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTi:wqDEvCTbMWu7rQYlBQcBiT6rprG8asi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724814713, "uuid": "dd5786b7-b53d-4fe1-b168-1ed9b6d924ee", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724814713, "uuid": "47b5fbc3-8518-40f5-9be1-c232da434fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724814713, "uuid": "dbd93dc0-6a0a-4577-936d-442bd950f1f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b86a99-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854762, "uuid": "2d90e627-f7b3-4e6c-9b60-703c7fa4a181", "comment": "Malware payload", "value": "a6813642bd0dcae055368dcb98a96c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854762, "uuid": "82502ea5-96e6-4db6-94a2-0119b690c648", "comment": "Malware payload", "value": "a462055dc500e6c7d30414fd2ab16a693ba300ed09cf51376268f05031e63a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854762, "uuid": "0c726a77-caa1-46d9-935f-7e1f9738dbd6", "comment": "Malware payload", "value": "e99ae8233105d78f39a140254b0e748520fe6a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854762, "uuid": "628c7efa-790b-49f3-b022-95c5fefdde60", "comment": "Malware payload", "value": "0b9441544444611df206de08d5887f231d818bb400b570e4142d77d7743101200901cf43019cae64a104f74e3052c3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854762, "uuid": "de0a17a4-186a-4fd6-9aad-92b900cead23", "value": "T14F159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854762, "uuid": "8c9316e0-a604-4474-a1b3-2d4119221321", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854762, "uuid": "3bfe141a-bd1a-4603-8631-4a046d6ece33", "value": "12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTm:qqDEvCTbMWu7rQYlBQcBiT6rprG8asm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854762, "uuid": "0fef7ec8-0ea5-4d42-8908-9d715c3b018b", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854762, "uuid": "f84a35a5-64f5-4eba-ad4a-a412706a0030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854762, "uuid": "457611ca-751f-44f0-a7a9-d632adfd7753", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d4c837-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840259, "uuid": "ee34f2af-392f-4d7f-8a9d-973184bc6b17", "comment": "Malware payload (Formbook)", "value": "144f9184fb9f860a313681252dc999ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840259, "uuid": "d09201ce-f05f-4831-a480-67bacb099dbe", "comment": "Malware payload (Formbook)", "value": "a47d17dc57da8ad544a45871fc79ad1201c46ccbe7189b69c6531219a9364716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840259, "uuid": "016f473b-8532-4828-ab1e-08aa775f3b31", "comment": "Malware payload (Formbook)", "value": "0e821050ca0330c7505b6da30121dd16fb72c5bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840259, "uuid": "9226d76e-5999-4c8d-9adc-9cb35722b60b", "comment": "Malware payload (Formbook)", "value": "9d6d22d8e600be9c95b9ebb69ef0598a8e9eea54bfd27c0f7911d53465bfceaa0dddae2bf791834404be639140d0df6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840259, "uuid": "400f195f-8140-4b2e-8dc4-7138a961c4a7", "value": "T19B55D0027381C022FFABA2734B5AF6515BBD69260123E62F13981D79FD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840259, "uuid": "08086fe1-e68c-4800-9d5a-2a8c74339532", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840259, "uuid": "51b98b4f-777e-4020-a96f-518083691951", "value": "24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aHjbDnGQZRoUhH4ym4:QTvC/MTQYxsWR7aHLhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840259, "uuid": "b6f779ec-8b33-4918-9e24-9c405b007d86", "value": 1340416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840259, "uuid": "4aad4ecc-821a-4492-8614-8408e326067c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840259, "uuid": "716a6641-8ca3-40c4-97ee-973b21e791ea", "value": "PO#38595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43756682-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840048, "uuid": "c47ce032-ad37-4032-85f6-eacc9ae460a6", "comment": "Malware payload (Formbook)", "value": "f1d6c6832b129f7ba4c8dee7b6912bcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840048, "uuid": "041a0b8a-a2b6-4877-91a5-75fc572f7dd4", "comment": "Malware payload (Formbook)", "value": "a4c89b2ba1d3bce34e282d2840c0901c0c013f292457aa679f2221e2efcb8507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840048, "uuid": "ebf4b8f8-a3a2-4ae5-a515-4a14938143b6", "comment": "Malware payload (Formbook)", "value": "f2145370001924d43416dd6a2063a8a1cce24fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840048, "uuid": "0b8f6a87-ab92-4f32-8641-7a912e21e67f", "comment": "Malware payload (Formbook)", "value": "836e52f8b53c81cefd3a186693e141e7c30f198e7c49f9e8dd9ebf3a5340fdbf6fe0cf34f8efe6de10ba2ba4308fff9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840048, "uuid": "0cd12e47-49ac-402b-9e18-bbc7eb193ad1", "value": "T13E45CF0273D1C062FFAB92734B5AF6115BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840048, "uuid": "353b6f64-f46f-47fb-b02b-644d2b18915b", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840048, "uuid": "1bee4b78-eb7a-422d-9e3e-618aa15cf257", "value": "24576:TqDEvCTbMWu7rQYlBQcBiT6rprG8aQJAhiQ8wOQNOi:TTvC/MTQYxsWR7aQyswBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840048, "uuid": "64a2a577-fe20-4200-a1ab-7f97c1e3f072", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840048, "uuid": "43e13301-9908-473e-91c7-55aa368feaa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840048, "uuid": "789e6d33-eb98-4a62-b524-bb4745ab26c0", "value": "WayBill_no5301292345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af71b164-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827344, "uuid": "960db36e-40a5-4cfe-896c-532cfade64c9", "comment": "Malware payload", "value": "906dab72edcfba7db436773ebc1d2199", "object_relation": "md5", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827344, "uuid": "5866e0aa-29f6-463b-a134-fbd68f5b4f16", "comment": "Malware payload", "value": "a63d1e29a6e17b86e251cc85b093881b3c355117c157d7b6c8086484a1581237", "object_relation": "sha256", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827344, "uuid": "998888f9-7995-45a5-828d-7b4fa80bea66", "comment": "Malware payload", "value": "9885dc84a9f6524291fe2b4803604ec5b80617d9", "object_relation": "sha1", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827344, "uuid": "761153cc-f04f-49e8-bcf0-d6eec52da94c", "comment": "Malware payload", "value": "3955ac6a499995ca970e1154bbd3cde9cbd477d55d03013e53d94a982df6986bec1de8caaecca98e3593c56f4afc9b46", "object_relation": "sha3-384", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827344, "uuid": "2ed8c490-47f8-4f43-ad7a-f57d8cb3cd77", "value": "T10A655A4BBCD148B6D0AAD2328A6666917A31FC090F3223D73E50B77C2F767E09A75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827344, "uuid": "b582247e-3128-4b0f-a234-d3fe960a32b8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827344, "uuid": "67b704bf-abbb-4ec3-829f-81c97f107978", "value": "24576:rQYj2VnIgotgDqHZyp2fhchdGfNbwY0Nl2:rQnn5o6qHgCwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827344, "uuid": "8c867943-a8c2-420c-a9dd-598fc631b490", "value": 1520640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827344, "uuid": "787230c0-c160-4132-b890-30c78780fb5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827344, "uuid": "0619de4f-189b-4590-9c01-132388080cc8", "value": "a63d1e29a6e17b86e251cc85b093881b3c355117c157d7b6c8086484a1581237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe052f7-6511-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724831130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831130, "uuid": "86f1c168-bace-4a4a-875a-b948e6977542", "comment": "Malware payload (DCRat)", "value": "36414c38ff6a43f76841281d0092fa6b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831130, "uuid": "b36264af-8be6-4b52-acbd-9743822d4755", "comment": "Malware payload (DCRat)", "value": "a6ca0d0f6c47f310778e8d3a82f96ce6b6e70e1248a17f73fda6dff59653b761", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831130, "uuid": "902c1405-fdeb-4e38-b4e5-a09e3ac9450e", "comment": "Malware payload (DCRat)", "value": "734fcf4466cb74f6355fedc7d91377f3a14bc384", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724831130, "uuid": "a0bde278-01eb-416b-b0be-a3b9d8df0cb1", "comment": "Malware payload (DCRat)", "value": "138e318b99db656f572643093127b851f7201bd141c5f6f8e96c42a6601ed53c6c422d07615afe61bab4d61283513147", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831130, "uuid": "ab2304bc-a160-45fa-8e02-b8723fd935a3", "value": "T164152396A7BB1F3DE6C1C3B580F6CAE1474B0C40B461196B06C279DBB6B67D09A409F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831130, "uuid": "94cbbb22-1ea8-4d5a-b423-b2ff68f2fafc", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831130, "uuid": "fd2de395-93ae-4a6c-9af0-186d92a9a7c8", "value": "24576:ykUxIMcP0X0yAy7+Wb7+cVWtHaD5aaN+2ehZk/9J:y3p9h+daW2+wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724831130, "uuid": "28928fe1-91fa-4b54-8c63-3ec71133f02d", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724831130, "uuid": "aeef218b-66d0-4507-bb8d-a2df0f946e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724831130, "uuid": "6c6887fc-6860-4c5f-b97e-be774dab1b95", "value": "36414C38FF6A43F76841281D0092FA6B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9ac3b3-6592-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724886370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886370, "uuid": "72afe3e2-15de-49bc-b05c-131e94e36adf", "comment": "Malware payload (Formbook)", "value": "d8c1e3d95b1091fe2736ab13b6a1f551", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886370, "uuid": "9a35383b-8382-40d7-8169-1d0cc5f2a32b", "comment": "Malware payload (Formbook)", "value": "a6f06cc81ea1f32259b6d9f45e3bd8b5ceef83c78041cf87a0acde5d3fc1a5ea", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886370, "uuid": "1969b04b-ef8d-44fe-81d0-f9c5946176eb", "comment": "Malware payload (Formbook)", "value": "fad4a1f0c7762dcfb1f89dc748d829adf04d1c08", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886370, "uuid": "b19ad1d0-a365-4326-9cb1-d48c4232f2d0", "comment": "Malware payload (Formbook)", "value": "a7e2307f039bc8594364c4991464c5ca16e3948727412e555113659e7ec980703b4e74d98a30eba55fbddff5dab037af", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886370, "uuid": "b92c55c9-5a05-4969-bd8c-36d864682f85", "value": "T16505E0D43620731ECD678831C568DD71A6A02D7AB206BAE764DB3B4B794C192DF08F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886370, "uuid": "c6d44a6f-c747-4ce6-9c51-c4244718e92b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886370, "uuid": "ca4313be-9a19-4c5b-bf3a-ad5a1af8868c", "value": "12288:yO9r7hB8/65HLeqn20Nx6ls0JVtBRH86NdlPDakjAm9WmWaKej3GF/jvIGc2tAW+:ycr7T8SLxgSwlXljjWmW/86xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886370, "uuid": "7aabeb9c-bd12-44d4-b0f2-8f531367d725", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886370, "uuid": "fb28aa51-56ca-463a-9f4d-e8e2c024a297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886370, "uuid": "e2454502-31b1-4b83-ad7d-81f713eff539", "value": "rRFQ.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba70496a-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724840248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840248, "uuid": "47c60a97-f7dd-486f-91d8-d6b624213198", "comment": "Malware payload (SnakeKeylogger)", "value": "5783a1fa182d62eb3838a2e3954a1f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840248, "uuid": "494c050a-e7f1-4aa2-b219-7c1adaa7a3b5", "comment": "Malware payload (SnakeKeylogger)", "value": "a708a6cd710ba79a3dee7a91db6fedf3b3f6da1ab10d6391cc98962ee0904fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840248, "uuid": "e80977f6-e65c-49b0-9a9b-8bf7f0590ce7", "comment": "Malware payload (SnakeKeylogger)", "value": "eec476fcc102b50390cf983725dbffaee693200e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840248, "uuid": "a72badc3-fc00-427d-bb80-737286c0cc43", "comment": "Malware payload (SnakeKeylogger)", "value": "b9863ac1a87912330d3be870dc8ad0f3bc9dbde271dad173d0c5f3451b09f801505570d97c33e10622547cb442b89c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840248, "uuid": "d09a04d8-fda8-401c-ba6e-4d9d1c348be9", "value": "T1270512D86B02C903E1A02B750661E33629FC6E99F406C3AB8FE9BC8F7C727259C45755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840248, "uuid": "65f0f070-fc00-4376-aea0-d3c88a1ac84d", "value": "12288:XMf55k2851eTl3GpqJTWwK6WP/FlTW/Md3SlpAVF/8CxeYm8ba/DONRoT9H:Xy5xR5VKBXvTUOlNm8bkDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840248, "uuid": "ebf86cd5-c89d-4e53-aa91-f581542bc645", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840248, "uuid": "21de82b2-7a14-4821-8580-d9ebe4ddc14f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840248, "uuid": "2f282dac-7626-4ca9-9758-cab84bbbaa0c", "value": "GCBrnEGE22coKRz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125651a0-6565-11ef-b7c0-42010a9c0002", "comment": "Malware payload (CryptBot)", "timestamp": 1724867024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867024, "uuid": "b9d3377e-555b-4423-86e2-cbae441d2d83", "comment": "Malware payload (CryptBot)", "value": "ba19e68c780c5a90ecbdf2e3c596404b", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867024, "uuid": "71dd4834-fb00-46ec-ac9d-bbb59e40e6ec", "comment": "Malware payload (CryptBot)", "value": "a7209dabde91f48944691bd89747d9a87bb7648f987a97b0d4ef9573e6311667", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867024, "uuid": "1e2f3b54-553f-431c-8ae0-17d9ac80fde5", "comment": "Malware payload (CryptBot)", "value": "fba31892427186036fe076b4ba3ec59108a1e4a4", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724867024, "uuid": "161376f7-b219-437f-bdce-339aecaea269", "comment": "Malware payload (CryptBot)", "value": "4ccd73602b8f9b1520efc3340d8f6572da2df3b1866be48efb2a5c1af8d23a299a9a8ce44f4693a1d0c7130536dcd6e3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867024, "uuid": "782c6b7b-de58-4a6d-b26e-6c966a829d18", "value": "T1CB66063A9B4345C9C13FA57ADC827F3FF8286ADC4369991BAC0508BCA755751E8AD303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867024, "uuid": "926c8a13-20b7-479a-a53f-2e7f1c0e839b", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867024, "uuid": "f2e7ee2a-1d53-4bf9-81cf-af1f853a5d1a", "value": "98304:eo86LNRr6kMZMmJuNRU6uYBgccK1xbDQJ:PrnrOMqOXF1cK1hDQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724867024, "uuid": "9849ec30-5010-4abc-9aed-eb8102ca61a8", "value": 6661483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724867024, "uuid": "a22316e1-f6c0-4fa2-bfb7-5d6c9ffe2c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724867024, "uuid": "77a2df46-46ea-4866-a76f-8e1ad468580f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b7efa2-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846172, "uuid": "4f2c7dd9-7de8-468c-92ee-f4a78cc4aa6b", "comment": "Malware payload", "value": "dde14d0e46b12f8a8c0cd770b905162c", "object_relation": "md5", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846172, "uuid": "18bdfb7f-6a1a-46f0-b275-1f8f5d535b6e", "comment": "Malware payload", "value": "a75287cc1412efff5df14e6e8a59cf38bdb3e2fbd60f19126671fe5493cee47b", "object_relation": "sha256", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846172, "uuid": "18c702c7-af5a-4bb2-98df-e82c95cd0170", "comment": "Malware payload", "value": "a2d8c6e6bd927d1905bd174303a1dc5facf25590", "object_relation": "sha1", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846172, "uuid": "b6e78619-edc6-431a-8522-dc99281d2898", "comment": "Malware payload", "value": "b6ae49611181c4ae67b33f54a0adc7ebeb2f8dd75db911820d612351b074b2a0f131c961279d3a264d0ccee104110096", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846172, "uuid": "b678b80b-272c-4864-ba4f-70f50bd372db", "value": "T10AE73361B18B8116FA7D5176A93AEF6F44BE7F73033040E737A4BA1A09F98D061B6503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846172, "uuid": "3c15a90c-3e59-4444-b14d-92cb792574dc", "value": "1572864:YdvXF+e76KJ9I4OzKvmTq4aMh6zGORvApErPLpcNRc3xBKHR:uP5J9I9GWhC7vApEXNCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846172, "uuid": "7fa568b4-dbef-4917-bdf3-42aec664857f", "value": 67692544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846172, "uuid": "28f541ea-6e48-4a13-97f1-46377038d060", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846172, "uuid": "17206ad7-4b02-4b5e-8141-f7f0460d7722", "value": "EYOFFTITMDLXZJFFCCGFDTBIY.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4212971d-655e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724864098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864098, "uuid": "94536d54-89fc-4276-91d1-0345909bd43f", "comment": "Malware payload", "value": "922ce47ef86d56f42097859ced848e46", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864098, "uuid": "79807569-f441-4a06-a14d-2ee680a089b7", "comment": "Malware payload", "value": "a770f8342da102d29228311ea9a0a542aea61017a2eefe3380b38b67a425ba57", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864098, "uuid": "11f13abd-9502-4e9c-9b96-f66ead452d89", "comment": "Malware payload", "value": "01acca0b1e16f4131ccff9622f4dc8664bd584f2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864098, "uuid": "17477ba0-b42e-4472-93b8-3a90cda9aede", "comment": "Malware payload", "value": "b106609361800842870a95dc63121917fd991280cb196b9b82409e45dcda6a849f3b1d615ad38756c7fedfd1781899ee", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864098, "uuid": "29bace1c-57a5-43c5-b55b-56b0b34119b4", "value": "T17777230091B3B515F76BB2BF2AB95FE48559BC6A02E59DF7637173B806F109204338A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864098, "uuid": "aca47e6a-e4d6-4c99-a003-0d419549c1bf", "value": "786432:xt9AUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0ybvB3R:xt9A7xVLYjsp+ikJbvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724864098, "uuid": "5ffd4ec3-4360-468f-88c9-f13daeba7ade", "value": 35910144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724864098, "uuid": "dbedeac9-2f20-4320-ac20-964440ab7892", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864098, "uuid": "8fc3697e-a543-41fb-9567-828954fbca95", "value": "a770f8342da102d29228311ea9a0a542aea61017a2eefe3380b38b67a425ba57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4101e2e6-6507-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724826730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826730, "uuid": "904ed42a-f0cd-4419-954a-38a0e06a3753", "comment": "Malware payload", "value": "d39d690ac522cee0ae633809d70e2144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826730, "uuid": "d9daa0c1-4b61-424c-b2e4-b3f3920ff8fb", "comment": "Malware payload", "value": "a98e3725e67617856e80da1d29ce39d491f0f56f7f832b949825749d02b8225e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826730, "uuid": "ceddd552-c6c5-422a-9bc8-39c2dda98302", "comment": "Malware payload", "value": "8058bc26d9205057910a18a104d9382d8a730b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826730, "uuid": "27f70b6f-2bee-4d57-9789-5b8bc2ec1038", "comment": "Malware payload", "value": "b412a8e8b274959c6bda45299791ea1e860117550b34e2e9bdfe8b819bd597042fbcbe77ca92a7676c5a6023ea426c53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826730, "uuid": "389a0b94-1815-4f5c-b0c0-349c814c79cd", "value": "T14E47297F26A48169C06EC13AC29B8F48EA337C715733C2DB52D936644E729C49E7F261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826730, "uuid": "b26845fb-4635-415c-8058-092dba698daf", "value": "a103cc658d452603d9847cbdd37a50c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826730, "uuid": "bae40695-5f15-45d1-aefd-fd932323b4cc", "value": "196608:nIN2+VYsIb320umuse+AheT29G9C/MRqK5oeoq2L:nHi+oeoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724826730, "uuid": "5970ea55-6f21-46d5-8a39-3123b50e46c2", "value": 26334670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724826730, "uuid": "f0578f5d-d232-4a73-a725-0fdd2309878b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826730, "uuid": "9b4d1537-af9d-4463-9c5e-95c65d1ef49d", "value": "MpClient_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd6a9dd-656c-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724870104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870104, "uuid": "95ebafb3-7f3a-42a2-950d-14876111a7c0", "comment": "Malware payload", "value": "359a8beba70783ec2e1838985018f5ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870104, "uuid": "41ce1b4b-bd08-42b3-8458-1a2dad35b335", "comment": "Malware payload", "value": "ab366ea9c7cf15bb24305716cedcdf490ef0b3e46f5ca249ebb0b7261b25e571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870104, "uuid": "ddcffc4f-eb8c-47e4-b676-268875a8fe94", "comment": "Malware payload", "value": "c989f3993c391676448d0e2c8aba81ce9a8276b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724870104, "uuid": "0867b596-018e-4175-9399-a6ff5722aafe", "comment": "Malware payload", "value": "a896ec25975a891955810b68e94df70b3523c123c2420cd41abd87e26b4dcd4316078da8974cc65d35ca091eabba85dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724870104, "uuid": "e44cd59d-95f0-4931-8553-5e6fd7943739", "value": "T14674289D7346FD63DC1618322959E2F6482576B01625087B77C47B2C6EBC3D8EE22B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724870104, "uuid": "2ee5b537-108b-4336-9846-57412f2bcf4f", "value": "647bc1f32f5206c42844fc594ea13105", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724870104, "uuid": "d38c9719-e6a4-4ef6-a468-7eb21623f147", "value": "6144:U0zGvKB9d3JewEfth2Z7swehrA8/l9PzuBBLVhOeSAOvGtSTE1:UPCb3REVh2Zdkrp9CueS0oE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724870104, "uuid": "ec189969-76f0-458c-a155-086217b8bef9", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724870104, "uuid": "a1334706-ac77-42cd-a625-bf51198b4353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724870104, "uuid": "df618580-cc5a-42da-a60e-401afd3aae6d", "value": "Ad\u043ebe_Activator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095cf907-6521-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724837803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837803, "uuid": "c68ff61f-061a-4380-a404-9ea62ce55185", "comment": "Malware payload", "value": "12397b82dfe524f38ddca22ca5636ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837803, "uuid": "0fbec8e7-2aee-48eb-b31a-e6f6e5080e51", "comment": "Malware payload", "value": "ad05ba75d61e0f68302ba8951dc47c793a0b336d400e9faf10e45bc2e8805e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837803, "uuid": "12487636-71fe-4b38-bcad-71faac495bb4", "comment": "Malware payload", "value": "92d8e7287f750903a0433c5c016936d0770cd5ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724837803, "uuid": "d2085f06-0ea2-42e3-a182-d59ab87bd82a", "comment": "Malware payload", "value": "365936a0f486f492840f90ba250f70cea9ef3164508ac943a97a148d77e7ff21990004622075403e259279f45518a7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837803, "uuid": "fa73c800-c5b7-47a3-8c8f-6fd82bd86a8c", "value": "T12916BF13F8408571E8B3007696395BB55EBEAD3433B9A0C36FA478A94E714D1A63E373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837803, "uuid": "0ab26747-806d-4ed2-942b-1fd5ecc543fb", "value": "b43e68cdd73b55c5b1210337438bad2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837803, "uuid": "92b6bd35-4504-4110-8318-0327b30a8b10", "value": "98304:sqqTewvfzKDYxb2GA5Ir4Uu8j13PDmZ3uakQrBqJ:STlKIbBCe39mZ3uMrBqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724837803, "uuid": "c2b0f608-3192-436d-93f2-4c37b789bacb", "value": 4280128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724837803, "uuid": "28071fea-1ae2-4c4e-834f-8c734c7e5d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724837803, "uuid": "8451da3f-8373-4d1a-8bc4-23d123a49854", "value": "SecuriteInfo.com.Trojan.Siggen29.2530.21543.30910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96bce54-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840246, "uuid": "c383395b-df6d-4484-b8e8-de87561b3fb7", "comment": "Malware payload (Formbook)", "value": "bbd94a3362ddd95703bec722f5e541c2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840246, "uuid": "46de0e35-89b0-4670-b2be-1b4c7963be8b", "comment": "Malware payload (Formbook)", "value": "ad9e2fa60943a06d73b99360575caa75b07833100c890a0bc85ae34fbb6411f3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840246, "uuid": "85da0aa7-3d91-444a-8036-f4e6b73c1bb4", "comment": "Malware payload (Formbook)", "value": "e923de40238bc664c6e2f20289005dca6e529d7d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840246, "uuid": "4d1b37f4-b88c-488a-bc12-943fc272b2fc", "comment": "Malware payload (Formbook)", "value": "1476a8b2ad1704b0bea87da287c28ac6e66f2ae08ec8d22eefab4f7cb3a96d046bbc37e0d3d2287da0f382341b5bc1dc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840246, "uuid": "ded0f692-54eb-4bf5-8960-f117340c74c1", "value": "T1B7052369B1C8BA780B9F7C9D7F29CCC0ED6BF2081495AF58C5611F010AF815E85299FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840246, "uuid": "c7f3caa0-d592-48fb-bf68-bf8cd84d0d4e", "value": "24576:NgzyMVn/JngHWofAK3SI4g1QITfpuLyEWEc6Ydb:NgzysnxYWtrIlQKILbXhib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840246, "uuid": "5c583ea3-9029-40f1-b36c-03083174ab10", "value": 815881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840246, "uuid": "db2549fe-9019-40a9-9e46-f41ea157af0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840246, "uuid": "7c72cc23-83c5-430c-ac2f-38e8907037b3", "value": "COMMERCIAL INVOICE AND AWB TRACKING DETAILS.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d136ec-64f9-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RemcosRAT)", "timestamp": 1724820671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820671, "uuid": "76702ea2-ffa9-472b-b8e2-b70e761e3a98", "comment": "Malware payload (RemcosRAT)", "value": "ac30e3d8b0557592e89bdca3e6b4e879", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820671, "uuid": "092ba7e1-e3d6-4d7d-bfe2-3db85a0bbb0d", "comment": "Malware payload (RemcosRAT)", "value": "adf8f2babc9a03e459102fd4290645fd46ae83f3001e581a7735f592449fd421", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820671, "uuid": "d802ae8b-41fc-48ab-a690-65d9c93c2e08", "comment": "Malware payload (RemcosRAT)", "value": "d484bca1c79af754eced69d18348c2a5e8cbe325", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820671, "uuid": "3404478c-2fd6-4b84-bb0e-a369b5fce9ee", "comment": "Malware payload (RemcosRAT)", "value": "952fd38780a4928df01bfe514999c3dc5ea7c0d5127bfcd4983513479bf5634d3d89cb3ec3e47eb725ddccd07ece6757", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820671, "uuid": "0f553a91-9b7d-4697-a119-dfa319b6a632", "value": "T14DC422093AD8CF53D60727BA0DE8E9970601FE249F66868BB584772E0F7D752F853602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820671, "uuid": "2fbf2cae-1c1b-4272-ba41-5a810aa6d232", "value": "12288:g+XRb0e93WNXplTiFFhzxgq5lBfh9HK3R2XetknutN2TeqQ:gIRQxFqFrgq5PfnHhet9N2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820671, "uuid": "51e3cba8-29dc-4d11-8d5a-b093e336f28b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820671, "uuid": "7dd487e7-d0ea-4a4b-9043-93cf300f0936", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820671, "uuid": "da071930-f8a3-49c9-bdc7-92650e52c5be", "value": "PO_304234.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69c1e92-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724840268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840268, "uuid": "cb9960e3-a21e-4225-abe0-183ef1552534", "comment": "Malware payload (Formbook)", "value": "676b8a352a266a21bb919399997cc2eb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840268, "uuid": "a10642a5-adc3-4e55-a166-28acf3eeb788", "comment": "Malware payload (Formbook)", "value": "aef26306d4795b684b50bf96ad874f9199c0ff8bd4698315b2fc341218dc66fb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840268, "uuid": "66936e7b-ed0d-4433-891e-7468e6a2dd6a", "comment": "Malware payload (Formbook)", "value": "5d2700717ed7902f91c3719c8bc25f9edf48ed4a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840268, "uuid": "9bd4d9a8-dc97-41d3-8840-d7e3d5ae504d", "comment": "Malware payload (Formbook)", "value": "c840efb2491cd0a50a23c53ebe2c054fee654b50cc0d180d68bda1484df8c6c90a54ae57ef0cbac1233444f92c884351", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840268, "uuid": "5a929768-7f90-4e91-a4a2-bb7dc0e51d20", "value": "T1AAF4338E3999E29D8D98FC26E39C8559483820E62F20049EA07C5997D5DF6C7E7C3F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840268, "uuid": "735682c1-5f41-4484-8ae3-dcd90ea72c98", "value": "12288:+/s5UJiqhFJYuMuvgubo3fGhrFBBTvrRb+uAsKb658c+Gu0dRRXqVKNTQYvgY:+/GU5J37bQOh9lhAss658GPUOTXvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840268, "uuid": "55a79613-f1eb-45be-8d56-004ff663e560", "value": 761879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840268, "uuid": "c800c2bd-3a33-45fa-99aa-550acebc4c5c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840268, "uuid": "a0355e5c-d46a-4c7d-9604-bc6ce4927c7d", "value": "Quotation.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26919669-64e6-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724812512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812512, "uuid": "bcc56af5-3c3f-4fe7-a357-a760a13f2116", "comment": "Malware payload (RedLineStealer)", "value": "5aacc8cd93bebb08e9ab78e44b76c1a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812512, "uuid": "e9278fe8-d18f-4830-93f5-0c9fe2ec47eb", "comment": "Malware payload (RedLineStealer)", "value": "afa8af2d882cb7c4cee86322f370ed80ac8d8410ccd8763baeb8597a2105d727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812512, "uuid": "e3cb2b78-82cc-4840-99ba-12b5d5ba654b", "comment": "Malware payload (RedLineStealer)", "value": "4d3cacb691f7cea24ce971a22327f3f6dcfd202d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724812512, "uuid": "d6557be5-73b9-4d71-815e-e181ca70cd07", "comment": "Malware payload (RedLineStealer)", "value": "1e226f65bdbd94ad9d541de0b4b95f9097465eefff3c4ae9c60e397d142d357ba0d163e6f2199cbf0adfd93e0c413c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812512, "uuid": "c02eff8f-9c33-4b07-8f1d-eaf31400ccd4", "value": "T177A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4A4DC154E61FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812512, "uuid": "a2fb44b2-3845-455d-8acc-7b8cb02bcfb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812512, "uuid": "d7cc04d3-984f-4730-99bc-c81385ec5015", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2b3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724812512, "uuid": "cda59d4b-0fbe-4f5d-aa31-e688378f872b", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724812512, "uuid": "e881209c-9150-45dc-b8e5-81850b40963f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724812512, "uuid": "d71a5626-f830-4a42-94bb-ec2c4ff8852d", "value": "5AACC8CD93BEBB08E9AB78E44B76C1A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b7e634-6593-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724886924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886924, "uuid": "51e3242f-2cbf-4c93-943b-1c8350af12c7", "comment": "Malware payload (DCRat)", "value": "19c4c9a7719c34a8ec0bfdfc687e64ea", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886924, "uuid": "0dc07428-157b-4952-9329-7791ab8ddfde", "comment": "Malware payload (DCRat)", "value": "afcc827d5872aeac992109eee70a63a141e94d660a573137a41800957bb35910", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886924, "uuid": "919f7d79-5779-4b44-a8d7-b893b27638e1", "comment": "Malware payload (DCRat)", "value": "b0838a5e06d3728d5663e5fc3bbb8c7d8fbcff5b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886924, "uuid": "7a9a93c3-fd21-477a-99f6-03d148781206", "comment": "Malware payload (DCRat)", "value": "e0a79e77d5dcb5d1bec24976e1e74201700249678b2c943c533ac9a53a67ec7e08dd8c697de917d4217bcae67e3a2394", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886924, "uuid": "b368980e-1635-45ef-8209-00929b4d71be", "value": "T112D5E02955D15E3BC26C573594A7103E42A0D7367D62EB0A361F10E26903BF8EEB21FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886924, "uuid": "cae848c9-9309-4bea-820b-ba2f5d91636c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886924, "uuid": "62f0d0c2-fb21-449d-b040-09b80e77d4a5", "value": "49152:Y9y+Be60mtA0//DMKizK7z2iUu9bQvjcajUB:Y9m69/szu27QbQvjzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886924, "uuid": "0e073723-9ac3-451a-bfa4-44b8883966b6", "value": 2962432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886924, "uuid": "07a2b188-5b3a-4055-b16a-600487ca87dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886924, "uuid": "f4c9e768-e8f8-4fa9-a6da-0c40c2f397d5", "value": "19c4c9a7719c34a8ec0bfdfc687e64ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053de316-6506-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724826200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826200, "uuid": "993b8579-4a17-49da-b678-d2c49aa614c3", "comment": "Malware payload", "value": "f6f52f46f9b5171383319b9da8aee148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826200, "uuid": "abc8ba77-938a-498b-b0c5-83ce57c963b5", "comment": "Malware payload", "value": "b123f45a35ecfabbf6c82c1e13f58bae461a1978d03b7f690de820047b6e2a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826200, "uuid": "6e07f3dd-b9d3-4466-b466-3f4a51a590fc", "comment": "Malware payload", "value": "ec02ae29dceda6722d41588131418ba1f9b4193b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826200, "uuid": "6f939beb-c8b7-49fe-89a3-8a59a0b79439", "comment": "Malware payload", "value": "c68d61c8cc2eea9297b4403db7479760b5b255e74e730667a9e067894333ff4c501ff3171eed7c3dab331208a72bd860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826200, "uuid": "19fb64f6-630f-4658-97fe-55eb2484b26f", "value": "T110346B1973A90CB9EC778239C9535A05E776B8420770D6EF03A0836A9F2F7D1953E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826200, "uuid": "e68c3d32-75bb-4d78-a227-4e856e832657", "value": "db9b5ee11bc6fd39db8df34c35ab633a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826200, "uuid": "42d477ca-7bcb-4e91-acd0-9f529b6c28cf", "value": "3072:Kt1HtViq36dgUh5p2O5jD9xd+mD87K/3ZNeorboY46cr3zaA6Gw4:KJVz3iNh5p2S39xdtvohvzcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724826200, "uuid": "1491da3b-ebc1-4129-bea5-30e1b161a977", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724826200, "uuid": "6a01f46f-eff6-4b97-a7e4-3d0d4f09e2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826200, "uuid": "6ee2a2cd-ab3c-4be1-a5dc-d77db6ab632b", "value": "b123f45a35ecfabbf6c82c1e13f58bae461a1978d03b7f690de820047b6e2a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977d937d-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827734, "uuid": "883a5abb-1b6b-49a4-81cd-0bf674c83cfb", "comment": "Malware payload", "value": "b8eb153d833666f1ed8dfc2ccb6cb733", "object_relation": "md5", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827734, "uuid": "c814b018-8e45-4366-a15f-bf6bba13f0d7", "comment": "Malware payload", "value": "b12ebdf6126b99c92682438dc5036bb77a0dc95046abfd234856e8c067fbce80", "object_relation": "sha256", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827734, "uuid": "6f9a5f10-5fb3-4eac-932c-4162aa01a044", "comment": "Malware payload", "value": "1a45e2c1a9c66244aa12dbe14f21416233e746d7", "object_relation": "sha1", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827734, "uuid": "473dff30-6e51-400c-a38c-7480cdf6ca48", "comment": "Malware payload", "value": "31fa942e059aca3dabae32a33caf87b334927b81b8d3ad4949dd68466f0250ec8e114e60c46cb0110e9d03799adb2ad0", "object_relation": "sha3-384", "Tag": [ { "name": "103-113-70-131", "colour": "#321A80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827734, "uuid": "2f3196b0-8e3f-4e08-bf4e-5b296d25365a", "value": "T19EE58D17BCA145B9D0AAA33289A652937B75BC480F3223D72F50B73C2F72BD45A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827734, "uuid": "45bd83f3-c1c9-45c5-b550-8e6de76b268c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827734, "uuid": "485efc5e-13d0-4a7e-a7c6-cbe4705a392f", "value": "49152:SiBiSRhySLJya5dwGflaZdlsZqqjUuromb6wE30WR0e:SsFQOlaZdonUgbq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827734, "uuid": "434a6187-8a86-4d3e-940a-c8bbb549cd2e", "value": 3212800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827734, "uuid": "6147e712-dd48-4fd1-9442-ed098a9bf936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827734, "uuid": "18768bf4-5415-4cd3-b231-f6ede7c3d31e", "value": "b12ebdf6126b99c92682438dc5036bb77a0dc95046abfd234856e8c067fbce80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e9a991-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822528, "uuid": "e5986b4b-63eb-43d9-ae50-def8f28d9481", "comment": "Malware payload (Mirai)", "value": "6571d4eae9806af6246e28d48115e46f", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822528, "uuid": "06628681-7504-4c99-a3b2-e699a448daf4", "comment": "Malware payload (Mirai)", "value": "b24dae72ac3334f43385022645db87f6fc434e77a10241dd61086578fbe65529", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822528, "uuid": "d3c36911-3a9f-47f0-bd2a-f29ea3bd204b", "comment": "Malware payload (Mirai)", "value": "0483601311c999347234c5b51a8af1f79d74cee7", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822528, "uuid": "a8f8416d-bc49-4fc7-94d7-61accbe13572", "comment": "Malware payload (Mirai)", "value": "cdf5a8edde2a06d7480e837219ae8bb0e7056499b8300c041fd2a4a975983e0c351c0e6b8c1e4d1513a0132ccf2109d2", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822528, "uuid": "f1b96bcb-179e-4cf8-8c5b-10d4aae70ed5", "value": "T1F1A30959F9416B10D9E635FFFA4F42897393476CE3FE7201AA255B2123C6A2B0F36406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822528, "uuid": "b5439f18-5803-4a91-a62a-85de4af0f4d8", "value": "1536:wNcnE1YJqXUkYbtVl9w1BrrI+apBwh4esQPWTirYqba0/lZwYDJbfXNcc:wv1ckyTeLrrI+apBwh4Z0Yqba0/lCOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822528, "uuid": "18124453-9ba0-47af-b449-8454b1f84f74", "value": 100076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822528, "uuid": "d7a44105-350e-4cfe-a954-94670a275848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822528, "uuid": "789edbdc-746b-4b14-bf1b-65be91add2fc", "value": "criptonize.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8902904-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822608, "uuid": "fd12ea43-744e-43e7-a20a-7cf9a856c220", "comment": "Malware payload (Mirai)", "value": "8e2be6be784dc094ecd00f9455b5a974", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822608, "uuid": "bea3a563-27ff-494d-b273-dbd88a5c8ca8", "comment": "Malware payload (Mirai)", "value": "b28d9e46db3e20e5d9161a33f302210d97a1b2ffcb4d8c30037db23610f1ee12", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822608, "uuid": "19eebe46-207c-4520-8aa0-8cd9b047b76e", "comment": "Malware payload (Mirai)", "value": "4ee0c1beca45b050ec680c51ecb2118f9f2ac0c8", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822608, "uuid": "1fe9f1ce-921d-4c98-98bf-82ec94f083ee", "comment": "Malware payload (Mirai)", "value": "38b2a008f9e5ea2e97a0be286b71f2bc2da700434df8e958a3a9ca15c0108876b26d6f780dc8052779dc50e68694e4e5", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822608, "uuid": "a03d71c0-829a-4346-bb2a-ee4b6ebc82ce", "value": "T15CD49F59BB8E3D42E3D7E338DF4993A1632B75E4D36392A23901431DD4C2EA9CFA1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822608, "uuid": "8867e83a-8c9d-4d3f-a23b-706f97c1023a", "value": "12288:wjuSb90jH0/xJIsd6xHi5t2QRbHg5zAWZn:dtgPTd6NixvWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822608, "uuid": "6447f892-399b-47d7-9fe7-358d7c6453df", "value": 626792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822608, "uuid": "2b306f8c-4349-4972-8e33-d8f57581e7dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822608, "uuid": "e44d4501-7b66-4c03-a405-90a1954fc257", "value": "criptonize.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50633d1-6562-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724866089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866089, "uuid": "c77fd1d4-085c-49c0-bb86-c6303e594201", "comment": "Malware payload (Formbook)", "value": "aed20228a60de7c73723b2f48ff53ac4", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866089, "uuid": "c4584565-9e29-4de5-8a2a-c98a6237dde2", "comment": "Malware payload (Formbook)", "value": "b2aad9504adb5958cbdd87a41356fbde48d35658295ef095127db03781480c6d", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866089, "uuid": "05bfd14c-03f9-4b06-9340-fee4bbfd2f8a", "comment": "Malware payload (Formbook)", "value": "a81bcf2c88bc3f855dba37737eb7e20e0ed8a534", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866089, "uuid": "820a6d86-1fd5-4d58-80e2-44b8ad078f21", "comment": "Malware payload (Formbook)", "value": "ab2156c5a631b28d30271d8497edcb746a3d54c36c8a487fcb47a85dfe2eb47e20eee9952e2ccd54f80946fb16ea18ed", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866089, "uuid": "4ad4f4db-9904-42c1-a782-f1a503422695", "value": "T14494230F7089B9E79C9A41C41D609059EB27BC54585E0FBC7B33A3268880FB94A1FF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866089, "uuid": "f68de999-234e-437a-871b-41de3d85fe3a", "value": "12288:lgOZzciwqq1cr2ZgfRdYm57mqz38smRxX48xXouei:eqcSq1crEWRdO83vmLoEXouF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724866089, "uuid": "18337995-83c3-49ce-8b8e-d5ee02edebca", "value": 435407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724866089, "uuid": "bf514037-20c9-4424-983d-75b94815f65c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866089, "uuid": "26f5c67d-7a1a-45b1-b863-f438dc0861e2", "value": "Purchase order_28082024.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bc2e70-6532-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724845372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845372, "uuid": "9a4304df-a51b-4259-8d4e-f9a11a0d8303", "comment": "Malware payload", "value": "8b1ca015ddd4cfbc27e92e4e4458d0f4", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845372, "uuid": "f664b921-4e5b-4caf-bbbe-8646bafbd548", "comment": "Malware payload", "value": "b30d51215ecf070eba0f2bce1f39cbd9073636af5ed4598fab4f5e58f7805392", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845372, "uuid": "6a647075-1529-47a5-af02-9ed7f871aaea", "comment": "Malware payload", "value": "35cf3dc2316ffd8ff97d187bd76fbc83cd6516db", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845372, "uuid": "944b5788-527c-4404-8c24-63d005d11464", "comment": "Malware payload", "value": "683b82bb12622927cebc92cc272792f083dc598eb92daa975f47a2f02fcef2fc29f29b2e334c7879a5f70534180aef68", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724845372, "uuid": "fa865088-d1d0-4467-b92d-ad1ba3262e43", "value": "T1E316237CDA2E4294CFB10530915C3B86EC98B5F2E49414E6A611899F3BEDD92E724CFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724845372, "uuid": "6c68fb2c-2697-4e40-b04f-a52e8080f141", "value": "98304:xxemgjaLrJ5SIl4+g8ZFUryLXZnWhXDCMbVWttXsH:yVaXDSIS18zUrmXZ4XDCMJck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724845372, "uuid": "ce1a7458-b723-43ae-85f7-396d7be9a53d", "value": 4161872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724845372, "uuid": "16cfe175-8691-443d-bfde-e3b9e6f3d943", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724845372, "uuid": "1e276235-5462-4735-909a-fc005e1d8a21", "value": "Viking Culinary - Catalog.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fa51fa-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822661, "uuid": "b6d54911-5b58-4b18-8dac-57ce521ed462", "comment": "Malware payload (Mirai)", "value": "896512aa230392aa802369c72019f759", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822661, "uuid": "d890bcc3-78c4-4378-8749-6f1cef66b180", "comment": "Malware payload (Mirai)", "value": "b4bbf0132b4b9ebaa0e89fa8a2c2b21775d1284418828a0e342f2bedca6f5708", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822661, "uuid": "833542ef-3964-47e7-ae3c-2462df762a55", "comment": "Malware payload (Mirai)", "value": "8de6f9350ca3dbe64351f5d7425b28472b84085e", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822661, "uuid": "bff5efb3-1092-4c80-90f7-01562a22f43c", "comment": "Malware payload (Mirai)", "value": "63c32b9a300a0ae8df91ae2a388b288ef76a916c2fd2c21edf7b05864ddbd9e9c75649ee1f55bde65902121030826c0c", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822661, "uuid": "1f8406c3-c0b2-4121-912e-ae9e06b7ae6a", "value": "T1E3836CCAF7C3D0B5F48204BE5076B7274B71E1475059CE85DB687C22ED27993AA0B2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822661, "uuid": "01ea7b4b-b177-417e-97b0-5abffc97c1c7", "value": "1536:3wBpBGtd8pjaeTLi2xWLOSx9lmiU7RG2cj7JR:hIH/i2xWX9lFUlGB3JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822661, "uuid": "9e0f121b-0472-46b9-bb43-38fb5e781c92", "value": 83816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822661, "uuid": "5c5abc24-32a4-4af1-9076-3769bd385d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822661, "uuid": "70dc38cf-22b8-49ba-afff-19b49b5f8bae", "value": "criptonize.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55719287-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846091, "uuid": "cf4feb66-bdae-433f-8f66-eb9815e24bba", "comment": "Malware payload", "value": "b9ec2026040610e1fa0c7612faada4d7", "object_relation": "md5", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846091, "uuid": "ac332d14-1364-4497-8a3f-53926036197f", "comment": "Malware payload", "value": "b52fe0bfaa1197cbb8964127f1564739155ed3bee05d34ea82a533f147c61c33", "object_relation": "sha256", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846091, "uuid": "ba8bd100-1d1e-4788-ab8d-3a4106413790", "comment": "Malware payload", "value": "5cd1f87e717354fac68528baa59fbfc1052ed13e", "object_relation": "sha1", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846091, "uuid": "105cfdbd-5956-4334-9f1b-c01d3070f1da", "comment": "Malware payload", "value": "7698980cf8578089d301c71a44628d0212af8dddcdeaa8ec6b8ff9c8060cc1ed27dfd633fe7adf930322c0094affd7b1", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846091, "uuid": "60a9ffd0-a6a0-4269-813b-476ef28e9e3c", "value": "T1F6E733EA8036838B68B6ED10965A5757B4D67B708031B8B6370CA7C70FCB6D520F365B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846091, "uuid": "ead55baa-f666-493a-ba33-ff30cd3e88ac", "value": "1572864:zl/1PGo9LJR0752+9MkSzE6DVwgVhExL5RLa3n3XsoPB:zh48LJR07YkAFDGgVh2MMEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846091, "uuid": "44613b78-9ed7-4815-89d1-9a00bf333c02", "value": 66385280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846091, "uuid": "d7f53245-f0d5-4937-96fc-c81952a9c121", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846091, "uuid": "b634caeb-9f0d-42a2-ac84-8eb8dfbc725f", "value": "b52fe0bfaa1197cbb8964127f1564739155ed3bee05d34ea82a533f147c61c33.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba98b045-64d5-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724805459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805459, "uuid": "65519437-6383-422e-a974-f4d27ffba1f3", "comment": "Malware payload", "value": "af67f113f6de4648aadc9d7a0be4d0ca", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805459, "uuid": "29a145f4-1a70-40f5-bd97-65a8b628f91e", "comment": "Malware payload", "value": "b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805459, "uuid": "54de051f-ef03-43b9-9f41-55bec407fd72", "comment": "Malware payload", "value": "d7697c61fe6ca142da8d9a3b14af32ad78778622", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805459, "uuid": "5f843690-921f-45e3-aa78-f3fa1937b95e", "comment": "Malware payload", "value": "b29ed85c37827bb8be680b97e6ac26a10fb78b82cf7d23b1f270a7fd02601aa965cbd69918cb9601499631621c7b7e4a", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "CosmicDuke", "colour": "#8489D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miniduke", "colour": "#1910CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805459, "uuid": "e0846132-95dc-4001-b5fc-9d48b818051c", "value": "T119B52220B7828073C26725B44AE5F7B85779BDA22BF299CF17C556F80F242C1927731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805459, "uuid": "d77d4979-3d71-4c4f-97e2-95b359ac9b79", "value": "28fddcffc23c8d6bd8c14acfa01b5fae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805459, "uuid": "9e67afbe-518d-4742-a672-c17a37ad1430", "value": "24576:Pe6u/p6D3RSWGDBqSfHfXBYnvakaYhF+Ma1eCFd1Zz9ItONK+ehkrh2J:POB6zYBvGv95F+MqZFdHwVhOcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724805459, "uuid": "679de13e-a1db-4616-8e9e-1e9f388fc636", "value": 2307951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724805459, "uuid": "26a2b133-f80c-47a2-8236-6db556946b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805459, "uuid": "fa59ef8d-e32d-44e9-b876-1199efeebd00", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9818b26-653d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724850205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850205, "uuid": "d8e17bdc-41cd-45c7-a409-5f3733c91263", "comment": "Malware payload", "value": "b23a2ddc7ef875889a0ee693620c88b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850205, "uuid": "e16b05af-ae13-4976-98bb-0a90d2dbf70d", "comment": "Malware payload", "value": "b6271260d2a30b87f701cd6c4fba52fc3e4012c9cdf6a280e324b695941c6fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850205, "uuid": "493293ef-9cb0-4826-a065-fec4030148b1", "comment": "Malware payload", "value": "f1f054090256f887caa47ef346051c2ae5267127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850205, "uuid": "d2b6e1ba-454f-4d2f-b5b6-25fc39fb4ad2", "comment": "Malware payload", "value": "c22d6c062792479d724af3ad7e3c4cea10f31ee8b6aeb3851734da3952fd18097970d9f2433ec25aff544e883a10dcc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850205, "uuid": "0addc833-8ccf-4963-8c50-4d792fafc297", "value": "T1A375CF0237D1C027FF9795324EE6F725867C5E251827A61F1BA43DBCBE706A01A2E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850205, "uuid": "e78b89ba-66cd-4626-9b08-44cefa2d769c", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850205, "uuid": "2960c9ef-2fd9-400d-85e3-e183a4e85f23", "value": "24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aDthteQ2wpcSuOlxkc496EG:5TvC/MTQYxsWR7arAQrcSplxk99r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850205, "uuid": "0a404d2b-8d86-4d7d-9bb0-125072f5c572", "value": 1608704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850205, "uuid": "7456f188-3055-4dac-9a58-f330e545ff0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850205, "uuid": "d88823c2-0aef-495b-b5eb-bd1d1747dc14", "value": "PAGO-630.900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78997f6-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Neshta)", "timestamp": 1724840270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840270, "uuid": "d285fd50-5ee6-40c6-85bd-1a1e375c35b3", "comment": "Malware payload (Neshta)", "value": "1581f07d5a3c0645bf38e449bcfcd387", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840270, "uuid": "36ee3f98-6fb6-4437-ab0f-3785c72aa743", "comment": "Malware payload (Neshta)", "value": "b7640ff2a8451d319071c08561f51a9f944cd4ff376fc5775725a9f90e24905c", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840270, "uuid": "318d7bea-ab0f-452f-b294-6aab6e745a69", "comment": "Malware payload (Neshta)", "value": "c9b9dc788044405af6c500ff41e31c6a5a804801", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840270, "uuid": "0dee1bff-f414-4590-b17e-a4eda0927270", "comment": "Malware payload (Neshta)", "value": "96537908892d34b47d055a8ba81bf8f0b73072433f2264c84f96849001618e9a337d412a44513edc725c15d1b4c40b12", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840270, "uuid": "fde7f584-236a-477b-9d08-88731efd2149", "value": "T15A1533A49E820A4D2C2D2CE335F25999D8D2F1924742B4390C4BFACEF547C48D66F9DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840270, "uuid": "30a977e7-ba50-4aa5-88ca-08e0ef5a38f1", "value": "12288:m6hqKk/k9h0C5hU9+5tseCa+eCQ53W2gxRzIapn6HxitL5djxKtYQkLc/kzwaSew:m6rhQ0THCapgt605hqYiszwdgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840270, "uuid": "d7d430ec-81bd-45c5-aabb-99aa2b287379", "value": 947450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840270, "uuid": "05928d6b-2533-4561-ba2b-417e1c98a836", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840270, "uuid": "fe2ec617-e423-4975-9adf-bf331b2b92d9", "value": "Quotation Reg#270824BOQ_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d071db-64f2-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724817713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817713, "uuid": "dabe8ca7-0686-4d8a-bbad-fd709178d42e", "comment": "Malware payload", "value": "17e3865d46028c9b1ec58584619eed45", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817713, "uuid": "6a5cea86-007c-450c-a178-0acb76f6a86c", "comment": "Malware payload", "value": "b7b85fe98b294e4dd2d49e2592ad8077d4945801b6a7c40b2a0802724e5fcaae", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817713, "uuid": "027e7d11-af91-4b25-99e3-7e6cbc483f25", "comment": "Malware payload", "value": "bf2e77342fb0447d48aca2ba3e4e1acb3cc8120d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817713, "uuid": "0faf43b5-0816-44c8-89dc-03733bd53a65", "comment": "Malware payload", "value": "4249cee79afad4c159821a939748404e78d8bccfa69430041d61e8354c2bd62ade1be8efc81bae6680fdbcdaa3c3fafb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817713, "uuid": "b792e3db-a869-43c3-a8a6-dfa2966442db", "value": "T134F164187AF8512DF27B8FB06DD266D9EDFEF3236906466A148103038E02F92DD425B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817713, "uuid": "e4133058-cfb7-4a41-9e65-be3793d7dbe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817713, "uuid": "5f16e1cc-b48e-4222-ac6f-2b83a0afe78c", "value": "96:GDYjX/B8Dn4qwuK/ncVqZ790AvKn6riLNQ+e3q5dNtosZ2Y843TWVWe16GRlLtfn:G8j2Dn+nAK9/vkvWHqzL3aVPDR4in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724817713, "uuid": "3c6092db-a694-459b-ba79-e87633c83259", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724817713, "uuid": "3faa2c00-7486-4793-86d7-2ec980277b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817713, "uuid": "0101a090-ca4e-4bc6-9b6e-1980a2b11b8d", "value": "run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef0e5c8-651e-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DCRat)", "timestamp": 1724836524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836524, "uuid": "5450e247-93b3-47d6-ac1f-fd620489bb1d", "comment": "Malware payload (DCRat)", "value": "92949dd923e8e88c697092b5311c7d95", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836524, "uuid": "338cc116-99dc-4b5f-91f4-ac171dcc104e", "comment": "Malware payload (DCRat)", "value": "b7d005d2dee9456e5fbdb5f7d46a7275a9c7000ec6cbf982eee58897f88fa4c8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836524, "uuid": "3b12985b-16e1-46b7-9eb1-e781a77983d6", "comment": "Malware payload (DCRat)", "value": "cb61d5772f5e07467734af1c151e831ff225ea17", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836524, "uuid": "b0e67dca-c5d2-4006-9f19-231a3c1424ab", "comment": "Malware payload (DCRat)", "value": "b0084f005a773e3ede8f551572d143a8a4bdf5e8bb934863497a866f77b80971f46a62a5ef968004e6777a07f6004f2f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836524, "uuid": "0749054f-60c3-41ac-a0ca-58323e7a2759", "value": "T160B5CF06EDA28E32C1A13F3684DB142E52F1DB21BA12EF0B762F10D5AC15175EE572F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836524, "uuid": "2811f68d-7b24-4a43-87d1-75bf416001f0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836524, "uuid": "a759dbf2-1932-4e81-9d90-87692dcbb098", "value": "49152:IBJGcql3qzKdi2mcnaKgkxueaRFuNZWYUshMtQd0:yIcqlO2mRKg+mwhhSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724836524, "uuid": "86360052-076e-4f89-8582-6f3b57af235a", "value": 2295916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724836524, "uuid": "b3446486-5fd4-4c7c-878c-468243c5c9dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836524, "uuid": "3114914f-12c6-4911-8209-18899b2b5571", "value": "92949DD923E8E88C697092B5311C7D95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7da595-6541-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724851665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851665, "uuid": "a88da295-37cd-4270-bd8a-23ed531696dd", "comment": "Malware payload", "value": "876c12019e3b15fe92841e8d358d4921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851665, "uuid": "27c7dcb5-ab25-4f83-b59a-13699a6a873f", "comment": "Malware payload", "value": "b8738d4888209ef2912d232eafbd13a0017bb62761a9f5d567c3fa0090a09972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851665, "uuid": "aafd221a-4a00-4b44-854f-c43225434209", "comment": "Malware payload", "value": "08e3fb4496270b4ab04d5adee71fefdb670114a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851665, "uuid": "20a12eb6-6871-4726-91e8-1e535a473472", "comment": "Malware payload", "value": "77dec16db374cd3eeb9c856b02d8e73bb55597ff14a734a91a7e0c3370bd31a1d40253d49b5c5c96bce7b9b220077ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851665, "uuid": "070cc52f-649b-4ab9-8def-8406611c2868", "value": "T10C523C5C1BD8443AFEAA1EBDA8E343018A73F76E5503F72F1C9C50992D8276055F136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851665, "uuid": "1a1d3355-73cb-48a4-af70-8c406755431e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851665, "uuid": "c45703cc-4814-415b-868a-11e1e104c599", "value": "384:EDtTXkmazUdOsR9VxeFpFb+iQIQRJqj5MqaCFJV9/y:Eh7/6Uad1QHqlT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724851665, "uuid": "8cf3da18-067f-4183-b54c-689df56b8d2b", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724851665, "uuid": "a5271c4b-ab8a-4fb3-804b-8c71863ad62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851665, "uuid": "97f9bc0e-7ca8-459b-b763-443f3eeb3d49", "value": "SecuriteInfo.com.Trojan.InjectNET.17.23993.14959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d36248-6528-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724841206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841206, "uuid": "3121267d-0cca-4ce3-9674-f2b62ce72baf", "comment": "Malware payload", "value": "4a941ed341f71498a228d9538722b5b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841206, "uuid": "9bfbaefa-6799-4f82-a87f-f6ca10cde176", "comment": "Malware payload", "value": "b8bd8c045e472c54f32b167544c0354b24e05d77e81e995386c63dd63a0d7710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841206, "uuid": "9a39d274-aeb6-4510-a924-64023c352a0c", "comment": "Malware payload", "value": "3abe490d27ba3473b0420f625b7e980ec66e23d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841206, "uuid": "61c284cb-a8ce-4f06-b5a8-36c200c3ef6e", "comment": "Malware payload", "value": "b5fc37fedaf8840952ca0112e642007b7d496f7153f5e4c91ac057a57b983cf98cffba8d01b4690013e232e5fbf788d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841206, "uuid": "84dd466c-803a-4dd9-96c8-c74050c75989", "value": "T1E3B66C43B9A154F0C5AE927489678013BB707C0A0B3463D73E1CB7A86F76BE09EB5764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841206, "uuid": "baec386e-5a14-4e3f-af2c-bb7eb3d8c64e", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841206, "uuid": "94b04fe1-aaa6-48b6-aed0-391a9cbbbad7", "value": "49152:cebRmqDt1u6H0+KsXgy7FZiDEPUDzJmeuVZUOyns9FgMMvWE4DSjv5E64Lo8QXMY:tR1NUWQoqmX9Ff0LEmCSDuZMz3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841206, "uuid": "a63cfcdd-fd1d-41e7-b5c4-71b78460cb55", "value": 11284496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841206, "uuid": "8e196670-5670-449e-9b4e-436351c34891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841206, "uuid": "4129a9f2-fd8e-4740-87e0-b1f0e117d636", "value": "b8bd8c045e472c54f32b167544c0354b24e05d77e81e995386c63dd63a0d7710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c221b98-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724818615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818615, "uuid": "9a03fa04-af8c-4b2d-9994-a0c4cd4d6dae", "comment": "Malware payload", "value": "30ae4e97d32e305f8288c50dfbfc641c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818615, "uuid": "7b1879a4-f55e-4e11-96cb-e8813d81d897", "comment": "Malware payload", "value": "b9695dda7cddac536ffb4dea72441fea27ea69c661d25bf7f8ce41baad21fc0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818615, "uuid": "85c4de85-629c-452a-8e50-e5d01da3d1d5", "comment": "Malware payload", "value": "ffba3752c161da353fd3c643360bca81d04a3edd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818615, "uuid": "d0ec2f85-f8aa-4505-8d7b-d3e34b748b45", "comment": "Malware payload", "value": "3086f7d752c0d6a651b3feb88b03b9d32cd3a65e20d77d0a9b106f131db87fafec228b619bfc4f2325a97010c89841a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818615, "uuid": "55200f35-5e59-4135-afd1-fb437ebd9a93", "value": "T11E032A007BDD963AE6BD4FBC59F0121583BDE6A72603D78A2DC440EF19237C1D542AEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818615, "uuid": "c265b7dd-1e46-4b49-ab04-c594b326a9b3", "value": "768:Zky9Spjgqa2HD60ox0AMVx9cLR+cn9E8NaB6Sds8Qr5PqttKL:Zf9SFC0AM79cLn9taoGs8yPqtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818615, "uuid": "d48f5f6e-060b-4492-9a26-c01dddc825f2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818615, "uuid": "6dad6bd4-ddc3-4005-a6fe-b470e5c2e508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818615, "uuid": "561e6734-7b3a-4804-af02-8445a6e0773d", "value": "Invoice0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae95df56-6587-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724881889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881889, "uuid": "407ba93c-5abd-4685-8c17-e9020791eaf5", "comment": "Malware payload", "value": "c14bc74c048972b3eed2073ae3cdc8c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881889, "uuid": "d56471ed-4049-4a98-989c-d7859a2c5b73", "comment": "Malware payload", "value": "b9852714c9f46bd6de740eb72ed901ddc38e897d242209cee84f0ed2b5bb76d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881889, "uuid": "2dabb79a-1c5e-42ce-b4b5-251887ca8a3d", "comment": "Malware payload", "value": "78ccb2bcc3c5bbd9f49ad1acfc1980006ab6c725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881889, "uuid": "1934d718-8648-4347-82fc-af6054f91c89", "comment": "Malware payload", "value": "a5baa4fe68064371012393bea105f90d760348ff2a08e26ee0e1d4b54c514360cf3a963f40dc2625abfb3dac2a97a483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881889, "uuid": "db0bd507-8a46-45d6-afe6-5f0da1e1d006", "value": "T172D53300F6D244F2E4B30D325D7DB792993E79646F14CA2EB7994A289E325C11339BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881889, "uuid": "0a8bff48-6e6b-4156-8051-deaa8a02aa95", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881889, "uuid": "8c5bf124-4079-4d87-a38b-49db4353517a", "value": "49152:gxfBfJXAEWtsTocM7XpqECJE+UOOQo5jqG0BTDKyaWHX3kbdC2VGyBbauoMMCZex:8BfKE+sECJE+xOP52FbHHX2VHOLoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724881889, "uuid": "0e1368e9-6587-43ee-984c-556c23aefff5", "value": 2967048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724881889, "uuid": "0f54f183-f6b3-46fa-b3a7-2fb26be72321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881889, "uuid": "6f18fae2-aab9-4ed6-8c18-849cade33cce", "value": "31-wrar5.61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f937ee18-6591-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724886309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886309, "uuid": "bf1783be-4664-441f-a0d9-06f62bc903b5", "comment": "Malware payload", "value": "2d62bc45fdb61f802129df3fd20c0b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886309, "uuid": "7ce577b2-8d35-4297-bb5b-c5f47e10f163", "comment": "Malware payload", "value": "b9c32503cf6bec98309ff478eb98b3318459280a8c6484121a5902f4d6502002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886309, "uuid": "a2f70b0f-5a83-4c05-9376-5bf0709fe9d1", "comment": "Malware payload", "value": "470eeed18bf1a81330d70fca79b703de5f01ee52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886309, "uuid": "d8894699-3e62-4090-be70-43ffd8bad7f7", "comment": "Malware payload", "value": "cfd9002df3454c9af56b87ba6712afce5b26f6fc351ab0a21288fd73d41a8f9b023a2058b7c5d42409e72e7208b07977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886309, "uuid": "5e6f2c5b-7630-45f4-bbe7-2ac3296453bf", "value": "T163E412A82616D407C94197744AB2F6F82B2C5EDED80182139FDD6EFBFDBAF160C44291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886309, "uuid": "02d74407-9793-4e5c-9a75-c3e0cec904c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886309, "uuid": "2b0783c3-964e-4da4-91f8-a8fce305f84b", "value": "12288:roW0BUTnCiwyEQXZc4qG7gBYnrWknghajy/MNS17kjgYMpMvRgFRQ7qn0gQJ2R8:ro9U7wyEQeLBYrihajyf1obMyGTxdQJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886309, "uuid": "3e86b2d6-7884-4288-ad7a-669b6a57963f", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886309, "uuid": "14f5c478-fcc2-4238-9819-aacf81454722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886309, "uuid": "b11797ac-bfbe-47f6-8291-e552b1585f91", "value": "z40DOC_SCANDOCUMENT27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0c461f-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Sliver)", "timestamp": 1724818616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818616, "uuid": "3b4ddca7-a440-4a16-b118-5eab8a639bff", "comment": "Malware payload (Sliver)", "value": "0b5dc77fb890e68b390eca93dc90e55d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818616, "uuid": "a2d1225d-1f96-4abe-8786-66ecf577eff0", "comment": "Malware payload (Sliver)", "value": "bae601f67c61730f017aca7f8374bb85f8076fe383134201ad830a1176872ce2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818616, "uuid": "2c721871-91f5-40e8-a606-c1544b192d68", "comment": "Malware payload (Sliver)", "value": "900a5584720c9e244c0dea5651e8acf13971fcc8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818616, "uuid": "f26a6cc5-8352-42fd-bdb0-0a4a2e23b189", "comment": "Malware payload (Sliver)", "value": "4ef1a8dfefb7a792b74307115bcd766cfcf1e8595778bd02e01fe18630a9490f2a7fb8b8faad7da8865fbb520e0433fa", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818616, "uuid": "a4d4bcc7-4732-42f1-b1e1-53dfc13f0791", "value": "T1A22105103E551E3B87A48B5844A993C2FFCC13CC759891F7339CE6862704A90EAB054C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818616, "uuid": "59709995-dc8b-4aac-a518-c888a4d1e653", "value": "24:qOl9hgCaQyZN3bgCvOQyZNg+gCvOQqOEOWIlE8CN4dN3wJkrI:qOl9hNPyZN3bZvvyZNg+ZvpqgSJk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818616, "uuid": "7fe20318-94d7-4fe8-a6ad-88c37de4a755", "value": 1154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818616, "uuid": "0caa9e7a-a0bb-4335-88ec-de06bcaa5c86", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818616, "uuid": "eb464f2f-a814-4e64-914e-44b2582f4a1e", "value": "ibero.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b91fa7-655c-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863540, "uuid": "cdb480e5-77c9-4257-8e74-078d6bd15b97", "comment": "Malware payload", "value": "7b9e449d03cc0e3e5fd65dd019505bcb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863540, "uuid": "2a26c86e-f097-437b-ab3a-4d3b40c49e04", "comment": "Malware payload", "value": "bb193b20d415134b38b673f30b232325f9cabff21732957266d2d207e2b7e170", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863540, "uuid": "e0431996-d16c-41d2-936b-bf9d818150f8", "comment": "Malware payload", "value": "26eb5c00591fa4307cbf71c95d9a0b63ca6cd5d3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863540, "uuid": "557d4f71-da4e-48f0-85e7-56c32a7c21b4", "comment": "Malware payload", "value": "04d6382e2cfcac75830af25031f871d20473673fcc04f1b50e8c0d63d2b9fe585891feebfb0c4601d0a17346d5a7ff7f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863540, "uuid": "0c373018-019f-442f-babf-cdd17775b4fd", "value": "T17277230091B3B515F7ABB2BF2AB95FE48549BC6A02E59DF7637173B906F10920433893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863540, "uuid": "d13a98a0-eba0-4bdb-8c8e-c96f7d03999a", "value": "786432:ot9wUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0ylvnA:ot9Q7xVLYjsp+ikJlPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863540, "uuid": "95ec2dbc-486b-489d-b24a-4a1d6a6772bb", "value": 35910144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863540, "uuid": "f60c771b-1a0e-4ddb-8bb0-bc6402c2aa13", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863540, "uuid": "be93504c-da09-4305-8772-15391d542bf8", "value": "bb193b20d415134b38b673f30b232325f9cabff21732957266d2d207e2b7e170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1c4d38-6591-11ef-b7c0-42010a9c0002", "comment": "Malware payload (GuLoader)", "timestamp": 1724886205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886205, "uuid": "e55c8065-feae-4b06-b5c5-d1fa51aaaea0", "comment": "Malware payload (GuLoader)", "value": "5b1b10d16308f61ac598822de806e827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886205, "uuid": "9b09f781-564e-44b3-a0e1-09f7cbd93df4", "comment": "Malware payload (GuLoader)", "value": "bc94d4814be919e507e812ff0b12a0f16d9a490c855b72ff7b8d4285bed16941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886205, "uuid": "d56474b4-29be-42ba-a942-4c26b968b4ed", "comment": "Malware payload (GuLoader)", "value": "9f78e03576e15884ec73852a3e304d53bd1ef51e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886205, "uuid": "066f6cef-39b5-41da-a160-ccac0b4bb205", "comment": "Malware payload (GuLoader)", "value": "1dd18f867c722f69c2b14ef310a9eeece3eb5a7f47a29a30ae95e6531896e353ef6a150820b4ad1f57aa58a8a996ebf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886205, "uuid": "c3b67941-0786-456e-9c58-0cc9ac0c4d22", "value": "T1D8F412977BC1D4FBE67C03B368D7E79159E4A8E469560383BBA23BD97032F166D0A004", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886205, "uuid": "a0ad3206-f0a2-4152-aa85-3330edf1b99a", "value": "dd68e663380c71f66b512f005f1be7ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886205, "uuid": "1ebd0bc5-1765-4b5d-aac8-46a4a59ec671", "value": "12288:SZCgwRmWooxcQTjJvJe09+9LwIvtqWMaH79E0mRRpcQ3xpJD0DIkLsQVlC:SLfhHAdvJ/LaUWMabXWReQ3DJCLsWlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886205, "uuid": "08009e94-0bbd-4c5e-ad1a-12adf86c6bfe", "value": 749808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886205, "uuid": "b9f95977-9bec-424e-a6cb-cae662dda882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886205, "uuid": "375330ad-57a9-463a-a0da-f13cf652c252", "value": "rSHIPMENT_DOCMSS24071327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565f90eb-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (GuLoader)", "timestamp": 1724840080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840080, "uuid": "3834e14c-7115-47e9-b483-2a6d09d4db02", "comment": "Malware payload (GuLoader)", "value": "5a14d64b70fc7106cb6c14be1aaa7482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840080, "uuid": "142d6cdd-927a-4ad6-840d-b0f3aa611b25", "comment": "Malware payload (GuLoader)", "value": "bdd5b953bef085550bb5891e8d3c7248b5b16fcbba1bb26e2be18c4801d1a98e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840080, "uuid": "59c68db8-66bc-4a7a-b7d3-a458ae8240f4", "comment": "Malware payload (GuLoader)", "value": "0612c6f0f1aa18f6e96de3d7ae39193981d9bb95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840080, "uuid": "4749f726-b60c-4f70-aa15-b673b5669175", "comment": "Malware payload (GuLoader)", "value": "065103c3207cec999e5b282bfb19fd6be09e2e8b00a6444fe77174b3fb659db65948dbb91929e0ac60e18ae150241345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840080, "uuid": "29355df6-8d8d-4679-9604-923f57bddb03", "value": "T128259EA3E44CA2A1D4E98F73E20B76B705371DB595560013A2D1BF273AF9C23467392B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840080, "uuid": "fddc1d84-dd37-4fd3-b9d0-279514a5b642", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840080, "uuid": "9a236e48-cbfc-47c5-afb2-0308d4696316", "value": "12288:RGUeTvuO1BJdtGrY8dMLMankl6QQGMi7B1mSwIhCjVn:RGPB4Y8d2JKpQWB1mSlCjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840080, "uuid": "6481e44b-2b3b-4c05-b118-684cef07aeec", "value": 1014480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840080, "uuid": "ad8e2be8-ae21-4572-a2b4-5acefbb3abb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840080, "uuid": "501277c2-0466-4b53-9e5a-7e9bf0d81bfe", "value": "TRIAL_ORDER_CP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce47db5-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863633, "uuid": "e9a201e1-0e1c-481e-aacd-a7008c88fb4f", "comment": "Malware payload", "value": "1ceb0e373caee64fc008aeb47f61406e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863633, "uuid": "bf234efd-3b12-4d07-90b9-a0d60dbd992b", "comment": "Malware payload", "value": "befefbb7c31124eced5bdadb15169c51693673d82e1a5856efbebdb49f638e84", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863633, "uuid": "fe1d3f7f-8141-4246-be27-e43265438b97", "comment": "Malware payload", "value": "fc8b3a736fef8e3c97bfaf6eb854226947464365", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863633, "uuid": "877cd5e8-2c51-4753-8f62-047eeef5e0d7", "comment": "Malware payload", "value": "f0c8361bc9aca14066d73e8d6127dad6aee255c48e6e26d2eb7404ad3315f0ce75aa3867355b4735895d3125085d5fd2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863633, "uuid": "d901c15d-7c50-4803-98dd-10134b2400c2", "value": "T1CB77230091A3B515F7ABB2BF2AB95FE48559BC6A02F55DF7637173B806F109204338A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863633, "uuid": "1acce061-6226-4cd9-87b1-18bf4eb8402f", "value": "786432:Gt9ZUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0yWS:Gt9t7xVLYjsp+ikJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863633, "uuid": "44a35ee1-7018-4b67-9c82-3f5ad28f641b", "value": 35910144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863633, "uuid": "615f44a6-e095-42be-b85f-d4d96b3218b7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863633, "uuid": "f18d8086-3634-4d92-8be7-4df711c5af87", "value": "befefbb7c31124eced5bdadb15169c51693673d82e1a5856efbebdb49f638e84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f59644-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Neshta)", "timestamp": 1724840291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840291, "uuid": "2146d2d8-6585-43c8-8c8a-8f7d24ccce8e", "comment": "Malware payload (Neshta)", "value": "c3a4cc1456848670a81274ab5b41036a", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840291, "uuid": "d4e8799d-2613-43ce-9e04-0baf1a7f7034", "comment": "Malware payload (Neshta)", "value": "bf9f1640e0bec04b7b04d623d7390be47007d46f744bca6526b2acd0f67994df", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840291, "uuid": "409dccca-20a0-44c5-9b0f-de80167e5882", "comment": "Malware payload (Neshta)", "value": "87eb35e7d1576fb6459dfc12ce9769ab8d269b33", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840291, "uuid": "ccff61cf-1deb-4500-a8bb-0aab82571e38", "comment": "Malware payload (Neshta)", "value": "153c42e8bc361bb42423f2a68e1f5e05c67a2f295eaf96fbf5d39d33964826cd1fdf900b3d21fe8b185b3bb1746ab7b4", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840291, "uuid": "7a89c4ab-86c5-476f-969c-47fc40c47dec", "value": "T17E05332E6240E79749048A8753CF4254B1E9919F6BB4F84E18F6921A95F7C7FED0E0CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840291, "uuid": "52bb4ca0-377a-4bdd-b52c-7b4e197b987f", "value": "12288:VtlqOZq2ue0Wo5O+b89bn9fGxmG4l+aU2ZA+t/UjBYwZQBTH3F7KaY7uW:VtlqOZq2u/WebeZfkmGk+mt/X15WaeuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840291, "uuid": "81b3ce09-4dbd-4faa-aca9-eed32959bd05", "value": 837661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840291, "uuid": "36ff7a49-2b82-46bd-aec2-61d8eef984b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840291, "uuid": "6ee26c95-0bbf-412d-9849-d4833889f3bc", "value": "TT51109240018351.pdf_1.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1673fedd-651e-11ef-b7c0-42010a9c0002", "comment": "Malware payload (LummaStealer)", "timestamp": 1724836537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836537, "uuid": "dda9fd2c-2736-4cc2-8aa9-5886ead76b9f", "comment": "Malware payload (LummaStealer)", "value": "30cbc399e37eef662eaeb7d90148f013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836537, "uuid": "3a12c86f-335c-4f69-812b-1a3cae3e780c", "comment": "Malware payload (LummaStealer)", "value": "bfde2ff885475fc1212ff255cc5f4e17b0ede10a8ee21b7b83cd34fc0ad73a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836537, "uuid": "cfd03bdb-f258-4f78-acb4-d31fe7cf02a0", "comment": "Malware payload (LummaStealer)", "value": "349839e58f61a81512d2545bd70ca0d0d7baa549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724836537, "uuid": "2d7998f0-a0cf-48b0-80ab-4280f301d109", "comment": "Malware payload (LummaStealer)", "value": "ed6822d78e6c26c0d2551b6cb3210da80f6337d9afa15b5ba18b565604ff7614bb9a5dae864bc29870e5bce541a2a209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836537, "uuid": "6601a66f-2821-4fdf-aa35-a24f4623492a", "value": "T1DD542377B788CBD6EF1D3B795E183216A2A1F6C6405BDF053D4462E48E392E385823C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836537, "uuid": "b1b6905a-7929-4ffa-b6b0-d8e5efd44cb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836537, "uuid": "55b0bec7-0241-4bfa-8a13-7c6b246e93f9", "value": "6144:7vFbmrw0Bo5jT5jI5wG1BGkdshosD++gtFLJh3gPK6OcpcVfCZK5V:58w0WTjfsBGkqd++VSupkfCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724836537, "uuid": "ba9e25e5-0620-448b-9a11-4cd5312998f3", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724836537, "uuid": "83bdd63f-abc9-44be-a0e2-6dba8b485dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724836537, "uuid": "7a7ed5eb-c68f-45f9-92ab-16d99a93bb84", "value": "Rebina.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bdd480-6545-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724853289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853289, "uuid": "54ec0992-154a-43b7-9c95-dd410c6c10fd", "comment": "Malware payload", "value": "351f45571fd7039de0241245aa85731f", "object_relation": "md5", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853289, "uuid": "599271ca-5450-40c8-8ad9-6d4512363a3e", "comment": "Malware payload", "value": "c03cc808b64645455aba526be1ea018242fcd39278acbbf5ec3df544f9cf9595", "object_relation": "sha256", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853289, "uuid": "40a953ee-ef26-46ce-b8c4-3b951d5954da", "comment": "Malware payload", "value": "2ff66d370f7cedc92585c6abb37ef01b36ae6439", "object_relation": "sha1", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853289, "uuid": "5dc0c710-9016-4188-ad64-1b7bfa38fd64", "comment": "Malware payload", "value": "822b8232d779a8d8b6ac7685a673959a9f790204245d885771e893580518a1720003dfca396db5fe58dd13c01b9e5841", "object_relation": "sha3-384", "Tag": [ { "name": "AdvancedPersistentThreat", "colour": "#6DA9A4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853289, "uuid": "947c4081-f21e-4568-ae8e-5c5ca78de2ef", "value": "T16B276B203554D032C35AB275452CDB194A3EB9226BB5A4C73B948BBF0F663F09F39356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853289, "uuid": "a2e73b04-7f82-4134-a0a6-08ca840d2d3f", "value": "555e0f7fb00b44fa8bb00b517dbfabca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853289, "uuid": "893863a5-1c53-4147-a370-d6e381c34adf", "value": "1536:N1vihn7gNNfuVk7Xk8WTB6mpbzWP6Nq5PVti:N1vi97gv2TRpbzW+q5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724853289, "uuid": "57907ba6-0301-4a2c-bad2-94d501e02d4b", "value": 21085696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724853289, "uuid": "4392da21-e3af-4aec-94d4-a2f880e0a5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853289, "uuid": "9f3334e2-6a58-4a49-b61c-664f746b0d83", "value": "goopdate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6a1435-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724827339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827339, "uuid": "b2c69357-c9d4-4640-971e-29fcbc2de6af", "comment": "Malware payload", "value": "d5df8ac086a5a3eeabdf6c15295e23b6", "object_relation": "md5", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827339, "uuid": "1f57fd6e-34ed-499c-95de-5df17ee8b8ac", "comment": "Malware payload", "value": "c0db529d033467aa5a0e5be0491004543b785398bfba60c895397f81aa3b8233", "object_relation": "sha256", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827339, "uuid": "00de66ec-7045-4572-86bc-15b309075e9f", "comment": "Malware payload", "value": "1f0ad64957c5f438b6866df92f4693c176bcc9fe", "object_relation": "sha1", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827339, "uuid": "23555caf-02ec-4b48-b6e4-c654b6d6ffaf", "comment": "Malware payload", "value": "dc34aed79d2beefd34417b2a8db255dcc9edefb6f0a3d7b103128d83f5dee22a2c49f2cf312ddb6d0d0873fe5b6d0361", "object_relation": "sha3-384", "Tag": [ { "name": "60-205-2-78", "colour": "#E571C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827339, "uuid": "27d4d791-efb9-4c93-84b6-1204b9a5b1e1", "value": "T1FC11B31304497032C576682A03E1851E888AFEA7362DE8F826E7073F2624924EE28D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827339, "uuid": "c8236448-e15b-4342-bf9f-8aa8b1108876", "value": "24:capq9KkmcsGtRq2Qeg3lHDw45WaJcTfxf5k5jGELT6:cR9m32QeWNpWaGTx6FPLT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827339, "uuid": "aa0da4c4-1013-4a17-8f16-09f42c9a0ed0", "value": 890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827339, "uuid": "e7715523-fcb2-4377-84bf-4868c716fea5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827339, "uuid": "a00fc293-8070-45cb-a228-4a18749137e5", "value": "c0db529d033467aa5a0e5be0491004543b785398bfba60c895397f81aa3b8233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf4b3a6-6545-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724853323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853323, "uuid": "855e76b5-d04d-4a2c-91a3-e508f1d35162", "comment": "Malware payload", "value": "667ead6e36314bd21b1fa1fb9f1960b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853323, "uuid": "6dd8e692-4ea2-4019-bc6f-fa3bd7918ba9", "comment": "Malware payload", "value": "c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853323, "uuid": "422d646b-fe9e-46f3-9e20-36746294815f", "comment": "Malware payload", "value": "b14ecebb5df15c8ab0f11663d419c2ccb1944760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724853323, "uuid": "58b79cb8-2777-4eae-9a96-4991cf3ea985", "comment": "Malware payload", "value": "8199cbd19efdb1c5660f054a86fefd9d4b8076c147a477fa5e56c0d22bf279fe1e4251887cb7c5442e526e88323a0dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853323, "uuid": "f9f944f6-1f22-4bcb-8593-4a81bdd32d71", "value": "T10A77AE17B294C095D1B6D134C62287B6EB717C1AD72196CB37AC7E163F332E08A3A791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853323, "uuid": "3d3b6cf4-3e5e-4167-935c-aaf93e84b691", "value": "7f6374fa43fb59c8c933315a94a24259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853323, "uuid": "89366a28-04b7-4445-b1b5-d67cbfa145d2", "value": "393216:16Csu5h4Lj92HygC5Ou2hFJ4X5g/nC1utUUplcc+Z0B1+IgWxlq5L0acaoaSOXEJ:10urM5oGiQV0B1+IgWx0tHcuUDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724853323, "uuid": "029ddd07-a8b0-4386-932b-999e824299e2", "value": 35527104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724853323, "uuid": "2ec0c6e5-396d-4905-b31b-c5c797ccd30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724853323, "uuid": "6761f1d2-63a3-48a4-b8a6-5b9b74302ecd", "value": "c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95420cfa-6573-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724873257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873257, "uuid": "35cd7123-f9fb-40e9-ab4c-6551ca29485b", "comment": "Malware payload", "value": "6764d0de25d8035ce3052d44327f7604", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873257, "uuid": "7de58e35-aceb-42af-8e1f-00da2d15050a", "comment": "Malware payload", "value": "c13eed1052dcf048cebf99694f89556a5a1bf468011cd4a1d1846689078ea236", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873257, "uuid": "4f9c1a59-fa02-4db3-a533-f9e3e829f3ca", "comment": "Malware payload", "value": "42be6194cea22595cd79fe38628625956d541d70", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873257, "uuid": "1d1a2164-985a-480a-ac8a-6a35636db7e2", "comment": "Malware payload", "value": "8f479261b5048466132ec49bd3c0b94d0a21b3107c926c7c15cf7ab752cca01b464326eada1015874ef00ee3cbd958ef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873257, "uuid": "0e56e2f6-6388-41fe-81f4-f4e6ea110012", "value": "T16D03320BB9B9DE04F15AC2710EC282C721A97F144BA682C6B28F7F20787D271774478B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873257, "uuid": "7baba0ac-1a18-49f9-8c53-8b62aa3c92dc", "value": "384:sVLYCNOmYU3Vkm3oiyxFFU2tgbjldiSvhmLXG4ffE9r:suNFU2tgbj9h14n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724873257, "uuid": "5f29c224-8677-415b-82f2-1ca17099f9b7", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724873257, "uuid": "7b29c70d-91bf-46ca-b2fe-609e7756c7ce", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873257, "uuid": "1736cb05-fcb0-4ed8-8ce6-d35fbaa6f018", "value": "6764d0de25d8035ce3052d44327f7604.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903c3a7c-652a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724841895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841895, "uuid": "301c410b-a176-476d-ae64-6acdddd2098c", "comment": "Malware payload", "value": "ccb134bac1da598adcab9070ad6ef5db", "object_relation": "md5", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841895, "uuid": "740e237d-b285-44b9-ae7a-eb29157798fb", "comment": "Malware payload", "value": "c1af977c484a2a05166f9b8d81fcdb709a40a13c66fee6d27cad638a8eba8662", "object_relation": "sha256", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841895, "uuid": "f1926aa3-c958-41ff-b2d7-576718d8fc4b", "comment": "Malware payload", "value": "b65e920ad8e375113bea86ae8393197040415391", "object_relation": "sha1", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841895, "uuid": "b917a88d-99f8-4123-b48f-726cd9fc043a", "comment": "Malware payload", "value": "94c4f0cf64cf8a34672f007a9c9e339d3c2e6f1c365f03e23fb73ec6482745b818edd32e4788576e31149ebf492ed9e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841895, "uuid": "22a55510-4110-4a53-b17a-f4d0a816fc3c", "value": "T109A6D0697791CE3BD2322C7ACCA773844599362C1E3C640AB9D8FBCD0D2A141EB75297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841895, "uuid": "b5ffd180-0ed8-4060-8d21-79a84981b7ec", "value": "177294f4ffae1cd4daaab3cc1c8f3220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841895, "uuid": "9d0268a9-0257-449c-80b8-754cdd8b16af", "value": "98304:fFmTtZ8FBvnmBtdvpcS1h26gEXvqzgNPuD:f28zPmBtdvK+NhXvqzgly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841895, "uuid": "a0d3a17d-911a-4b65-9f67-43f5bf7c8c6f", "value": 10149137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841895, "uuid": "5965e95b-6911-4edf-a608-8bc332a4e361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841895, "uuid": "11de79ed-8a5f-44d4-b926-29ba72f687c0", "value": "c1af977c484a2a05166f9b8d81fcdb709a40a13c66fee6d27cad638a8eba8662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87573c1-6564-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724866900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866900, "uuid": "131c0f1a-6e74-4f6e-9c51-f80553d9cfee", "comment": "Malware payload", "value": "0d49dbd551b7f262def7ddd3d4c8b1e0", "object_relation": "md5", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866900, "uuid": "e044494d-db7c-44c6-b2fb-5e32b2332bd1", "comment": "Malware payload", "value": "c1fde081342a6b1260e87b5032b81bb6dfcf326833fe74b24082dbbeaaf12ea9", "object_relation": "sha256", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866900, "uuid": "b0233edd-56c4-4339-bc24-e9979f7d102d", "comment": "Malware payload", "value": "0482a6a444a7419bf054d0226d87faa42298d4c2", "object_relation": "sha1", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866900, "uuid": "cc57355e-acdf-4035-ae9b-b1988f2a8647", "comment": "Malware payload", "value": "0a3ce059e5b0eda562eb17f2ce54cbc570f39815b34ec1b5010cc073bfa7d04dfc768979ee92a3d3cb2a56dbba9519a9", "object_relation": "sha3-384", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866900, "uuid": "d579343c-9a60-4b7b-a214-4fc1624be937", "value": "T141E533837E89D457C984C325413AC9B719EEB759ABC6C808C939A3D3F819C8857D933B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866900, "uuid": "9661129e-e013-4295-845a-c8a22d7c228c", "value": "49152:iMuFlyl5J4p9ccEwb9NmkWFt1sW6GHvWRVIZ+rW/7N7MV4o6c6pGwQMQ8yaVPGkJ:ZuFoJmbxgkWHNNHm4YN6g0vyaUciS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724866900, "uuid": "e0d4df5a-11b9-4e1c-8f1b-3630993dbb2c", "value": 3245241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724866900, "uuid": "19e68b87-1821-4a03-b8c2-e8333aeb09ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866900, "uuid": "4b34841b-5f37-4986-9c4b-dd50aac408e5", "value": "#!!Se-tUp_~2025~_Pa$sW0rd$s~oPEN!!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7ed372-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (CobaltStrike)", "timestamp": 1724827180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827180, "uuid": "b13fedeb-9126-4c48-af58-7e864575d1dc", "comment": "Malware payload (CobaltStrike)", "value": "aae7e4cfb51a2bf803cbb9a3523f6fd1", "object_relation": "md5", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827180, "uuid": "b68a62ff-2f46-4004-a0b7-fd1ac95b7b14", "comment": "Malware payload (CobaltStrike)", "value": "c368a78cac51628bd6f5b623d2786ab8751135a7f56892e1be04fbca0d5d76bf", "object_relation": "sha256", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827180, "uuid": "2bec87c1-e6e6-404f-b3ac-179cb6f99379", "comment": "Malware payload (CobaltStrike)", "value": "ec5a8d5e906488d6d24bb098ffbf48538e9519fa", "object_relation": "sha1", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827180, "uuid": "96c98a90-c93c-4beb-b269-f62afcbb9192", "comment": "Malware payload (CobaltStrike)", "value": "4e1bc6e9e8070381f0ad5bb6c85a480c4a0517b47bb20314d5244e48fc9edece7f1c933dd0909ce253345b51e4825990", "object_relation": "sha3-384", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827180, "uuid": "530652d8-985c-44ee-9b35-c79e08eca835", "value": "T1FE954B4B7C9598EDD8A982328966A162BA31BC081F3217D77B80B33C3F727D45A74774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827180, "uuid": "8e95276d-5704-4094-b976-738d355942b0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827180, "uuid": "c31994f2-0ad0-41db-ad9f-fdd030e2362d", "value": "24576:VgL05V1SFxdsMnYA9oCeUwVjJ9kYVdTgN8ws6nYLdfM2:VgGV1CxyKgj1wspf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827180, "uuid": "0f35c92b-7e41-49b5-b591-22e2f547b19a", "value": 1965568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827180, "uuid": "0708e833-610c-4a54-b536-908ccfd66545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827180, "uuid": "95540574-399c-403e-81f4-0b35a35936a7", "value": "c368a78cac51628bd6f5b623d2786ab8751135a7f56892e1be04fbca0d5d76bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8ddaf6-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724840250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840250, "uuid": "789b301a-5ce4-4a82-b928-03a23ed5a891", "comment": "Malware payload", "value": "554ebc7a43f4b74dcd6f0028e767e7a3", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840250, "uuid": "fe2ec8fc-4b09-48d9-893f-210605234f91", "comment": "Malware payload", "value": "c38b02abe2c790833433d9e60e72dd0ae6753b78df93b475c2b8484665ad55fb", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840250, "uuid": "93696e85-2b70-40bf-8d4a-03659ef3201a", "comment": "Malware payload", "value": "aace8f65cc5fbffdb1e55efdf70c27630a256f9e", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840250, "uuid": "ccdbe4c6-f9df-4a1a-85f9-99a01c587192", "comment": "Malware payload", "value": "797208eda28d38c13b7d758614c63030cf6662b8400d2d35734a48f42fe853f576b6358ebde471ba3ab30ed5c9482cca", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840250, "uuid": "56924ecf-5491-465f-9c76-6ab311c13c4c", "value": "T10E253374B6BFAD12CC2F707B429DA52E1421E8F698AD9F018C401EB858F5DB0548CADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840250, "uuid": "96f06264-b66b-42d0-ad39-77ba05355735", "value": "24576:kJKGJN/53ML8c7S79XRveIgDJ/VZ25DKEpMt+iv90/:kJKG35cCXU9J/n25DJpMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840250, "uuid": "6a1b3f14-daf3-4d52-a41a-52ff048a737a", "value": 962906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840250, "uuid": "02ca5466-c1b3-442d-aa1d-118e7e6cac61", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840250, "uuid": "e1469958-e9f9-4cfe-821d-71631622b23b", "value": "PAGO $630.900_1.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996deb36-64df-11ef-b7c0-42010a9c0002", "comment": "Malware payload (MarsStealer)", "timestamp": 1724809698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809698, "uuid": "c1c1ec2c-5c3d-463e-80df-4ee020c742ad", "comment": "Malware payload (MarsStealer)", "value": "31f08ffb553577bea81855226fb0d0b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809698, "uuid": "af56e4ca-a1e6-4abe-a906-b33be267ccbc", "comment": "Malware payload (MarsStealer)", "value": "c39eee3fee330717d83074da5df2f9f1a5ec00c4a0fc7191462b024693b47e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809698, "uuid": "99376925-104e-4ebe-90c3-5301d23b667a", "comment": "Malware payload (MarsStealer)", "value": "e9d8ea91e9e690786f85be9347f05c32fdf3524b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724809698, "uuid": "f01ceb91-a86b-456d-bb5e-a2895043e9d9", "comment": "Malware payload (MarsStealer)", "value": "74d3e8ad7d56f247fc7b29daeb6de10476e7ba593ba2afd3c40a86aae4e7929b981c1061426b4eb4c8af1b604038122b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809698, "uuid": "653b92a5-e992-4b5c-b778-0eb721c9f101", "value": "T1288533140B7330B7FC4F8EB1B8E0711A6A65279FB2D597813AD6A76D0F53384DE84221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809698, "uuid": "e5302cbd-5022-4f9c-95d3-7b4cc657a110", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809698, "uuid": "0d028737-5b68-46cf-ab17-7a0035519865", "value": "24576:iWM1PugpFJOypeCJD0U27EaD3qrqUG3OvY3R25RG6U2gh5vebhVrq39wmilz1kx:iXFAyICJDiT6WN+KsDU2kebr8iV1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724809698, "uuid": "f2f5c59f-b7c8-4c16-8fbc-d0c511552ba6", "value": 1784832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724809698, "uuid": "3ad676de-7ab5-4ca6-ad1e-725d362a8798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724809698, "uuid": "3c96d6f8-0afb-4e5b-8e08-75f39ffb462e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2e4df7-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (CobaltStrike)", "timestamp": 1724827175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827175, "uuid": "4ada03cc-8533-4744-8de0-c0e55d3ce9ba", "comment": "Malware payload (CobaltStrike)", "value": "3f167a4cb8b366843fc3547f7f564fa4", "object_relation": "md5", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827175, "uuid": "a31db27a-72d9-4393-bf1f-ab69aff797f7", "comment": "Malware payload (CobaltStrike)", "value": "c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825", "object_relation": "sha256", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827175, "uuid": "8946c38f-7140-4bc1-8cf3-87ef4fa3f05e", "comment": "Malware payload (CobaltStrike)", "value": "20a3b47c2415856fd9ff8d8a61b376c85f6c6b52", "object_relation": "sha1", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827175, "uuid": "34096676-c1e8-4fce-8020-56054bb28037", "comment": "Malware payload (CobaltStrike)", "value": "f866a2d2aa9cacf5f8be6f84a0d7c4d3a8ee19163e840fb108ef02f0575e93d3bb392470b44e33db9deaf0a4dde8c825", "object_relation": "sha3-384", "Tag": [ { "name": "47-99-72-48", "colour": "#6D4C98", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827175, "uuid": "e838fcc2-3e8f-441c-8c61-7b0e91a94d1a", "value": "T117549C5ABBB705E5E98104BF03F5F2219D9AB6C2E76DF130A63854FDA010D446FACA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827175, "uuid": "4b519dee-a480-47d7-90b4-0907e90af9e3", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827175, "uuid": "a108d996-632d-4304-9ca1-ad41eebf8315", "value": "6144:mzJ8qdZGPkZBzxWT//G1dyUG+EjHpDHWS3pIjk:mzfKwBO/qdyUAHB1Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827175, "uuid": "1c2eda8c-5900-46ca-9761-1089f97a2413", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827175, "uuid": "46984aed-18dd-44b2-8727-acc1374f5956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827175, "uuid": "6cd6f808-25de-44d3-ae84-fffdcda7a95c", "value": "c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff06439-652d-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724843129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843129, "uuid": "b96cecbb-0b8e-4d65-b27c-d9855eaf2fb5", "comment": "Malware payload (Formbook)", "value": "9cd1d6d0275ffc81f7d89cfc2ef22a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843129, "uuid": "3c880cb7-7657-41fb-807d-ac33b786ae77", "comment": "Malware payload (Formbook)", "value": "c3d4bf7b34654afd79490a7c3ba3b19f9ccb920e3fa7649c23a73c8269fe6744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843129, "uuid": "03cfcb5b-7f10-475a-82e5-98ba5812b1e1", "comment": "Malware payload (Formbook)", "value": "7a93bc13f2b0686948a73db38c615ecde3ad7752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843129, "uuid": "abe5174c-3dfa-4b3f-95ab-dacf262e5da7", "comment": "Malware payload (Formbook)", "value": "9cbe79def7d130947792522af026fbe572e2dfd0542e7c62b95121d84066707963f25fecad7ef104b9201f7206045395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843129, "uuid": "f4f20d38-f9f1-4192-aa9b-8a181c6b3e8c", "value": "T1980501542A25DA07C9A547F90DB0F2B1177D5EEEA901E31A8FD9ADEFBD32B004C50193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843129, "uuid": "6f171a38-96bb-4cc1-933f-a1458efcdb16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843129, "uuid": "de1cbd28-aa50-40b7-b14b-ed0c7a92e7ec", "value": "12288:IdG98FAb0bRAH1mquX0ies+fCshjICwW/BWD3PIzwv4IbbR/4OmsxrJ:IdA8Q6Ro8++aWzPIzC4Ib9wOms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724843129, "uuid": "b6646be5-896f-4746-822d-4e2b31196abc", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724843129, "uuid": "32a9a816-015b-4b78-bf43-d67a36ff5908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843129, "uuid": "93737156-b42c-4c6b-8f26-ce57362c92e8", "value": "PO 00017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eeb8bec-652d-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724843047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843047, "uuid": "4f972d67-f2d4-44cc-88eb-60c6eff80911", "comment": "Malware payload (SnakeKeylogger)", "value": "ba3c5862f30c243b6bac9c0c0d9fde6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843047, "uuid": "6df2a8cf-ec04-4981-bfbe-81741b94aeaa", "comment": "Malware payload (SnakeKeylogger)", "value": "c525446f2722dc0469ac6566e515dd15e21e41db50cf1c054bfa46997d8f2acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843047, "uuid": "30fdc493-d592-498c-8116-d798cbf46dc6", "comment": "Malware payload (SnakeKeylogger)", "value": "4188d68679d8c29b48f79059aea6461f3215062b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843047, "uuid": "c10141b0-48dd-4d21-babb-6ed3cc326575", "comment": "Malware payload (SnakeKeylogger)", "value": "6819b94a171e48b51112ceac0af50a961a164f0f271326522a9777935d3bcc1a12e8853df902833579f785af5cf255a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843047, "uuid": "e95d6f14-e9d1-49b1-bebc-02c1d23d49b6", "value": "T193F401987516D607C5A153FA0CB1F6B407B91FEEA801D70A8FE8AEEB7932F154D40293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843047, "uuid": "c57fdcba-7120-473a-879a-7b35de5e887a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843047, "uuid": "2e81c27d-96e8-4ba1-947c-091676746fb0", "value": "12288:tcjYrs98FAb09CzdfzioI2x9ExpWqw72Yj05G0fNhOoKuSTHaP2ikm7zO3FzAeaf:t3G8Q/ZzFExJw72+WG0vOhHa63FzApfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724843047, "uuid": "de36b037-7a88-4d37-bcb5-899a17ab3274", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724843047, "uuid": "4e3f8c70-c3bc-4e0d-9bb1-b719d651ca50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843047, "uuid": "d41a0cde-867f-4b3c-a706-5a3a8ec09c3d", "value": "Scanned copy payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e16dad0-657f-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724878399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878399, "uuid": "a71c994f-9ea3-4bb0-bd00-c4ad8e8db97f", "comment": "Malware payload", "value": "8e41d2107579afb2911dccffeab97f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878399, "uuid": "0a5e9449-55c0-4c31-bf7d-640ce1df9871", "comment": "Malware payload", "value": "c5c219a6512dc639b5ac5837abe4217e265f7d165159da131eb32048b0c15030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878399, "uuid": "26ccbc08-3b08-464c-af86-a758388b6ac7", "comment": "Malware payload", "value": "e364f0f9b85adcb64747c8eac819a1b59b458727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724878399, "uuid": "3ef4d1c3-46f2-4b5a-9abf-2d52b35a4a7b", "comment": "Malware payload", "value": "eb06447b4390f13b639c192e1f6e06cf3c675571f1666cc1556bd2c9b3f71cbd814a9e26098b0e9be2cd184708a36f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878399, "uuid": "be137835-911b-4cc3-b7ca-c0c832c6671b", "value": "T1972412420B940772D2DE1A36E652C18E17B0E7A7764F4C8B308ADE99DF0F79522462BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878399, "uuid": "91f82ec1-87d9-47b1-a0dc-d67edd6ca311", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878399, "uuid": "e9751830-7d2a-4b22-800e-ad3df31da910", "value": "3072:+6wNIhnghQ+uCos63ZV1LrV1/FwVJ5mfzPNx4u5lEuvdh4XMBfApkaFGAq6KYzEO:fwNItDCb2ZV1PmVJ5mfzF1Gnp8WEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724878399, "uuid": "a1a26847-d126-408c-9d18-652c4230f21b", "value": 212008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724878399, "uuid": "5b38d473-ed26-4dba-a741-3de79027469d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724878399, "uuid": "88ffe359-112f-42b2-8215-41e4363e02e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce658cf-64d7-11ef-b7c0-42010a9c0002", "comment": "Malware payload (NanoCore)", "timestamp": 1724806214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724806214, "uuid": "a5c19b5d-affb-4d9d-a614-5d6e4bc7de07", "comment": "Malware payload (NanoCore)", "value": "1033c6b6d28d44c062806cf7d594e6f2", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724806214, "uuid": "776312a1-321a-4b33-8ac0-03e530600f27", "comment": "Malware payload (NanoCore)", "value": "c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724806214, "uuid": "6fae2125-f424-41e4-8b60-2fcae0ee1de8", "comment": "Malware payload (NanoCore)", "value": "74c6a8a092c267399e87e91abb7be13df725b046", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724806214, "uuid": "f149656e-14eb-46ae-b497-2b65116b9887", "comment": "Malware payload (NanoCore)", "value": "6ac3f3a437dbef8aa8c26252defe9a6ae290685095f7711b14705d612a9c1f7b9295e1c39dbf14358e018dfa0b3809fd", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724806214, "uuid": "14225ac9-1835-4f79-a096-428711832d5d", "value": "T1E6B501A21E74ED8877946538BEBD3160E3E0DE7B6C3B96205253EB1E2B26D414720F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724806214, "uuid": "9f1fb404-7a0e-4582-8089-51602a4059f9", "value": "24576:bD/qEBZa71HU8t5t1brARP+rHHSjIPwSVs5fEEkhTb+jUTjs0oi6vXkkQW+pUFX8:vqyMTtMDjIYSi5MTCY3s0o2kQWCXKBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724806214, "uuid": "f8fa40a4-c629-40e8-8c7a-836e787d46c6", "value": 2373280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724806214, "uuid": "9c84df66-ea9f-4bbc-82f5-525e81f3e92f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724806214, "uuid": "ad0e5ca0-0ba8-4373-92ad-81d1cb4a0860", "value": "CamScanner 08-28-2024 07.05.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16131bb2-655c-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863165, "uuid": "8b9718c3-02bc-4b31-bc08-a7087f1e3651", "comment": "Malware payload", "value": "b7c427b7a03f39652a2e09760b56e04a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863165, "uuid": "025f8d57-a4c2-46c5-ab39-9fc09517400f", "comment": "Malware payload", "value": "c806086192b9e3d2c9333805b2c5b374d664176ad47a2615792864a6550400e2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863165, "uuid": "27ad16a7-5efe-46a0-8a3e-7174e7f4b87a", "comment": "Malware payload", "value": "3fdb4661b9821e126bce1642e1bc8d95f5a947d0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863165, "uuid": "c6d34e90-e059-4f0a-8321-15e63aea51ca", "comment": "Malware payload", "value": "1d9e7363c9e1586c3585e95bb038e8de587a8d1d22334654ca2b97a04f4225149b604e99beb6af6495f2c1fad9c3c6d5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863165, "uuid": "6e26c528-6226-4b06-9a5a-0023ba3bff4a", "value": "T17D7723019162B615F663B3BEA9B96F8082D4BC7D0A654FE7A37573B607F70810872837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863165, "uuid": "e2d4b327-0927-4e8d-9f33-18f6efef8180", "value": "786432:Ct9pUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0yvl0J7:Ct9d7xVLYjsp+ikJvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863165, "uuid": "2b9906bb-1d14-4e6a-8a52-7a12d632036d", "value": 35890176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863165, "uuid": "32db1e96-f77a-42bd-826c-eaed1fc55f26", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863165, "uuid": "cdda9fa8-aae7-434f-95d5-8076f88b7b16", "value": "x64_x32_installer__v4.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fdfdba-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854763, "uuid": "2165ba5b-5966-4598-8c65-9f6b52aa1f18", "comment": "Malware payload", "value": "5aab48a95b5ab5dac841821e04f0b11d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854763, "uuid": "cb4ee52f-dbdb-45c5-883c-c8608c22e42c", "comment": "Malware payload", "value": "c82aaa17f5c2f63a2d0aba7de706cde0794c163cd6ee665500ae7de053add6c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854763, "uuid": "fd5b7fd8-9ca3-4d17-8ac4-82656dcaca43", "comment": "Malware payload", "value": "b00b63a8470d4f8c0391b81dc534b2b188f28c3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854763, "uuid": "67026b98-1527-45ac-a5c1-ac1b1f416926", "comment": "Malware payload", "value": "e15f24e72a8d94dc551896ca9a8faad525cf43a95cb13bb1fce9e9b9a00866c01c7ebf762ff90cca5e31933e85598a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854763, "uuid": "6720d3e9-8f4d-492d-91fe-d1101cf9ca9a", "value": "T1F8077B03A955C0A5C0BAE134C63242F2BA617C46DB3193D73B9CBE693F72BD0A979354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854763, "uuid": "231d85be-8ab7-4f12-8b01-ef158574b6a1", "value": "7a4e11003c086fcab691bd5ed6081713", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854763, "uuid": "f4a3d525-2565-474a-a201-d3c468234450", "value": "196608:zaQVBMxFYalg5/nOh1utUxCp4m5Wf+TGNZi20zaEV1+oR:dBEYalg/nC1utUUplcc+Z0B1+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854763, "uuid": "0f8bc4d6-61e8-4c8c-bd00-455641d0e042", "value": 17391296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854763, "uuid": "5ead655d-a4f9-41e1-af44-5b0b8c31e331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854763, "uuid": "87624079-d2b3-4696-aba0-f1089b1b84f5", "value": "c82aaa17f5c2f63a2d0aba7de706cde0794c163cd6ee665500ae7de053add6c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1b4186-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724840360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840360, "uuid": "0abe44ec-6350-4bde-a6f2-ab195694aed6", "comment": "Malware payload (RedLineStealer)", "value": "7fdc6d283bcbd3b6957117bcf029121b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840360, "uuid": "d7c5396b-fa3a-495a-a390-06e15305fc26", "comment": "Malware payload (RedLineStealer)", "value": "c973e384fd5a93315635c41262e5616e7a602ffa79d18bb600ad10fba480fbbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840360, "uuid": "5e6cad9f-e19e-49b5-a515-6a30a4ed4fd0", "comment": "Malware payload (RedLineStealer)", "value": "98a235ee6312fa0554dcf0d3ef900f3c6407de63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840360, "uuid": "0136dc44-0f9e-4ed6-901f-121ba97d2ccf", "comment": "Malware payload (RedLineStealer)", "value": "1dfad6ac156bc0624dafa956cb20102a582e297edf9e81a2e84560f0cf7283cb643809279ac0b64610d16692b1b6cf41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840360, "uuid": "c98bc39a-fdd7-4f5b-bbf7-92a8f297c320", "value": "T19CA4AE0B7B80FB94D3B917B1E0D399284378E956B637E74F3E4862552E423389E453CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840360, "uuid": "e96c5204-25f9-43ee-806e-e9280640b362", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840360, "uuid": "f6f9fa27-07b3-42f2-94a6-0c7a9ce4df5d", "value": "6144:okjPhTiT3Iockv78XqKK6Woijzy8vk/yj7pqYDm7RRbZGky847ecW:X0Iov8ejzB2o7EYebkky17ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840360, "uuid": "91a903cb-10bd-4c72-a1e7-2274934f345e", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840360, "uuid": "ad3ec8ea-cecb-4725-8767-b4670994d45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840360, "uuid": "12946229-32c5-442a-a38f-700de8779e10", "value": "SecuriteInfo.com.Win32.SpywareX-gen.1519.9988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071cdf23-64fc-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724821908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821908, "uuid": "9e3e229e-9fd1-4099-96ad-b14a94d7a522", "comment": "Malware payload", "value": "666f1e7ce43dca40014d716ed5f8f86f", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821908, "uuid": "8758bdcf-c535-4aa3-9969-ab6ff56cd18f", "comment": "Malware payload", "value": "ca1271cdf8397b064bda6ba3cf89ae0f50564ee32bfd2e4d984fd1873a36a76b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821908, "uuid": "cf3c5db9-c412-46d1-842f-a6d98963066c", "comment": "Malware payload", "value": "067f7c26c169440ae03d4cd2c22bc0285659760c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821908, "uuid": "b701f414-4f0b-41a9-9998-c2f4c129e714", "comment": "Malware payload", "value": "539cc6a2412ed3ff6b0a084bd1f3e7e5f891bf3284ad8f44b1368574e8e783f07d3060cd7342aab8b4f5861c759acd7c", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821908, "uuid": "8777c3b9-883d-4214-b284-a61e74c5d70b", "value": "T19A661275D2684C38F1218C3FAF3E650A5E31F4E24D496E54773B628B7D62BB01E798A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821908, "uuid": "fc6682ac-940e-486c-9212-44b2ebb32056", "value": "98304:veVVeoF83xlJM6wrmz2EIjuZLS0Z2Pwhly:2VEoS3xPM6w7CP/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724821908, "uuid": "099e29bf-87cc-40b1-974b-9eb6bc72868a", "value": 7048365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724821908, "uuid": "c16780ab-d507-405e-af65-3c8ece05b919", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821908, "uuid": "a60dd512-e461-4f90-8a7f-994874c19217", "value": "cen03-2018-rrb-notification.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8e707d-6562-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724865884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865884, "uuid": "1907f753-637d-4a99-9644-9ca4b4fd7f8a", "comment": "Malware payload", "value": "23c1ff8c35d2c6c38f909b6f3a30518b", "object_relation": "md5", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865884, "uuid": "cdf15e0a-301e-458b-a9d7-759240f534f7", "comment": "Malware payload", "value": "cb7855f609e32510cd367e22cbee2d4bfafa70bad7ea8f8ed1f9cbd727697115", "object_relation": "sha256", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865884, "uuid": "9dde51e7-bd34-4560-ae3b-7419473d0eab", "comment": "Malware payload", "value": "2f688f86c254675921ba4208fcf99ae7d7a1a876", "object_relation": "sha1", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724865884, "uuid": "76531804-8e4b-480e-8d70-315f6bbf83bc", "comment": "Malware payload", "value": "f0697f4a2d2e5a91e11ff1c23d6ab767ba0b8b6fa2dba002a5fcf7a8650ff0cfc91c7f7008e82dc7c212507ffd4050fb", "object_relation": "sha3-384", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724865884, "uuid": "a9328703-2bc7-453e-9331-8ec4162736ee", "value": "T199D533E04D0D86EE1663DE24EE8CFAA642416B39DC39D23AB104735DB94FCDEE4548C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724865884, "uuid": "7b42926e-b4ee-4f03-8e17-77099c8ec567", "value": "49152:t+hL0OJS+FGQA1QcOAlr0WEvUyRNOlJdaao6096yH3yo2LCqTZpuJpV2Lw2Gz3v:tM0SXxA1QDUr09syZCGiEKKJ2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724865884, "uuid": "a0334650-92e8-498b-9c83-c3b0a832626a", "value": 2870213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724865884, "uuid": "da201da4-8f0c-469e-9db4-1e5d5c8a2bf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724865884, "uuid": "e9476e98-674c-48a5-aee0-9a4b18c2a261", "value": "~!!__ACCESS--2025__!\u1e56@SSW0\u1d73d!!__$oPEn$~.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b2a877-6570-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724871883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871883, "uuid": "9ec7fec8-8455-44e1-b4cb-360b2919e78e", "comment": "Malware payload", "value": "9e0754511bf8f2602a8d02fc96258cc9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871883, "uuid": "8692c4a5-78ea-4746-b5c3-d0daf3a39f3e", "comment": "Malware payload", "value": "cbe5544ccb132ff6ed954a8de99ee72cb7ed561deccc3692f2a43fbe3f70844c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871883, "uuid": "2697eb9a-4918-4441-b75a-c05b67b50333", "comment": "Malware payload", "value": "21b4921bf02aeb4fbb2d7dc71354cfc8d0edeb35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871883, "uuid": "920bd942-6738-4770-82e6-0f2b987f8637", "comment": "Malware payload", "value": "b922433cd45666d92952a47a70fd5e509f44a1e481d267f08b62d5c4c5c511a31cc9631414a380a138d3b51c451e7c91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871883, "uuid": "e0040e50-940e-4098-bb94-12258872e23e", "value": "T177F52136CA31FCD4871D3640A7281C9E21A8695793F74E28D7161CB63E32B62EF65D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871883, "uuid": "e7486473-0fd1-46f4-baf4-bde9f392a1c8", "value": "49152:xxICRL6XLRMEzaztox/8kvFJbeiO98i2VNcoKdaEA29jZkLyWkQ1E2OQUpCXupOY:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724871883, "uuid": "1b1bdb28-0390-4218-9e8c-1af7cc79c3ec", "value": 3331515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724871883, "uuid": "56060db5-307f-4211-87a6-57f4a2850c6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871883, "uuid": "e6ad23ed-d4d4-4776-a9df-057b58a98526", "value": "cd_v2_x86.xsl#", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9f291c-64f8-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AgentTesla)", "timestamp": 1724820357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820357, "uuid": "96dec8c0-890d-4346-9c50-fd088d73bbf1", "comment": "Malware payload (AgentTesla)", "value": "eb4d07f7aa59e7b313fba17f44004262", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820357, "uuid": "62a838c8-e50c-4fb4-a953-a7e175e5daa0", "comment": "Malware payload (AgentTesla)", "value": "ccba2d4f646c750075acb6931fb502965124df5def59ab4c1979cce417c34ac5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820357, "uuid": "c7c1f109-4448-4411-bfed-ce07388e0616", "comment": "Malware payload (AgentTesla)", "value": "70c2427dd9f0ad884b1157cbed0d550df9903452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724820357, "uuid": "16f712a7-de0e-44b8-825a-47375d1c5f2e", "comment": "Malware payload (AgentTesla)", "value": "2863ec010b31fa3c4a1bd629517f9b580e267a266b64bf891b38979f4c386afdf5fcb827706ca82ca4567b3877daf0c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820357, "uuid": "a4de18a7-df4c-4f2c-a35b-dff8d94bb350", "value": "T1FD35BF027391C062FF9B92334F5AF6515BBC69260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820357, "uuid": "a4b5415d-c34a-4b0c-91f6-7f6d4a90688c", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820357, "uuid": "816a8c48-e4f6-4d5b-a7fd-6b59071c7084", "value": "24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8a6GUjU+6SmA:STvC/MTQYxsWR7a6GUjUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724820357, "uuid": "83560409-a4a8-414e-9372-cee9391b00c5", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724820357, "uuid": "a3b07bd4-bc91-4642-99b5-fa332d6e7a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724820357, "uuid": "467e7fb8-395b-482e-b7f1-87d0032b116e", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3d8074-650e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724829916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829916, "uuid": "68bab2ea-3d9b-41a3-8c6e-910c73b16f56", "comment": "Malware payload", "value": "741d5a62b3fb1d8af982adce1bd34c04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockton", "colour": "#DCDF7C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829916, "uuid": "1b47d804-f85b-499e-84a3-dbc8258672c4", "comment": "Malware payload", "value": "cf37b3caea9b8f6bf3297f2d9c562703ad0eb4f6a27df9b105bd7c9aa9ca95ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockton", "colour": "#DCDF7C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829916, "uuid": "6774d409-78bf-49c9-9d0b-46e7cea51746", "comment": "Malware payload", "value": "ae046000803108dcadc0ab4759c81deb07cd5a4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockton", "colour": "#DCDF7C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829916, "uuid": "63db0e4c-734f-4457-896f-2e7f40889829", "comment": "Malware payload", "value": "1a8ab2656209bcd4987a448e9944e8b6ed654ae128b103d5e8a760e6ca5fe5449b34af488e939e917dc9b4b181d7d39b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "lockton", "colour": "#DCDF7C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724829916, "uuid": "277b893c-cec9-414b-860f-c2883f63b5a4", "value": "T12034A93376D1E9E4C4CDBBB81497D76DD7A0A8E0A6041BDA33879B2D4C85E8D7B2D240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724829916, "uuid": "c09ce1a3-b44c-4ee8-b01d-d74f05d47a47", "value": "6144:NQppspk5tDjATjLivbLjWyADIjZ+scHBfF:SWWCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724829916, "uuid": "0d3bc9d8-f852-4bca-8874-7d51b01bba66", "value": 246608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724829916, "uuid": "4003a369-a445-4b60-88a0-8fbea4ee89f0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724829916, "uuid": "9e422717-9abc-40ca-bb24-5f42dc774ac6", "value": "lockton.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e62e09-6587-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724881933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881933, "uuid": "ad83f8ad-587b-438b-a0eb-68893eb3b64f", "comment": "Malware payload", "value": "6e28eac6bad78b5757c5b57edbc379b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881933, "uuid": "d6a573ac-ce14-4f15-9ad3-377d99b97357", "comment": "Malware payload", "value": "cfc3c3bf97153af782badf823cb0fa061ad8b772129861a60e5a30d48e021d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881933, "uuid": "eedd7e7e-0b3a-42c3-af00-94860f0871f5", "comment": "Malware payload", "value": "fdd4abaf5ef12b7c883c0ff9a59e3f45b677a9be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724881933, "uuid": "5e45a7de-10de-4353-b593-b55620867376", "comment": "Malware payload", "value": "693bd9cc1fabecdc52e9e5ccf6a261d99238372acb972480b7e1dce186769c30f0fe13af4a560df8bf221af93f75e99d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881933, "uuid": "8a37c36e-6a17-4611-a51d-728e706a9ab8", "value": "T166D53300F6D244F2E4B30D325D7DB792993E79646F14CA2EB7994A289E325C11339BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881933, "uuid": "a5ac5436-6c86-44f5-a128-62fe5c49d1ad", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881933, "uuid": "7809088e-650c-44dc-81de-4d2bd4acd155", "value": "49152:gxfBfJXAEWtsTocM7XpqECJE+UOOQo5jqG0BTDKyaWHX3kbdC2VGyBbauoMMCZeH:8BfKE+sECJE+xOP52FbHHX2VHOLoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724881933, "uuid": "7086497f-5179-466e-9cfb-09a38aa03c65", "value": 2967244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724881933, "uuid": "0dc2f5f9-ea1e-400d-a550-41ce6c41d24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724881933, "uuid": "f1b9535d-fe3c-4625-9b99-0131fde008c8", "value": "3649-wrar5.61(test-2023-10-24-05).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3855fe56-6598-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724888992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724888992, "uuid": "8bae56d2-5f97-456f-9302-75a570da3039", "comment": "Malware payload", "value": "a95aa166567f9946940a6015d9c5ebd9", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724888992, "uuid": "7e0c70f2-5ffe-4d30-a2c6-411318decea7", "comment": "Malware payload", "value": "d14055069aac97f0bb7b5627f0458fcee04fe62ac492cbdc511993adab1e3f45", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724888992, "uuid": "0896550b-f207-4d83-a7ce-3b0d98bf7b4d", "comment": "Malware payload", "value": "fffe7668c7d9efcc66e77a78a27882ca33fe41a2", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724888992, "uuid": "6e51c700-000d-4ed8-bf47-2d14418b1c3f", "comment": "Malware payload", "value": "db0e5fec9ca8d8f355b180e4e849bc082149efb81a26a6a6d9323028ce0732168734482f3584875a53786394be1a9338", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724888992, "uuid": "5ad9c61d-ec97-42aa-866c-8c3b7493b34a", "value": "T132D423E44156CC90CF92B2BBF1129971B860E47F50CF6D42D917DDA6B886803E72EC7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724888992, "uuid": "b6b58092-bf5c-4e61-a93a-3be777ddba83", "value": "12288:y7zFnsBvBXyFOT727JbpbcFsmIH7Pg9N6+//aYc2wI7cEnDrooctWJNSj0jZzbiU:EFsxBXyYTaMm+6kbQEnXoockftbijIAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724888992, "uuid": "c24bfe7d-9ce8-4506-b45e-5ea5055af4f9", "value": 646708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724888992, "uuid": "b47f84be-d035-4a8f-aa49-a03feb80a3d2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724888992, "uuid": "db2f83e8-1a7e-4dfc-9f99-6a0191c6ba2a", "value": "1403-0569 pdf.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c31f216-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854746, "uuid": "c000103b-b741-4246-a7a0-8065976a8e5c", "comment": "Malware payload", "value": "87ff7122558314f2176021aa9d3878e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854746, "uuid": "57fd0e16-ea55-448c-95b1-554d9446db32", "comment": "Malware payload", "value": "d15ae61864b5a9970781602fd119feed37864160d1cf2b85dfd1db8d90316270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854746, "uuid": "510f239b-94aa-4c49-bda1-82f4ffd508f7", "comment": "Malware payload", "value": "669d759fa4e86d060b49ab156ac32817507a53ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854746, "uuid": "d546df26-87a9-4013-8362-89edb428272e", "comment": "Malware payload", "value": "7378c9fdf201f8c1306026c2dc54fbf30854d1a05ee9faf17b0321b6a2982547d08a0826897017cd6b37559eed1767ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854746, "uuid": "e044df93-c707-4399-b2c9-f4c9dc7c8103", "value": "T1C6077B07A955C0A5C0BAE134C63242F2BA617C46DB3193D73B9CBE693F72BD0A939354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854746, "uuid": "d112a124-562d-4cae-8616-5b963d84d257", "value": "7a4e11003c086fcab691bd5ed6081713", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854746, "uuid": "b76cd910-85dd-4112-8589-a26543e2479b", "value": "196608:eaQVBMxFYaEg5/nOh1utUxCp4m5Wf+TGNZi20zaEV1+oR:ABEYaEg/nC1utUUplcc+Z0B1+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854746, "uuid": "6a4f97b0-2412-4e49-b276-6a0394408121", "value": 17391296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854746, "uuid": "98ae914c-7ad6-425c-921f-fda3a9cf05d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854746, "uuid": "67ad5ed9-4896-4793-856f-685d01da450b", "value": "d15ae61864b5a9970781602fd119feed37864160d1cf2b85dfd1db8d90316270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab99788-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822585, "uuid": "018d8f26-ced7-4b4d-bcb5-8060bf47ed2b", "comment": "Malware payload (Mirai)", "value": "da6d16026e2c2105107c96b5cf6b4eab", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822585, "uuid": "073a7354-fad8-4ed3-bc5f-7202a56f752e", "comment": "Malware payload (Mirai)", "value": "d2bf5395799ee13d2d21281501e4ac8352b3f37d8c66f674cc8750a252dd97c0", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822585, "uuid": "f4bab97b-96fd-4173-9afc-ced505b3b8a8", "comment": "Malware payload (Mirai)", "value": "589549a86418ccd375d20074c4126802b1c21f62", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822585, "uuid": "40723040-ab10-46ee-b29f-f251f5b07beb", "comment": "Malware payload (Mirai)", "value": "070f344971566973f055fe342caf23b55b52cdc085d5b74f003f70b231f64d69b9f5838cd80f25eb93095483978a8694", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822585, "uuid": "a7a5d870-6cca-4402-adc2-c3ca3bb352f5", "value": "T1E7E49EB2B3464A66FEA95B700FD38334F6E4782102F3455AD36617344BB11B96C2EEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822585, "uuid": "fc23170f-2f71-4766-823d-9f4d38866a31", "value": "12288:sk1b865jxBLkvRf5RV8GLabu11sw1Y+Byz29EjmBog5dVCu3:sk26pxaT8Gubk1ZchmTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822585, "uuid": "a08ec528-f307-4921-ac8a-882b7953ce6f", "value": 721592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822585, "uuid": "2492dda9-1764-4b3e-8ff3-d3aafdf2be70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822585, "uuid": "a05ddcd9-c340-4c4c-9734-27f39226d502", "value": "criptonize.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3360f6-655e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724864361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864361, "uuid": "da8b8aa1-da6d-4b97-916f-09226aea5edb", "comment": "Malware payload", "value": "5c0f5d0e4e61f2ac03fc8115ad4d3a8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864361, "uuid": "2eaf47cf-03d9-41e3-9128-a599d16a0711", "comment": "Malware payload", "value": "d2e92610c10d49668db81f99c7fe97fb5d3a3c0b6eddf40b72041cc58526ebcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864361, "uuid": "5229a59d-d0fa-4209-8598-f879b6df2c2a", "comment": "Malware payload", "value": "7639abebb13638bc031cc1231d47c5c4fe037e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864361, "uuid": "16722b65-cf18-48f0-894d-bd8120779fdc", "comment": "Malware payload", "value": "ac43ed9df17019b15bd213e56e31c39475fc39757967863d787fe025da4ac8b3c332fccc620efd0495f52cae95de2a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864361, "uuid": "b339dda0-7e3a-4554-a7b6-823c944ed553", "value": "T1AD1412E16B0457A5DB4A8E3575A516733B384526A2C36DF72207C2E3BF8D730728B329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864361, "uuid": "e1d5d46d-ae82-42c5-ba64-4f562544f051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864361, "uuid": "5ebfa105-fd27-44d3-bca2-d60bc1d41b01", "value": "3072:EtLpA1JSJrRspz8kJYVJavNKiXKPiFvhpnoSqEUuXwr757RMn6nO1kQlNUulh2jP:Et2JSJVvkJQaGI3HqEV057RM6nmUI2jP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724864361, "uuid": "d645b7ec-27ce-45b0-9c4b-ac30e932ec9c", "value": 196136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724864361, "uuid": "21f9559b-191e-4e0f-9512-fd223f1a52d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864361, "uuid": "cc7f5793-d4e6-4d1d-97ae-10262b0c0691", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963ee4d5-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (QuasarRAT)", "timestamp": 1724827302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827302, "uuid": "1330a183-2b00-4f51-b95a-af7ad9aec79e", "comment": "Malware payload (QuasarRAT)", "value": "417aef4e7e9b9ea10b6de9fbaaed02ca", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827302, "uuid": "22fe2b1b-476e-4fc8-af9d-d12cc1cf4ad0", "comment": "Malware payload (QuasarRAT)", "value": "d4b403a71a8609e194a0ceb988b21511e82da194bd809fbe50d174ee5e6dc6f4", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827302, "uuid": "fb4d6c22-1ecc-45be-9ab8-000e68dc80e7", "comment": "Malware payload (QuasarRAT)", "value": "80a911922790afd28bd132b0de8ae880034bc31d", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827302, "uuid": "50145ee7-69bb-47ad-80a5-b261595a9741", "comment": "Malware payload (QuasarRAT)", "value": "4cadee35d529d9ede3258631b6c6a1d67c39147c6d509ce813e73458e24ffd35194c90c386cfafcae7a8eadec485283c", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827302, "uuid": "5e379e38-ba84-42df-bd13-09c78e5f1993", "value": "T10916330526D5AFA2C8DF07B98652058447330D48AD81E3EF3C8E7CE17EE6BC86585E97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827302, "uuid": "a015bb69-9b03-4ba8-ab96-0a73b06660b9", "value": "98304:cDMgfL0MjhdmEYApF4h1LfuaIy5Sp+l75v:uhdwApFAmaIywp+l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827302, "uuid": "0f6842c0-4305-4fd7-83e8-7e5f9aa1263a", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827302, "uuid": "4e520c08-c840-4101-9781-bcb68fbd1812", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827302, "uuid": "8fb7fe28-72eb-475f-925d-6cd96bcfe9ad", "value": "ZKB - Zahlungsbest\ufffdtigung an 20240828.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dd4d20-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863810, "uuid": "20ae5dbe-c913-4658-bd1a-391db130213f", "comment": "Malware payload", "value": "ddd7dac6cf66dbcaee98e3d958e4626c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863810, "uuid": "a8b60969-6b21-4839-9674-1e6b56708e32", "comment": "Malware payload", "value": "d59b4a63813b861c807e301b622398b55d18d420eafd4bdc8a082888b8a6a9e1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863810, "uuid": "f4cf95f6-bc62-4a60-8406-ecdc9241bcf5", "comment": "Malware payload", "value": "718df86ebbd83cac42b60e6c4324d7a5186b8dfc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863810, "uuid": "388380ae-bd00-497a-b525-cb57eb2c0670", "comment": "Malware payload", "value": "a4fcba21662f00f7a814e84058addfecd18e9320d0e883e577d4b837f5111cdf554317194c5a1e505f474bd16f16ae29", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863810, "uuid": "d3a2bd19-8f5c-45b5-8f33-c163a1b2627d", "value": "T1C577230091B3B505F7ABB2BF2AB95FE48559BC6A02E55DF7637173B906F109204338A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863810, "uuid": "5f4846aa-63ec-4fff-bbe4-72e4bc40c58d", "value": "786432:1t99UyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0yMePUnhe:1t9B7xVLYjsp+ikJjiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863810, "uuid": "e3c02cf2-fca7-4245-bceb-c44ed948da22", "value": 35907584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863810, "uuid": "2eb30c82-7a89-4698-8412-0ff623c64eb8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863810, "uuid": "43fe46f0-7c31-4e7b-a9ea-d7d25798e9be", "value": "d59b4a63813b861c807e301b622398b55d18d420eafd4bdc8a082888b8a6a9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1b6622-652c-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Metasploit)", "timestamp": 1724842584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842584, "uuid": "d70fda42-efe8-41f6-ade2-d9537925144b", "comment": "Malware payload (Metasploit)", "value": "3bd849d25180d79b18039b642635546e", "object_relation": "md5", "Tag": [ { "name": "193-117-208-101", "colour": "#54C71A", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842584, "uuid": "f7a7854e-af3c-4705-8dff-c1b6243d6012", "comment": "Malware payload (Metasploit)", "value": "d603e1d388840c3cb201c63dfe58327ba18a12256d6752a11090f910ecbd4dc4", "object_relation": "sha256", "Tag": [ { "name": "193-117-208-101", "colour": "#54C71A", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842584, "uuid": "0b2ba8c1-da30-4980-8794-4f46c33b9477", "comment": "Malware payload (Metasploit)", "value": "c19f74814e9654073ab348e1c1dfd23a08158c3b", "object_relation": "sha1", "Tag": [ { "name": "193-117-208-101", "colour": "#54C71A", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842584, "uuid": "3af5b81a-d749-466a-a4d7-e7502432a677", "comment": "Malware payload (Metasploit)", "value": "1cda4ec85b9d2b95283d652b6933639d220585775f9284d02369ed4823130e78350d3e2c230c4957fc712e9fb9bd1b67", "object_relation": "sha3-384", "Tag": [ { "name": "193-117-208-101", "colour": "#54C71A", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724842584, "uuid": "53fcf683-1f58-4a08-801f-293e20b9bd2f", "value": "T17FE17EB3BA1BFCF73E194EBAC8163A686D8F544B461CE197A70E40D446728D70D051AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724842584, "uuid": "650ae653-65b7-4b6a-be31-41bfba75588a", "value": "96:LQMOFg45euU1vQWfnv8y87NCdUaMLoutd1CbnK/GF9iGfkxQyT+5:LbWg4+1vQWX8yJ+1ouBCDhfkxlT+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724842584, "uuid": "c92226dd-223c-4aa9-852e-864543b079bc", "value": 7374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724842584, "uuid": "33c0a1fa-088e-4acd-aa71-763b9712af28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724842584, "uuid": "6af560a4-8234-47a2-8f9a-ccbe856a12ac", "value": "d603e1d388840c3cb201c63dfe58327ba18a12256d6752a11090f910ecbd4dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f3d001-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1724840274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840274, "uuid": "87025731-fb52-4071-8309-82b99a041440", "comment": "Malware payload (VIPKeylogger)", "value": "1defa37b971560c3fe7390432ac53436", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840274, "uuid": "2bc07cd1-2a7c-4b74-b413-472014af124e", "comment": "Malware payload (VIPKeylogger)", "value": "d721f6806fdfcc6a837a5a273bb7f8f2fd55ccfc362bc020ee06a1aff6918786", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840274, "uuid": "02e2418f-8380-4221-9706-0d17df34eed1", "comment": "Malware payload (VIPKeylogger)", "value": "b89841562c8c3a09893fa6db6baf5caf819fa6d8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840274, "uuid": "a3a7668b-0086-4d68-a2e3-1ea65a8d79e4", "comment": "Malware payload (VIPKeylogger)", "value": "b50c3298ce382fb21b724019b8210d97e4ddeac677ca694140779e99d5f28aa70d9d96cfd9ff19617ef7abcb4c35bc27", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840274, "uuid": "959d918b-5567-480b-8815-868d0b09c8de", "value": "T168E423BDEAB05001BFC7679615D7F2BA104BBAA10326F5D0B077FB47BFB99088601994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840274, "uuid": "bd5a3ba7-4b75-4ddd-930a-76e339447a98", "value": "12288:kVTuQKxrHFV0kfAfrjkweTxdHqNF+zfHDuwG1g36mII8yBVojG/nm:GTuzlbAj7eldHqifjuQ6mtqS/nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840274, "uuid": "96398a6b-7df7-4014-9bda-514cf3d76c1d", "value": 660847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840274, "uuid": "90fd1b49-465a-4917-9fd9-3dd1f08e66c4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840274, "uuid": "22fe7d5a-c471-4873-9441-ed35098e2e02", "value": "Request for Quotation_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8820613-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Neshta)", "timestamp": 1724840271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840271, "uuid": "39f2bc33-d9ed-4ce1-84ca-697fa27c3c9c", "comment": "Malware payload (Neshta)", "value": "f48426ca3522149006582f9625d7d889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840271, "uuid": "704498cf-7f24-4a99-8173-c7aa9c3404df", "comment": "Malware payload (Neshta)", "value": "d7398e1ff0347dab0a3183f8b00f2bbe6888aa784437e727ce0dc6b0f9df1854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840271, "uuid": "cc7b5419-2021-4589-8232-8559fb743d97", "comment": "Malware payload (Neshta)", "value": "bc343da234dbf7b267fb43cc05b5d03b38272948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840271, "uuid": "817e55c4-8f1d-4ae2-a8cc-2f07d1dcdb07", "comment": "Malware payload (Neshta)", "value": "0a35bf3d5112d97ef5adbd63ed3fe93ccb9025e7341e9a7f6bb4cc068499d635b17c594bfb9223bcbbe8e9dd024f8f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840271, "uuid": "6aec5b7f-0d5f-4e18-b34b-95a5e85ea500", "value": "T1C955C00273D1C022FF9BA2734B96F6514ABC79260123E62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840271, "uuid": "d2dc7ff1-52ab-40d6-a3a9-d941eb817f7d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840271, "uuid": "aa6fb874-13d9-4d79-a232-f7878d4b91bc", "value": "24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aI+ryc516YG69KFgz:NTvC/MTQYxsWR7aI++mnkFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840271, "uuid": "28fc20cd-daa8-4824-b432-c70004697234", "value": 1400320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840271, "uuid": "e9b45ee8-ec56-46ae-883b-230ed9f233ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840271, "uuid": "fd5f31a9-3f79-4871-9ec4-ec3581bac764", "value": "Quotation Reg#270824BOQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9624440d-653f-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724850924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850924, "uuid": "cda9e3d0-5314-425b-b755-6ae95db6e455", "comment": "Malware payload (Formbook)", "value": "36b4067c01a3e0f4e7b320e9c7f14ad6", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850924, "uuid": "23d6932a-34bf-4596-a806-a9c7df9db25d", "comment": "Malware payload (Formbook)", "value": "d759f265b876f02ffcc24ac8f81c127acbfad02061d99c8b45ca957f4b69f03a", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850924, "uuid": "6589863e-cb4a-494a-b3b8-f31385bf3452", "comment": "Malware payload (Formbook)", "value": "e5a5728821c2cb9ddd09b295f1f491a38439d3d5", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850924, "uuid": "b83290e2-b4d6-4854-8464-92a1540e12db", "comment": "Malware payload (Formbook)", "value": "03a90988cef4bbd1769d3086b4c433531a87566617b117758cee21e02e1c09622f2b507a87b3dab547d61f9b267eec45", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850924, "uuid": "59a89b98-2e39-408d-a74f-c059e609d5b0", "value": "T1FC94230F7089B9E79C9A41C41D609059EB27BD54585E0FBC7B33A3268880FB94A1FF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850924, "uuid": "2dc01314-df2b-4a72-880f-00783e042211", "value": "12288:BgOZzciwqq1cr2ZgfRdYm57mqz38smRxX48xXoueG:KqcSq1crEWRdO83vmLoEXoup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850924, "uuid": "78eccda8-5749-4814-ab27-a0ef6ad5057d", "value": 435403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850924, "uuid": "8d1d4293-3c4c-47f8-b9ad-0ceb079e352b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850924, "uuid": "e6418047-a38f-4b31-9f07-a27d7572547b", "value": "REQUEST FOR QUOTATION.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6d32a3-6547-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854206, "uuid": "623bd7af-8ae0-47a1-bb32-56ab24fc88f6", "comment": "Malware payload", "value": "278923c95230db8da026d16df6fd8a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854206, "uuid": "2a311bd6-6018-404c-a6ea-f4136e3aeb33", "comment": "Malware payload", "value": "d7b3977f24cf27cb4f4656aa47d6230479859764537ceebca07094d147eb93a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854206, "uuid": "f8f4c5da-b4ce-4bf7-aea3-6c9def7804b1", "comment": "Malware payload", "value": "fcd38c20ca8525144d26e3189a63e82935e9dd95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854206, "uuid": "f7af82df-6669-4191-af3b-2ed90dacba38", "comment": "Malware payload", "value": "bf2c73382cc157ba12d1b3a8ab4310b50897e3dbbf211917ac41923639e823de251aa3e679f2034b6b5c812490fbd4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854206, "uuid": "e44985fa-a2ff-42d2-bf20-534d176340be", "value": "T139F63311FFE25C36C17843382C7F9B891A353E505C18E9DB33D0AAED5A7BB821C165A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854206, "uuid": "9129a5cc-747e-40f1-a8fe-bb8902b246d9", "value": "0f5836ac2080c685f0a1746cfeb91a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854206, "uuid": "9882e897-5c5d-4fae-96cf-51af45ee278f", "value": "49152:8yPOqa4+Ay98nabhHCmbOHOccXKFFX2WYF/F+EDrDP0B8JEE+V3B19Mmf9EdG7y+:Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854206, "uuid": "e1bc3785-3215-48f2-b31f-68fbbda7cdd2", "value": 15835136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854206, "uuid": "96600d9b-e93a-4c17-b855-47a2b31d8637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854206, "uuid": "a51a3412-8c05-4910-a7c8-a9c100ebc517", "value": "208653207450-COTIZACION-5350000236508574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be49b894-6591-11ef-b7c0-42010a9c0002", "comment": "Malware payload (QuasarRAT)", "timestamp": 1724886210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886210, "uuid": "8dbbda97-0e4c-468c-ad97-3a8a584063bf", "comment": "Malware payload (QuasarRAT)", "value": "80a20c307904ed98007d5c6716839ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886210, "uuid": "02ffc831-b8a4-4bb7-9fb6-52cc704d2d42", "comment": "Malware payload (QuasarRAT)", "value": "d80b06effbd34b981b32276034abe3c118ac51a53ace4a253bb52c90cb18f13d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886210, "uuid": "3a14c9b3-3c6b-462c-bf2d-260543aafa54", "comment": "Malware payload (QuasarRAT)", "value": "2e3f689209e7696052fe6548dd1c53245d1b307b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886210, "uuid": "b6132c3c-d549-4b3c-911e-d2c634c20965", "comment": "Malware payload (QuasarRAT)", "value": "6ac7ca2d9d9a62d16eb008eda48452ec36880691955c616b1bb9695170ad5ff27b028d3f14383dc7059d50795503e479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886210, "uuid": "750edb11-1c48-413d-a7a3-95ff7d60e1d9", "value": "T1BA0623E139286B19CC5F0636A2A9DD7256A30D6ABC44BBE60DDC7F4730AD200AD5CF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886210, "uuid": "2e7e9ca1-846d-4afc-b084-de5c08ab6df1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886210, "uuid": "ec844e7f-1206-43f6-b26d-47a4d4bf1f01", "value": "98304:riJ0iNYbre9gJGGahLc2L12IXgb+wOcYFzrZfuJIZOeX:rm0iireNLc2R/WHO5PuIUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886210, "uuid": "c1a11d3f-6865-4cba-8df9-450007319bad", "value": 3806720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886210, "uuid": "1c7d8ab9-6850-4a1f-9446-9018b99ee1c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886210, "uuid": "164d59e1-df81-4385-ad94-d70f8d48f078", "value": "rVAKIFBANK-\u00d6demeonaymakbuzu20240826.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2dafee-64fb-11ef-b7c0-42010a9c0002", "comment": "Malware payload (CobaltStrike)", "timestamp": 1724821517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821517, "uuid": "34f664ed-179d-4b74-b42c-60606cd42f05", "comment": "Malware payload (CobaltStrike)", "value": "882e00dd2c44f57162c0ac90858e8fc7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821517, "uuid": "f6cf551e-71ee-4622-b84d-d3c791f61b44", "comment": "Malware payload (CobaltStrike)", "value": "d999e7ee9fb086bf4109f9c1821d959fd8b038902fa6f8dff2c3beafc36bee7b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821517, "uuid": "4e40cd46-1e5b-4ddf-a840-28c539e357ca", "comment": "Malware payload (CobaltStrike)", "value": "8e7c38c20fb19e890c896a4c98108b291237afb8", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724821517, "uuid": "4f71ad4d-1b7c-4c6b-8ea9-d35981df3cdc", "comment": "Malware payload (CobaltStrike)", "value": "0c85126d9e509d840dcd883a45575b788fbd4a4d565e2ce2b19069789b519d42c90ccb400d5cbc7bc7e41b97c0ae5e4e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821517, "uuid": "d635b62f-dd53-4dcc-863c-0c885eb4d57d", "value": "T18B749D9AE5CE3BBFF151D730C40FA725AF9029983369872C49C587592BA761333C981B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821517, "uuid": "99d3c60d-cdd1-43c0-8f37-6ba664a5fdff", "value": "b189f83bdce907074c1f8f63d1974fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821517, "uuid": "3337d701-a851-4bd6-a3b8-e94a88ce63e5", "value": "6144:DsyrpKZu/6bWNKshx2JZmrxkn3gmAJoYjY2HZA4I:DdVKZu/6phJZminOGOY259I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724821517, "uuid": "73068d35-880c-4c92-98ca-96c645294f19", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724821517, "uuid": "a06eb3e1-2a57-493d-984a-eb4550d067e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724821517, "uuid": "1217aa78-a35d-4c4c-9bf6-72799bb1c357", "value": "882E00DD2C44F57162C0AC90858E8FC7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106d1186-6506-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724826219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826219, "uuid": "853d6d01-758a-4daa-8a3d-af16682be258", "comment": "Malware payload", "value": "5de96ce5f00c62fbe3922406f1a2ee3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826219, "uuid": "0016c35c-1b63-43e7-a1f5-6c12aa44b539", "comment": "Malware payload", "value": "da00a1afc34d69c23615649a1e74eb55cca840c5dcd8fa71ff8f109fe0bb637e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826219, "uuid": "0be66806-1c3a-42ea-a3f9-88606545f5b5", "comment": "Malware payload", "value": "0afee59a2556c964088ce88bb233f2034b14d801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724826219, "uuid": "5faba658-cd89-476e-96dd-f1df50da626c", "comment": "Malware payload", "value": "125dc67f652f0efeef9721bcc54d7770cbf8bd45aa647af115e6e185ddf7cb95575ff4f7e203737801351b94222c82f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MpClientdll", "colour": "#7BC7B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826219, "uuid": "d37b9f12-a7d2-483b-ae53-58915e606ffb", "value": "T177073321BB70C3BBE0B708F121F1A2F26D7D36908628555E478C471EDAD4AC26599B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826219, "uuid": "0938c892-42d3-445c-b502-6c28a216a44e", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826219, "uuid": "35df4cc5-a4a2-4ac0-8b12-6c4ba9eaba59", "value": "393216:RrjjLHZMX2lqPt0iZtSCIAsJ4AlUhXP+aDzs5G0/IvxuF:RjL5M9TZkCgLoP+aDz5+Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724826219, "uuid": "07f9b0ff-e6de-4a8f-bc7a-883650b165cb", "value": 17117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724826219, "uuid": "8c977bc7-7e05-4541-896b-a447dada345a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724826219, "uuid": "74961cc7-42f1-48e3-82fe-8bbb9acd64bd", "value": "da00a1afc34d69c23615649a1e74eb55cca840c5dcd8fa71ff8f109fe0bb637e(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042cc3b1-6529-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724841230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841230, "uuid": "daa98dd6-e420-4ed9-9268-73fb72b1cc02", "comment": "Malware payload", "value": "3f6ee5dedc1975aa6ff1be16e0a4e0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841230, "uuid": "8a30c641-6a09-4e97-b71c-b5ccd670d8a7", "comment": "Malware payload", "value": "db6840a4d481393a8532bd8d9c0cc0d77440beaca41a2c68789b71581a71fe5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841230, "uuid": "297de9bc-717a-4b71-9efb-a932b8f1a287", "comment": "Malware payload", "value": "860b5a825962b81b4c30e165603d158f6cc23f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841230, "uuid": "9a25cf7a-a9ea-49a5-ad16-ce836d88ed9e", "comment": "Malware payload", "value": "b84938d9eb454a47ae8c8efe529937c11d70fe4c94cd40f8a0fff336a843a8896678fb7997648221660a2d59a8b6b073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Scarcroft Ltd", "colour": "#93D664", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841230, "uuid": "e8a5bf71-0cc0-4bc1-b13f-ce5933ecbf51", "value": "T1D7C63A11FBC749F6D903483280AB727F27316D0A4B79CB8BEB547B2AF8376914936215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841230, "uuid": "575b7f18-d44a-4182-8c50-90a07f6e5bfd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841230, "uuid": "40317d61-a689-459d-a314-e34bfd0cfa45", "value": "98304:EciK0mHIG3ntkSAfnSPXFWeUqzgvrtRgu7CoFpheKfMxT6w:HHb3tkQPXF+q+H7bheKfMxTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841230, "uuid": "08baa716-40c5-42f3-bc5f-6993eabce914", "value": 12466704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841230, "uuid": "f67bf97f-0ea8-42c1-8df1-cbc674464de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841230, "uuid": "8f9393b9-2a44-4ba9-b4a3-41aaebaac111", "value": "db6840a4d481393a8532bd8d9c0cc0d77440beaca41a2c68789b71581a71fe5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a959b0e2-6564-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724866848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866848, "uuid": "565d4a18-f182-49a5-9812-0908100a0a9a", "comment": "Malware payload", "value": "0978cc25db273ab5af3a6449ced810a7", "object_relation": "md5", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866848, "uuid": "36347b2a-6493-4fc4-bc84-61f48701ab56", "comment": "Malware payload", "value": "dbcd267ba8ff4e070856db3e42d64aa7eeb55dc9a57913aa3f0cbc237ba5a84b", "object_relation": "sha256", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866848, "uuid": "bef6a6a0-ab92-4fda-863c-0942f4ddfc73", "comment": "Malware payload", "value": "a2d44a2819e198d63ed9bf1680df71d6f872ced6", "object_relation": "sha1", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866848, "uuid": "596c1c6c-44f1-4db0-9586-4c9e361bdfd8", "comment": "Malware payload", "value": "e2132a89f7aff03f132c986ba811cbf29ae3b9bfad13ad09b8ec6e1a6514dfcf87431f003e12b19a9d874cf1a330c6c4", "object_relation": "sha3-384", "Tag": [ { "name": "sideloading", "colour": "#5E9168", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866848, "uuid": "21c68298-aabe-4606-b7cd-c12342ed534f", "value": "T1CCF5331675817F98D49E85E8882FA0AB52CC213BDC529C20FDD54B9240927FAEE3C57F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866848, "uuid": "9730a561-5420-4c60-8654-5094edc109e3", "value": "49152:anHgTPCrnt/EgVxyYg4KgcLPXGDJrgGp0FsNSRWCZPHXk4pC2vuwritFhFNamIWR:aoPgtRPcLP2F7Nsr0u8zPFNgWEnhY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724866848, "uuid": "74a737ea-76d9-4f6a-8837-45013bca11f1", "value": 3470249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724866848, "uuid": "ab938b74-dee4-4950-a218-4a19c76f46c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866848, "uuid": "2362dd1e-646e-434f-bc30-21974b1e175b", "value": "#~!~!setUp~_8485_~PAA$Sw0rd$$~!oPen~!#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2599f2-650b-11ef-b7c0-42010a9c0002", "comment": "Malware payload (MarsStealer)", "timestamp": 1724828574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828574, "uuid": "fcd1ec56-63f1-4a93-8663-b98667173842", "comment": "Malware payload (MarsStealer)", "value": "6ee7f7e1573dbf5e399ed17d4fc8992b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828574, "uuid": "fb50c0ba-3bc5-4842-af7d-1c596f32729b", "comment": "Malware payload (MarsStealer)", "value": "dc32d38d36ddbd7be65e033f70c6e47f2af8b014298f1278c6ba13055ef0d4d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828574, "uuid": "a94068a6-308c-460e-bf74-bd424cece6f3", "comment": "Malware payload (MarsStealer)", "value": "cabb8afbfc33699eeffacb8adbcffe11506a15ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724828574, "uuid": "7af68cde-3535-451e-bf84-10d5713c2ac6", "comment": "Malware payload (MarsStealer)", "value": "25c3fcc21e1e538a82204c9bb469b7e950c3974bad770e31ff4cdfd697c2dcd7174f276d6a4b11d2a81a1715803ccb0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828574, "uuid": "77804145-e33d-4cb1-abbb-4e438a1cfc66", "value": "T11185334AAFBA2C30E52C9E39CB9EFFB13D94BA47C20455C38D589B94CA393431D495D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828574, "uuid": "f6f9919b-247a-40da-affe-658c6abd0044", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828574, "uuid": "9508f563-6a54-4e0f-b282-d7077bc86b9a", "value": "24576:r1OXjzHz4wIbwekCavqBmxWQEaoQyzTwhDILMU0dxlucR0iyGWDzd:IzeczCaqd8/6gDyZ0dpRPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724828574, "uuid": "e0a084d2-c3cc-401d-8017-d975bb1df94c", "value": 1783296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724828574, "uuid": "2cad8f94-4a38-44b5-872e-0bc84524e204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724828574, "uuid": "b8f43390-0cdc-41dd-9869-db3a653de60d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7447fcf9-6533-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724845714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845714, "uuid": "dd82ff19-3480-42f4-ae9f-ec1ee92337b6", "comment": "Malware payload", "value": "b5a6e633330ede88b76777532223017b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845714, "uuid": "3dc09efc-0943-42fc-9922-798409ab3e26", "comment": "Malware payload", "value": "dd1074b75f93e632e7b78b5504fe07d4bcfcbc71759c779394c0efe5b572ce51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845714, "uuid": "6925f464-55be-4a1a-b64a-8fb82cb70f95", "comment": "Malware payload", "value": "7f02397384b237520a6f91678be73d9c75f106e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724845714, "uuid": "a7685e24-dfb6-4297-a712-b8d0ac751817", "comment": "Malware payload", "value": "1936dd1171fb2aa9db285486efd8f046838054cd02bc75da21ca84d34ea8dbb4bb326c5313846f7eca4aa624c7276429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724845714, "uuid": "d0c4b9d1-2fc4-41a6-af78-060ad4c30a77", "value": "T18A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724845714, "uuid": "f46897fb-61f6-4907-b645-50dc8c0cf26a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724845714, "uuid": "3692b8e9-29b7-4244-be19-2430659560c6", "value": "12288:bqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTY:bqDEvCTbMWu7rQYlBQcBiT6rprG8asY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724845714, "uuid": "639fe7ad-f59d-4c9e-921b-81c8aa5a64d9", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724845714, "uuid": "e0e9f6c5-44a8-422b-ad2a-08f3f6ca0843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724845714, "uuid": "3782598b-2f87-4818-8a24-f541f553d28f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8781a0-64f1-11ef-b7c0-42010a9c0002", "comment": "Malware payload (QuasarRAT)", "timestamp": 1724817248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817248, "uuid": "a1399905-1bfb-4450-8bb1-52ab8e182775", "comment": "Malware payload (QuasarRAT)", "value": "65d2891f5f960227e763d758181a4997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817248, "uuid": "48969e66-dc48-4639-a89b-4c42d5ad106d", "comment": "Malware payload (QuasarRAT)", "value": "dfae13334f5330c89e5623376e96c14aacda81ce29c0b036b082ddc6ccbac950", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817248, "uuid": "ce66a442-ba63-4c51-a7a5-92ce2853dcd2", "comment": "Malware payload (QuasarRAT)", "value": "04f78fe58954f7f8eb34d33864a7f4b5b4902153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724817248, "uuid": "1f97f42b-39bf-40f3-b71f-ccb5f3103456", "comment": "Malware payload (QuasarRAT)", "value": "248fcf571e7975310d5b17b3d1bb1f045720c4d5dda67a407895c0db6d28ddacccfef63ae66f2aa62e9109197896e4eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817248, "uuid": "eaf13bae-8a08-44f8-9f3b-b03d17d75434", "value": "T1EEE53303E3FC5016DA413E73659EE6A974994191AFD89B38B6C01F6D1E3FAE00508BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817248, "uuid": "ef191c2a-5508-413c-9413-31a1d5f4fa88", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817248, "uuid": "a92c934c-b4f1-4896-bb69-721ef0846d64", "value": "98304:IZKZpEcvhgT6JlfSlQ5bigvh/KotBlXnE3JvzuTEDkCOw:BpvHqIm4/KotbXE3h6YDFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724817248, "uuid": "bfe0fa3a-2621-46e6-8372-6f4ac9666c6b", "value": 3265537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724817248, "uuid": "b3488522-62cd-4c25-97fa-6ec3c3fb4652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724817248, "uuid": "4640e4ab-90bf-48c2-b61e-83008aa8099b", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8778a564-652a-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724841880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841880, "uuid": "f5dfa86e-7585-4cc8-bad2-f2a58e3c4257", "comment": "Malware payload", "value": "c48168d3274ceffc9699a5d641dce901", "object_relation": "md5", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841880, "uuid": "89228dfb-be41-4ef0-94a5-eae43a182691", "comment": "Malware payload", "value": "e120256386d8539da0219e924c31e4b4abe88296b0d7a37fe7c76c55f2aa076b", "object_relation": "sha256", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841880, "uuid": "52fcbbb2-d144-4488-b27d-63b226093aab", "comment": "Malware payload", "value": "923f560257af26ece51321e652a85710173bd819", "object_relation": "sha1", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724841880, "uuid": "c4f75166-e73f-420c-9cfd-adbbb7712ae7", "comment": "Malware payload", "value": "c9043b255493224ad270ecf7c0901b61346c89994bf252b6339e9deaabe1f19fcfdd9a1e3d60c00c2da9ba006eaf36cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dalian Zongmeng Network Technology Co. Ltd.", "colour": "#0DFF1B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841880, "uuid": "69923573-0db0-47b2-942f-459f42cf0975", "value": "T13426E055AB81CD37D2322D3ACD677390455A7A2C1E38600ABAD8FBCD1E3A141EF7425B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841880, "uuid": "83238902-0290-4c96-8d8c-0aa5f7ede551", "value": "351a453a43dad89819dc90e92fde9577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841880, "uuid": "357b0409-1266-4020-ad0c-4186d8d3b91d", "value": "49152:WDKLhpZZRxvQs6mwTJsg4Rb2opcS1b2DMDi6gdu5zuw+DZ5TmvqzRRUNPljy7Lsw:WDshp5lQVmBtdvpcS1h26gEXvqzgNPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724841880, "uuid": "0f2202ab-6bf5-400e-a3a5-2ca72c332709", "value": 4664521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724841880, "uuid": "eb69ca23-744b-494e-9f6b-06cfc48302db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724841880, "uuid": "109287e4-c39c-403a-a081-f6f0c8925ea2", "value": "e120256386d8539da0219e924c31e4b4abe88296b0d7a37fe7c76c55f2aa076b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c837245-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854774, "uuid": "fe07d041-b40a-4961-990f-d85e1d5bbe13", "comment": "Malware payload", "value": "a4ac3dc6a7f6ee8204e8f1386910d445", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854774, "uuid": "8a9f12c7-c9e0-44a0-9cda-a2840c0ff374", "comment": "Malware payload", "value": "e189768cc423960e91abd95d563167032e7a5573c7c68559ebb4c8e61b822e8c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854774, "uuid": "785c2ba9-51c5-4d3e-a1f3-eefd947759b0", "comment": "Malware payload", "value": "00c922c141369e4ba652be05a7b7393b2141a2f2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854774, "uuid": "4efdc43a-0526-450e-8018-4a1dbcc669b5", "comment": "Malware payload", "value": "b357e4975cc7dcc99e03278c324c13b1597577f0fd9c4c22d8151c366284bd36b4c5e4da3fe601de55ce396fd4a22a97", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854774, "uuid": "48309728-02bb-4771-8e82-46fb5f43a1c5", "value": "T1007733EFB771D20482ABD5F95C2163F28C01D219072866EA7D2E5DEBE28189F7434DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854774, "uuid": "b0dcf0c0-5a69-472a-ba95-c0624c1f27f8", "value": "786432:A6zGrry81bAyWkeIMwCqiUjS4GzAmQqhOJcT3CAQP+IqXPKs5LiN1bOnzL:Lz6GobAjG6kuw2bCAQJkKsReuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854774, "uuid": "faf5f8a2-bb30-46a0-997f-c632045f73d1", "value": 33581079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854774, "uuid": "4b6b429f-5c93-4372-b272-888380e44822", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854774, "uuid": "e8eeb23e-9675-4f65-bb3b-bdeac17e6993", "value": "444f7888a6627671784e64f14a57e345f9a855eb7cec9853855a3fcc8df085a4.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2eddf7-6548-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724854911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854911, "uuid": "bef7c5fd-e4ea-4462-8cc6-d7a49d5d01f5", "comment": "Malware payload", "value": "609993e0e77cacb03484b8a7d39b155a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854911, "uuid": "70e5a780-abcf-49f3-a38a-ef2c70b354ec", "comment": "Malware payload", "value": "e18c02b5d24e08af2f65ff4b535ce153fff15d04fba28fbc5ab6737db01c4a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854911, "uuid": "c7f88aca-7ea0-4987-9551-57f85df9afed", "comment": "Malware payload", "value": "a92eb9fb0d9a0831edabf1733539c44ffe2fe363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724854911, "uuid": "e8c4440e-db83-450c-811d-773fd2861379", "comment": "Malware payload", "value": "833bd26822a10dd5d8136e6a827b75c35a5692edfcf28d31709db36214982c8ee0a3a308866ec31bb1b314936ed190bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hebei Yingtong Pipeline Co. Ltd.", "colour": "#B46701", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854911, "uuid": "bba688aa-3c86-4be0-9681-a26fe66b6a21", "value": "T1CF083359804274F8FA465C34A76DF8F0A51630134E6B31761E8EC6B9AA75AC2FED3703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854911, "uuid": "a785c303-5516-4d1b-88a9-6e36cc71469d", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854911, "uuid": "19bbafc0-ab5c-488b-9fc9-59bce1718603", "value": "1572864:xqkCVh0AUCwbNyuEMw3Wjct00SiNDuBcUEeT6LkCF05jwRASebmJQl1HwWObD+30:UJUCm7EMw3AHuNKBcUH6Cj0AS6mJm0DH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724854911, "uuid": "4afbedd5-a4d2-4634-b766-2f3ca2957b45", "value": 78492352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724854911, "uuid": "da0d4576-5049-496a-8e7d-77e0a9f539b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724854911, "uuid": "30471639-95da-4a30-b843-0d9e9837cb09", "value": "e18c02b5d24e08af2f65ff4b535ce153fff15d04fba28fbc5ab6737db01c4a28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141590c2-658e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724884636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884636, "uuid": "050d2e67-10ac-490b-9762-40859cd4b364", "comment": "Malware payload", "value": "6c951396c8a600f3954f02724204e6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884636, "uuid": "4142422c-1c93-461f-bbcc-c9151d6fe8f1", "comment": "Malware payload", "value": "e292a5f89cead803995060267c373b00676d05db42ce988f13550b7292bd6103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884636, "uuid": "5c672f7b-3423-4c08-a19c-df9d864fc3d9", "comment": "Malware payload", "value": "7604522551061bdad1a513fff5cb62949facee5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724884636, "uuid": "e6dff1cd-88aa-47d9-ab83-5f7cee80993d", "comment": "Malware payload", "value": "24511e64e4d5104d7021ef2d07319728a386d42beb5d4a2e89fa2544e488d190c91e287522bb07ac8a94b34bc53b0d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724884636, "uuid": "674f9db4-cb8a-4890-adbf-d3cdbbd4b06b", "value": "T1B3E4229DE180804ECD76EDF504FBAEF023637D3AA560D14DA07FBE34B738665280A616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724884636, "uuid": "2f190e8e-b3e3-47c2-aa71-1d9a5e44ae01", "value": "12288:ZWtlc5ingN/JuXdH7O18x3UObHgf5jFuq4XQM5taSw40fgYYMiwp68kxU:0tlc5yC/adbChYjl9c40oRwI81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724884636, "uuid": "f5201055-4d63-4ad1-a235-cd2234de2894", "value": 670977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724884636, "uuid": "6149e951-a122-4a3b-bc4c-eaec647b673d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724884636, "uuid": "cf157e81-44b4-4362-92bc-ce7ebf924b99", "value": "SecuriteInfo.com.Win64.MalwareX-gen.19509.12229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29cebdb-64d4-11ef-b7c0-42010a9c0002", "comment": "Malware payload (DarkComet)", "timestamp": 1724805070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805070, "uuid": "702236e6-7743-4f22-81a6-edf5d6f95e95", "comment": "Malware payload (DarkComet)", "value": "524750f2bfcee3d2a91f63d7053b00f0", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805070, "uuid": "df8b870d-b5ac-4a25-975b-0591cdfdb526", "comment": "Malware payload (DarkComet)", "value": "e492ab74db73fb05a78112868596383e27ad49d8a2aa82a34611eea44a23a1ef", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805070, "uuid": "5b7fe4da-9b0f-47e6-9803-ca204046dcfc", "comment": "Malware payload (DarkComet)", "value": "c76dd21a67167bf7c9d37a481de517fce075f887", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724805070, "uuid": "1a01dbe0-8e1b-4bcd-bc85-56d12b69b571", "comment": "Malware payload (DarkComet)", "value": "35240b534572eb379b658aaaa1683f970e333e17e059e8de4ccd12903ddd6dfb5fac86d997ce942c4a8238ce7b9df9e2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805070, "uuid": "6997e87c-b725-4ff2-8091-80d30dc54fc9", "value": "T12536121FB2B56AFBC21A4EFAF0376C1C46F0138A3A42475AB5D496344A0FB716D5630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805070, "uuid": "ea327c0d-9d53-42bb-b071-69c285fa8b9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805070, "uuid": "fb581e95-4783-4161-95a7-7f3a409f3e07", "value": "98304:yv8upB6APFAYS8ILk65Hxp44MVghKrVy+dr5/FtqvG:88upg+GYCkf4qg4h/FQvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724805070, "uuid": "d82e153c-abfa-456c-a7e4-03ad059549e3", "value": 4947968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724805070, "uuid": "c127d596-a7bb-45ff-82d7-018dc5eb2013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724805070, "uuid": "146f1045-266d-4ff9-84bf-635fdab2bf3f", "value": "Apponde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306d7ef2-6509-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Meterpreter)", "timestamp": 1724827561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827561, "uuid": "8208c1ac-bf14-411a-a0fa-b81dc90f4850", "comment": "Malware payload (Meterpreter)", "value": "cd4f21fcd7716a21efb6a302d63c4a8b", "object_relation": "md5", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827561, "uuid": "909f7ecf-f630-462a-970c-66371d769d4a", "comment": "Malware payload (Meterpreter)", "value": "e6ff371016ef905cc6b0b27942d337c5ea12e975887fc9d329f60cbe7e653dee", "object_relation": "sha256", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827561, "uuid": "4a05f10c-5fea-40c3-bf40-7f5d3cc2f96d", "comment": "Malware payload (Meterpreter)", "value": "2c94a72a0ffba566cbe34be2fa51319416b21380", "object_relation": "sha1", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827561, "uuid": "1408f28b-b887-43a4-be1f-40a4868f1831", "comment": "Malware payload (Meterpreter)", "value": "1fb89fad1f3802101ae43d3cf533bb29fe4fce9c98577b04ed950d71614ba5840db7ac194c76dfa5bca1e5b615bd0c22", "object_relation": "sha3-384", "Tag": [ { "name": "51-89-148-22", "colour": "#20C5A3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827561, "uuid": "bd3809ae-96c0-45e0-8c8a-88d4848d31bd", "value": "T15B53FE9C766072EFC85BD472DEA82CA8EA54787B831F4213902715EDEA0D897DF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827561, "uuid": "866fe771-dd34-44cb-b51e-4cd78abd44ed", "value": "768:k9FE2QitHEMPukehR3wRuu2U++eLXQ38BRL049ldXfV1pJU9t2AXBoLijlrncI:kfENsEMPuv3SMBZldvVLJA2AXKMTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827561, "uuid": "9181d658-8f7b-4490-982d-1086b2701c0f", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827561, "uuid": "59363a1c-228d-4f61-b9a5-174390067d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827561, "uuid": "357bc196-92f4-4b10-a472-51079c1cfdec", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e29c415-6589-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724882559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882559, "uuid": "9c1a2331-53b2-4898-ae0a-21477af4cab3", "comment": "Malware payload", "value": "16618e636158684100bc4765ab67e0e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882559, "uuid": "97bf7a36-c2ef-485f-8616-eb7911ffc13b", "comment": "Malware payload", "value": "e7335ced5e17bea179ce178d947032d191a7dbc821c8d096639e7df94bca2c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882559, "uuid": "3bd05592-f17c-4b56-a71d-178d3f57ff94", "comment": "Malware payload", "value": "f53d888235de613e6375fe9125ed5938604977e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724882559, "uuid": "1c5d3c2c-c46e-4a8a-9884-fc0a67e04b6f", "comment": "Malware payload", "value": "07c3c5bfa0775145009614d1d711c18f42a7b7906c9eb4b91b9be5440907d5049625fa6e4b4607af703ff6effcb8260b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882559, "uuid": "3fb93214-80bd-4606-b384-5daf77c6d96f", "value": "T16C159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882559, "uuid": "353de9d8-2ae1-43e4-9c0f-29a24d95b10f", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882559, "uuid": "140c36de-ae80-49f1-b2dc-dca01e316fde", "value": "12288:KqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTO:KqDEvCTbMWu7rQYlBQcBiT6rprG8asO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724882559, "uuid": "a4bc9af3-75cd-48a9-9256-62993910c3e9", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724882559, "uuid": "f14e1d43-adcc-4755-98ba-877fe27308ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724882559, "uuid": "8288f4bd-fab7-46a4-a69b-ef5bef34c98a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc600179-6575-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724874181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874181, "uuid": "fba75b12-1fe6-42a0-bcba-9b17a3677581", "comment": "Malware payload (RedLineStealer)", "value": "5227958f4b44c8a400765ad1bd63bd82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874181, "uuid": "2ba037ca-3e65-49be-ad6c-9dbd6e684829", "comment": "Malware payload (RedLineStealer)", "value": "e7f6a40e059fef9ee1014d55665464075bc67a025976e42987103a582542ef15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874181, "uuid": "0c5a43cf-b039-4e01-81a3-e36f10af6bd0", "comment": "Malware payload (RedLineStealer)", "value": "2f3b858bd3046cccf29b6434d5526ab10a4b9cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874181, "uuid": "ea27c50b-530a-48df-b950-68d221abbc8a", "comment": "Malware payload (RedLineStealer)", "value": "d8eb70f0c009bd3dc0cc074ff1497ce7b49393cc1c4a77fec17c873c9e2bf58a296683629fcf729d6f0a5ea130958f23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874181, "uuid": "feed624c-badc-4ddf-abbd-7db92b88324b", "value": "T104B42388BA785687EB8C5B7199F74B5043BBFB0CA041D31B26A950ED2C837E81179C5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874181, "uuid": "006a9b36-2651-4776-9a1b-ddac21da64b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874181, "uuid": "7d6a1244-5cc1-40bb-91f5-d9c5c5ec52d5", "value": "12288:M9FnOMdqGf5KGcXf5ymFADfnFVJhUuvxQlI1yQNT5apkR:M9FnhoGxxanFAzX7d5QlqJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724874181, "uuid": "44d42d64-444b-42e6-ad75-d0cf486b9411", "value": 530952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724874181, "uuid": "e0ab641e-a2c4-470e-a07a-566bddced2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874181, "uuid": "cf5fb990-4c42-4255-aae9-ad001ea8ca34", "value": "lmec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8ce971-6575-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724873890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873890, "uuid": "b6c051f2-66f6-4111-8c76-dd2c99d078e5", "comment": "Malware payload (RedLineStealer)", "value": "e0f1f888258b37de3568ac3afc68f2cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873890, "uuid": "dd6ac283-5219-44f9-91aa-da995ffa73cd", "comment": "Malware payload (RedLineStealer)", "value": "eabae532c6ddac29c4f04aa2f90bdebc49d72f961a658e5c9459e3fcf58a8045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873890, "uuid": "e40863b6-dc15-4afd-9034-482ed996a9ed", "comment": "Malware payload (RedLineStealer)", "value": "9213beab5fbc54030de4accab9dd44324d297ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724873890, "uuid": "a435ee6c-2bc0-43a4-9661-e629c0dbf401", "comment": "Malware payload (RedLineStealer)", "value": "9448fa1d7bf699ae04367cda31e5dc932154baaff2397da2f0edac5ad942c35f416d1681ca1681459d681c007aad7cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873890, "uuid": "50a66591-40f0-4e0c-aa4d-36fe70819714", "value": "T16BB423DB7FBDA103CBA00FBC59A2A4350EBF0B533C10C57B9A65A8DD1C8275582E6527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873890, "uuid": "011f5f66-6aab-4693-a0de-0ea111818323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873890, "uuid": "33e2774b-50e3-4c39-88ea-a103a51d5c19", "value": "12288:suYqtePFS8BLMVbAuwRGX6jPGUWrQn5YKTsoQoKgcLuOKttSqUZMtHFkR:eqt+BLu47oQ5CGsuO/qUmtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724873890, "uuid": "c78af1e3-7c83-4867-9186-c3cf91825d7b", "value": 534024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724873890, "uuid": "27add358-5648-40ab-925c-2c9468046ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724873890, "uuid": "4f771f2b-8064-43ab-ae66-1ddc4dc346e4", "value": "CLgi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21f428c-6527-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724840636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840636, "uuid": "f14b53e6-9f97-4c27-b0cf-5dc88fbe6121", "comment": "Malware payload (SnakeKeylogger)", "value": "9b67e81f3d18dd82ba19e3b1b9d30e1e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840636, "uuid": "82feb1c4-bbc8-49df-a181-bd35f5ac7751", "comment": "Malware payload (SnakeKeylogger)", "value": "ec828ec2fbfe987cf12c1556a14e1eb0e1d84e66d5392011d95860ce2783789d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840636, "uuid": "e9c9e0e4-02cb-4193-aab3-9997fa8b24cb", "comment": "Malware payload (SnakeKeylogger)", "value": "789613b88a52bc06afdd8a08fc43cfff4bf8ce7e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840636, "uuid": "648e0975-547d-4738-9343-419177877c9d", "comment": "Malware payload (SnakeKeylogger)", "value": "987bdc59fa1c55ef845f923e5d05781b44efa7f26c8bd9e9aa780ca40425a09a69516a0e48d89e1622208bd7b92d31ab", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840636, "uuid": "ad3567de-5885-4822-bbcb-8731a7432920", "value": "T1A1528E48CF9E11C2F721675A5BCA9AD1072F4D61BF0B4AD21C6802C5373AEC1B526F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840636, "uuid": "d1efa32a-37ab-46b4-9c00-c084564a9f93", "value": "384:6E5qYUlp+y4DdVWrXDL6SuvTra0qtRFWSBQXu:H5qp+y4ZYvGVvT3qtKYQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840636, "uuid": "c4af2bc3-3d62-4f05-bab5-4acd6f1e7fa3", "value": 13730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840636, "uuid": "5ed72911-5093-4821-8b97-f019fd5279f6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840636, "uuid": "b41e1613-feb5-4e18-b9e7-cd2cd1f82903", "value": "DETAILING_INFO_0321.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1ab4d0-653d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724850099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850099, "uuid": "e4ba1fee-799f-4385-b1ff-035abe3820e6", "comment": "Malware payload", "value": "c01911ca0f9272632e94d3649c2c5ec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850099, "uuid": "e8881dd3-4683-4243-82c1-76f7883c70af", "comment": "Malware payload", "value": "ecbb62aacc2ad0af1e83282162a3b6832aa053584efb8e1900e78cb4c6561b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850099, "uuid": "cfebc75d-ac17-4dcb-bbf4-640d545d6774", "comment": "Malware payload", "value": "72e27f1c3e60028fe257ae07153a556fb402ac6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724850099, "uuid": "992f22d7-955d-4847-96e0-465687ee0067", "comment": "Malware payload", "value": "ff3f3011ca4e2237d2e19718e31783c6188be5fbe5b0ed61554f4e812e7fd45de7d211c2e629a2078eac915a5c305dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850099, "uuid": "8bb58c3c-14f9-4242-907b-8a4a687fe199", "value": "T1FED4AEACF85050DCCA96CFB7E4E1D7BF78870C21BF014825A75A715A17B62FB600AD1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850099, "uuid": "5358efea-9206-4da3-a667-0db584cdfcca", "value": "dd68e663380c71f66b512f005f1be7ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850099, "uuid": "4e32ae58-f3c4-4b9b-8f96-94a1b02f5faa", "value": "12288:kMBIHm4pgCvnRTdvsGSr6N8eP3zhwFHbBaq03CG8twko:kMBgTpgMRTCSqFtJaC7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724850099, "uuid": "187ac684-77cf-4890-958b-2febd597b088", "value": 614512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724850099, "uuid": "bfcab4e6-8434-412f-99f4-89a0bcda662a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724850099, "uuid": "603e409b-2800-4d98-ab59-836ce8ac3625", "value": "46262-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0db2b9f-655d-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724863881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863881, "uuid": "f8e68df6-1920-4aa5-a0af-8258ba2f0764", "comment": "Malware payload", "value": "50db59a5e5ec772f698fb616c0e866da", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863881, "uuid": "ac217d43-8f62-45b9-bd6c-32f41ed97ffe", "comment": "Malware payload", "value": "edeecb527e2a948da8caf1cd0f762151775ca770a2f69a6fc3735673e62cfd8f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863881, "uuid": "acdbc54a-8e94-4eb8-b297-0ee48c9cd986", "comment": "Malware payload", "value": "43f03037fcdc1d46eb044dfac8df18f6ab76ff87", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724863881, "uuid": "16d5075c-c0b5-4443-9c64-186107b94bbf", "comment": "Malware payload", "value": "d6e0073f9b9ae864af0fb123d4d079edc6e23e58ef9da73846ee7c57c4afda80d079e924d13a765aee97863d340e3b3b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863881, "uuid": "7e913362-89d8-4926-9eb5-a20b71a5e2fc", "value": "T11F77230091B3B515F76BB2BF2AB95FE4C559BC6A02E59DE7637173B806F109204338A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863881, "uuid": "50f45b7d-c7ef-4d74-83ba-330866ee272d", "value": "786432:Tt9bUyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0ypIxgm:Tt9r7xVLYjsp+ikJiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724863881, "uuid": "505ea5fa-b4e0-4f1b-8a76-ea5474690326", "value": 35909120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724863881, "uuid": "7db00d85-7a03-4849-82aa-d5b497c02469", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724863881, "uuid": "7070eec5-a048-41f6-9bf5-b536a086f000", "value": "edeecb527e2a948da8caf1cd0f762151775ca770a2f69a6fc3735673e62cfd8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd32a40a-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724818778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818778, "uuid": "20e6af37-cd1d-43fa-8cb3-32f8ffa80e16", "comment": "Malware payload", "value": "f4969b7d60d03d841912c7154d4f05b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818778, "uuid": "93dbe86e-c572-469d-9491-33efab4e57a8", "comment": "Malware payload", "value": "ee070d492ce48844683d2fb43a9d1f89ab8b1b225d4f8f64cc7e368fdb017979", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818778, "uuid": "3d7d28a7-afeb-48ea-9d1a-0eda7aa6bec4", "comment": "Malware payload", "value": "7a51a3de5e7f75396a878d41a12528df9dd06dec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818778, "uuid": "a1aea809-8328-43dc-89a4-87b850d64900", "comment": "Malware payload", "value": "9ebbb43111ae0def5581b221d186dc5b214b20ef7d3666e06107445da6a9c8e95bba19bdca714dc43e758762ba450b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818778, "uuid": "033292a9-d4f8-4c7e-8481-438be638b2e3", "value": "T1F9159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818778, "uuid": "e5b6d2ec-8f50-4911-b85f-ce17ad36114b", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818778, "uuid": "8b5c8181-da02-4fd5-bf69-bce7fc5d6d73", "value": "12288:6qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT0:6qDEvCTbMWu7rQYlBQcBiT6rprG8as0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818778, "uuid": "3cc4712c-5ce8-4aaa-aa73-27652152bd17", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818778, "uuid": "369e13a2-1bbd-4571-85ca-8069a0a8bb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818778, "uuid": "a7470f20-973b-4ded-a2b6-6275cbbdca7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8111e687-652d-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724843158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843158, "uuid": "e4e5e907-4125-4133-8221-2433cd0e712d", "comment": "Malware payload (Formbook)", "value": "a61e0f9405c19b6a69b58b188742a29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843158, "uuid": "71e5eaa7-b7da-452c-a31c-fe16d56b2adb", "comment": "Malware payload (Formbook)", "value": "eeabc02c0c8b1e32a032f2573a61e8154570f6d9d9485bf40207328bd14447cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843158, "uuid": "4bf594c8-70f7-40e1-bfa1-6dd948dd9117", "comment": "Malware payload (Formbook)", "value": "7ec8239ac5bc2c81eee837a34c20a0c0d3f80f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724843158, "uuid": "778d9df0-67e4-48a8-8d98-6773ef9c8b93", "comment": "Malware payload (Formbook)", "value": "e095a6a7c2859d11264b7e0ad5da78c5a0f831ca2ed9463a430071863c3b6a1533d2debdf8d966b5abfc60bf4580f04e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843158, "uuid": "2ee46bdd-333d-4a66-af99-af06ddff53ce", "value": "T1A2D42381BA5CD843DBBC8672B6A894480171B443FD36F78F1DA509A592D07D803FAE8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843158, "uuid": "e5277afd-63db-4a52-868e-82f7cc8f5e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843158, "uuid": "2a6ee17f-37e3-4d27-8887-464a3d1f7bff", "value": "12288:3iTkgmb19n6FYnamMF2+jQ8yXUH4RfQcyTH4UkxVLObe49PnWE3XVJaHkkR:STvmb19uYajVQFPyTHbkxV4T14HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724843158, "uuid": "4c6977a4-0545-4f23-affd-11bfa9639c27", "value": 630280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724843158, "uuid": "4d4b6f6b-16b9-47d5-9241-edde536be168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724843158, "uuid": "c11c4a89-80e3-4443-b3b0-ab58324eb454", "value": "NEW.ORDER INQUIRY.XLS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5e60dc-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822509, "uuid": "ca4683fe-35e1-400f-a53e-9402391e9862", "comment": "Malware payload (Mirai)", "value": "21187955c57270888bbc2abd05b5166e", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822509, "uuid": "7bc64989-81f0-49c3-b850-6fee223c465a", "comment": "Malware payload (Mirai)", "value": "f0b14ccd154d2acc3c954ff0372a72bb660656322c460722434c5445066b7df1", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822509, "uuid": "594b53e7-d93b-4693-9c02-7e1ec3e9f293", "comment": "Malware payload (Mirai)", "value": "11e1935504cd4dc3f4440de86f100a74bf611f15", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822509, "uuid": "2b4f78a9-6493-49b8-9072-e7d9e4b5712f", "comment": "Malware payload (Mirai)", "value": "a707cf994b8d58928d8a1cb47e48bac9e3bb73d34eeecff220c39886bcc59f49d87fbc968c019f8ad7ffdab5f7671b43", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822509, "uuid": "c6ba2c4c-b342-44f4-8d1d-6cd9bf2b4c35", "value": "T104F317C7F901DAF6F809E7330C534809B270F7A155525A73A257367FED3A1A8182BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822509, "uuid": "762d6b16-6061-4c6b-bb55-1947726ba4b1", "value": "3072:ztNx4PbV0qIb8k1oeQekacWVcW0JcWcBiprhMo81Ezn3RtVdUSLElEd9nr:BNxObsb8kCeQekacWVcW0JcWcB0rhr8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822509, "uuid": "93f201ca-a9dd-4a5d-b415-b48c6c69d812", "value": 160312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822509, "uuid": "9bd02300-966a-441d-8e68-5e597955df51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822509, "uuid": "cfa4800a-2bad-4b75-ad8a-32646999bad1", "value": "criptonize.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61511cc4-6582-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724879612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879612, "uuid": "f0ebac1d-f82d-4161-84e9-35408bdc44dd", "comment": "Malware payload", "value": "551977703bd64d8f12e66626ae00ffd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879612, "uuid": "5cf0e65b-8acf-40c3-9b9f-df05c2e4468d", "comment": "Malware payload", "value": "f1a0c1bc8c35d9301031f2b2b27d0f53f04aca5739d6d5a12166d055ac3320c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879612, "uuid": "6100a91d-6c07-4115-9684-e32a5cd4ab66", "comment": "Malware payload", "value": "57d767fa33d6da6477fc0fed1f30c6593c05f083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724879612, "uuid": "6dde7482-1ef5-4729-9184-06b66f49ea00", "comment": "Malware payload", "value": "59e1ed6dba5f7e942d3f3d8c40b52d0be243d14609ed1b1567fe7d5391c63cf7c75a720b114aa56707446eacc3c4e88b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879612, "uuid": "88875135-29df-4b43-805e-600ad5a09d05", "value": "T1FF159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879612, "uuid": "db4f6eb7-afdd-4c2f-8415-235a65dbb1a9", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879612, "uuid": "691d51b8-4fb6-4470-9247-5e11305f4493", "value": "12288:8qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTa:8qDEvCTbMWu7rQYlBQcBiT6rprG8asa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724879612, "uuid": "5fa167cd-5816-44f2-945a-e2a4fb00474d", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724879612, "uuid": "ce909d7d-c0ab-40ee-9632-c996e8118c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724879612, "uuid": "e1979933-05ff-47f0-b290-0ccf292a9c11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50241bfc-6541-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724851666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851666, "uuid": "66fe3ae0-5d41-403c-b362-55134e322b28", "comment": "Malware payload", "value": "f4d6d6ea62cb666b6fee9d00bdb77350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851666, "uuid": "05aa04fe-7aaf-482c-bde1-2db02b7be2ee", "comment": "Malware payload", "value": "f1afd0fa63ba265a10d59a7407b0341f7d93ca6a903ad861efb02cfbc6c0d67e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851666, "uuid": "4f9dbfeb-087f-4008-a356-bbbbcd3b7277", "comment": "Malware payload", "value": "7e02b9be8a9ab7f3c6f371d2ff930a7de43fa272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724851666, "uuid": "118fdb44-1c0c-4bf1-9dff-c75b2de0fa49", "comment": "Malware payload", "value": "f974741079b7583ba1b6eaf20cac4bddb4573a80e93f73c5d1d783dfa405932d24b2f4a2904dd8490155bac4e9b0c580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851666, "uuid": "bf1e748b-282a-4edb-b889-88432a726152", "value": "T12A447C0AEBA381B1EC06447921EAF77B4A3562174338CDD3DBD0CF94E956BE250B9607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851666, "uuid": "d673e7bc-5764-4024-ac4b-5b24a22b26bd", "value": "9fd5b8944ce9c3acaedc650793d4996e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851666, "uuid": "0bcef511-4ce8-45d6-a9c7-db439c4f5f69", "value": "6144:jiYdiGs/ROvwXbkynLIyqoQ8+64GnWb4bYtdhrKNRO7Eyyym:eygROD22O3ZGdZD7Eyyym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724851666, "uuid": "2dffc3cc-d4a1-42fb-a1cb-f03a466121cc", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724851666, "uuid": "c7098708-72f2-4492-896c-b34483896e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724851666, "uuid": "bbbe9cbb-5580-4159-b577-b9d5b9309fc5", "value": "SecuriteInfo.com.Win32.PWSX-gen.30515.23037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629d3cfd-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724827216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827216, "uuid": "3af26ae2-ce93-4bdc-866b-8378bd2c2e5f", "comment": "Malware payload (RedLineStealer)", "value": "f4fb933067e5a123bdf4e7175700a861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827216, "uuid": "57ae59a3-0ba6-4d5b-ae92-9036a4365e51", "comment": "Malware payload (RedLineStealer)", "value": "f2892f678130b16f75d62165205fbb384d73ee663199c366cb76f020ed105f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827216, "uuid": "fff6d035-baa6-44cc-aeeb-b283e99faa07", "comment": "Malware payload (RedLineStealer)", "value": "93fcdaac9994b762f98d1a4983803dd45b37536d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827216, "uuid": "e45d0039-47e9-4d7b-b759-229841c11492", "comment": "Malware payload (RedLineStealer)", "value": "c7db122c34e3630075f1eb603e59c7b57cf86093ba7d8595043915295982b3ea6e671777b3a32e5a34919854c895b81f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827216, "uuid": "b0470c72-5df5-4920-8073-47ea3723d344", "value": "T17F2512686915D316C9A443F80EF1F2B507BD1EEEA842E2569FDEADDB3933B050D40293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827216, "uuid": "189c200a-468f-4831-9602-1cbe6a8a05b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827216, "uuid": "fb700c26-aa15-4109-a0da-e29ad4978981", "value": "24576:PBUPpJ0V171+V4/TGhMc+E4Ypfa4kc8PNRr6rIN7JxD5f8Q:pGPWR14xht40iAuNR+rA7nD98Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827216, "uuid": "05b51931-a0b2-4c15-9d37-5434a95ae30e", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827216, "uuid": "41f7bdc3-0820-4c70-b416-1f8fd3007dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827216, "uuid": "f0fd4c1f-e5d9-43a4-829a-fc636bd69b44", "value": "USD 720,500.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c8bff1-650c-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724829154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829154, "uuid": "99cd4ce1-44bd-4abf-ad22-1a8c1180421b", "comment": "Malware payload", "value": "2221a252ea5de03bdbb75168c3ef5a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829154, "uuid": "cfee7b5f-fa56-4185-bc5b-14c1343093f6", "comment": "Malware payload", "value": "f2a246644a98ccce35ba182a1348d422a89cbc0cab445b50f6482a16a5edc20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829154, "uuid": "a559a62a-74bd-43ee-8a92-c5458a2589cc", "comment": "Malware payload", "value": "b012e1e981a6bd850a0eeb7d4ab5b891f7b4a24e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724829154, "uuid": "8aeda4f2-fc36-414c-bbb6-7a9113112f9e", "comment": "Malware payload", "value": "b589e710cd3ab6c5fe54c4b1ffb7fa01ef5d1eae369a2e77a6278b82abca210a634704c4a983f1a5309470132f52551f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724829154, "uuid": "341e45ee-5419-4fa0-b470-bddec9293bb8", "value": "T1A1968DFB22E6462DC12D923BC093CF01C437B9790737C6D702915A39DA6AAC15E7EA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724829154, "uuid": "8bb010a8-2e7e-4d69-9d5f-b0aa28dad03a", "value": "937ab3e955faac33827861f288cec9e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724829154, "uuid": "b7592392-d4f7-4003-9e85-36560a2c88c4", "value": "98304:1AlUu2HHsfNHU/J1vD3NSPUv3KWQSy+Bk:Kqux+RlfKkhBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724829154, "uuid": "4d01f40f-6ee4-4680-8dd6-793f4257ed1a", "value": 8751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724829154, "uuid": "ff147ef4-101e-4b67-b558-4c07b12aff98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724829154, "uuid": "3b00f579-b522-469e-8878-3e6281bfb7f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e26bee-6508-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724827162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827162, "uuid": "5f37970a-221a-469e-9357-6dd2e0df5412", "comment": "Malware payload (Formbook)", "value": "0cdbef652a0c0b1b883377973c51fccf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827162, "uuid": "1ade5cd6-9808-4c53-bf4c-9a149ad34747", "comment": "Malware payload (Formbook)", "value": "f308b6b60e01b1b1319eafe5189a63eeefb79c01d6017bf0246b6664f21bd966", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827162, "uuid": "87ceb792-6370-4055-8c20-d2b13fc23270", "comment": "Malware payload (Formbook)", "value": "d9faf9b259cc781c758e9a977fef3e86909f8669", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827162, "uuid": "7e112b31-35a7-4d2b-9b27-ccc5361ef501", "comment": "Malware payload (Formbook)", "value": "0d8030b48cd14b85e16e0967adcbe9ce6e61568e4e6378f0bcf02ae99a276650937ee17abb90804797f71ac10c8ce6ba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827162, "uuid": "3fc57066-59e9-4bb7-aa84-7118d814c302", "value": "T1170533994E5A823DDA03974AF7649BD4E11DFF62A08E9418D3C631548EB3C8BBD6C0F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827162, "uuid": "554bda19-238e-467a-aa2a-fe9e01e95423", "value": "24576:Q6ISinjfpnxvnTbMMCOmoIktayCfJqCMa76z/G1:Q6snjPnTcohwxtl7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827162, "uuid": "1ffe122f-214d-42f2-a626-d33342372ddb", "value": 808171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827162, "uuid": "bc7b4590-fa59-4a40-a32d-a462797bcd2b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827162, "uuid": "32db630d-ae4d-482a-80b5-be15074d4772", "value": "DN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589cacaa-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724818609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818609, "uuid": "56a827ec-401b-4670-be07-11c07fbc9902", "comment": "Malware payload", "value": "a96714b5fd1c3a8f919bcbc612f9e6c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818609, "uuid": "3b58f534-ce86-46f8-8186-cb6ac04ed3bf", "comment": "Malware payload", "value": "f3bf5c06bca51b1d99d6c883656fae1898422ca2c772b300b8b5b85c624aab32", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818609, "uuid": "9bf889d9-c7b0-4f53-bdc2-a6de08aa47d1", "comment": "Malware payload", "value": "45d4673844fbbe83ac432dc620c4b0c94219bb6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818609, "uuid": "01e1b51a-d328-45c9-aebb-749ca5120400", "comment": "Malware payload", "value": "cd2fa8cb7e91704375ab12a66881d067ee13d8ab90749e8cd309c6e69078f941c5836a6e4caacdd1f1b6cd443fa57edb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818609, "uuid": "805be1c9-a035-4bdf-afb3-33031c3a72a9", "value": "T143F041C3C0CF3325C2642472506E899045E0ED1D42A8A8951010CADCADF8C09AE90A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818609, "uuid": "d1da4081-48ce-43b3-8608-e0dd24aeb5bd", "value": "12:5jdEpCc3x0SGaqVpcN39BKqeseR0iM5LN6EMxN2sv+FeENxEBaMd:9dEpCciSGampy9cqeHWiMVhMxNhmFeEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818609, "uuid": "375867e0-ae1f-41c0-b0ff-b334ac26889b", "value": 599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818609, "uuid": "7baa6843-b241-42c0-9b9d-5a7099271650", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818609, "uuid": "2465b797-0cc5-42eb-8f71-43dda94d2c57", "value": "INFOSUBMIT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce288c53-652c-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724842858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842858, "uuid": "fcac3afc-5814-4992-9b15-057f85eeb807", "comment": "Malware payload", "value": "a8d8d4b77fa2cde8fe1d0a48779e8d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaC", "colour": "#74ACC0", "exportable": true, "hide_tag": false }, { "name": "lummar", "colour": "#55F306", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842858, "uuid": "4db4bc05-5de1-4e12-9f29-57e972ef9c29", "comment": "Malware payload", "value": "f4aa7fef3a5b1aded41b8389c05e40960c57c15baae6f4437331a04faf12151e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaC", "colour": "#74ACC0", "exportable": true, "hide_tag": false }, { "name": "lummar", "colour": "#55F306", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842858, "uuid": "26186e74-1aa9-442a-bb7c-84ff418c3550", "comment": "Malware payload", "value": "788bb254117c2e06a53ab1b542fe1661b595d838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaC", "colour": "#74ACC0", "exportable": true, "hide_tag": false }, { "name": "lummar", "colour": "#55F306", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724842858, "uuid": "9ae6c804-8bc7-4387-b6e8-45e4aadeff54", "comment": "Malware payload", "value": "3a246998b1b19ee2bfb92f4b387f7d5a4fd03ba341e4f61bd4fd079f9dd90dc9d1d9bd289fc5689d2e3afeb387d6f309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "LummaC", "colour": "#74ACC0", "exportable": true, "hide_tag": false }, { "name": "lummar", "colour": "#55F306", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724842858, "uuid": "b3a504f1-798d-4d6f-966e-05563c34a6da", "value": "T159E64A50FEC758F2D9434836905BA22F27345C058B28DBCBEF54BE69E877A921C37249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724842858, "uuid": "e2dba8ec-7530-462f-a3d6-0f9895aeeeda", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724842858, "uuid": "d4c35c83-2ad9-436c-a19b-a8d13ee84043", "value": "98304:PN/VjOV0BZq4eGHfIvqHC1a/nejojxm5coptQbDdyfxo:LjE0pejGmvQ9wxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724842858, "uuid": "df69d192-6949-4d48-8069-771256549bf4", "value": 13920768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724842858, "uuid": "136261c8-0155-4b46-88ee-9402641cfe97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724842858, "uuid": "ef6452e5-d18b-497d-a542-9696e05783e3", "value": "pcsx2-v2.0.2-windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438f4da5-6570-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724871831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871831, "uuid": "155e61da-213b-434c-8449-b9d5aaaa9fee", "comment": "Malware payload", "value": "e468cade55308ee32359e2d1a88506ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871831, "uuid": "628093e1-083e-4e4c-8c6f-ca6302a684f4", "comment": "Malware payload", "value": "f618e9fa05c392501fb76415d64007225fe20baddc9f1a2dcc9ff3599473a8eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871831, "uuid": "e648851e-1db6-47be-bc3b-2691fe34a0fd", "comment": "Malware payload", "value": "278eb15a04c93a90f3f5ef7f88641f0f41fac5bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724871831, "uuid": "09456216-d26f-40c0-b73a-f9d4a2047259", "comment": "Malware payload", "value": "00ad6a8e73b1f4ae08bacbfcfaa25dc6d79c9dcf90d6b10d1cdde218ab2e25595ce68b809619f547e58aa775d1f09a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871831, "uuid": "90b30109-50e0-49c3-a489-d91cff5d8d32", "value": "T1B6E48C62F6C3D0B6E8D611B192FE1BF31D3873154329A5DBA2D029A41A701E3763F61E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871831, "uuid": "7d3efa5f-322e-4dee-923e-2f19cfc1409d", "value": "23166a43462b7b4cedcdb2671cf7e0b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871831, "uuid": "e0d1f530-5337-42dc-afaa-6207343b9c8c", "value": "12288:oymg4BvDLjNSwO+ocal447iMaNHH8WpKG23J5qIspRQ8RzIA7t80xVJW:oyUvDLJvO+0ldi5B8WpKG2ZYICQyIelo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724871831, "uuid": "02fe73f7-3e36-4822-b17f-ee88d1a403cc", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724871831, "uuid": "c317f907-0863-4216-9555-7f4efe89f12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724871831, "uuid": "ac257257-07f9-4516-afc9-fb47ea53c1c6", "value": "chromedump.ex#", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703604dd-6585-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724880925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724880925, "uuid": "e5ebcf7e-9325-42d2-9817-464f1e2991ef", "comment": "Malware payload (RedLineStealer)", "value": "3ccfea6abb70ee274c1389946793ade4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724880925, "uuid": "9a016b1b-c240-4774-88f7-45600ef9b8bb", "comment": "Malware payload (RedLineStealer)", "value": "f66880a25c96cbdc10a12576cc1c67f88c96db31f6952207d2565a62fa7c6272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724880925, "uuid": "c657aa86-481a-483f-81bf-a0fc976f45c8", "comment": "Malware payload (RedLineStealer)", "value": "06090d3c3f64da737e65fefee6f793fb5f59bc78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724880925, "uuid": "eccef918-13e6-40d7-98cd-fbb4bdf0ecda", "comment": "Malware payload (RedLineStealer)", "value": "20e4e57ac2ee87c2e67d1b4a7257ba84d54352d862a99e33093b21df61b02793805f842159dd585232db9634468c0b87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724880925, "uuid": "66da9e11-8a36-42fa-b7af-59eb8d9ad95d", "value": "T16EE471DD365072DFC85BC8728AA81C68FB6174BB471F9203A0671AED9A4D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724880925, "uuid": "02c092ca-6bf0-4045-b5b1-98f3b98293d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724880925, "uuid": "ea32243d-92ef-434b-bc09-4ce84c6a481f", "value": "12288:sJiUtGVdCKFsFUWIvg/lW5DRpx+uuj4RHLB6jxGLwFU+XPNvynPUl0BcEUx2+oLW:MiCGVdtr52U4P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724880925, "uuid": "ae04de44-7c02-4aae-bd2c-325254794a30", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724880925, "uuid": "a7a382d1-b2b6-422a-bb86-c0809c0e4654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724880925, "uuid": "ad4048d1-d3f8-4c3a-b10c-97f5737a3f5d", "value": "3ccfea6abb70ee274c1389946793ade4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4f1aa7-6525-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724839877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839877, "uuid": "9cdedeba-42e5-466c-8cee-4e4c3c887479", "comment": "Malware payload (Formbook)", "value": "9a057309180e58b6f230abfddd69d641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839877, "uuid": "20a17a75-30e9-4535-b429-b30cab8517ef", "comment": "Malware payload (Formbook)", "value": "f758dbb63208445f8ed1f1d8bb648759ba6f1b8116b6ecd2ef996f8be008128b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839877, "uuid": "9cfce807-3bec-483b-a317-766edef18687", "comment": "Malware payload (Formbook)", "value": "fdd107e8261be425264c7863b07cdbaec37a23cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724839877, "uuid": "b9fb7b89-254e-4d40-9142-19269f668626", "comment": "Malware payload (Formbook)", "value": "19daa10528ea7f3587054d418c5df553aef0334d35a5e80761824371a6491f43011d61e39de83f70411e81232b6d40e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839877, "uuid": "fd9ec209-f76f-49cf-aaa3-8cc35094add5", "value": "T1850501682605EA13DAA597F509F0F278137C6EC9B902E2139FD8BDEBB836F005D45187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839877, "uuid": "5897029a-ca0c-4633-9070-afedeac692a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839877, "uuid": "992984c1-e8f6-492f-b3e4-2be155678a06", "value": "12288:J4psMlFytfdaeytmhMkYdqBrpBpYys5GQypWGyxoL4iL0sa0FUpH+UaRQ4HX3EyU:J4LeOdqBVBgoDyRiAgFUpeUQR33z6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724839877, "uuid": "134841df-d37b-437c-8cfb-4819946ed37d", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724839877, "uuid": "90c72449-4648-4abf-8f55-5a6141af9b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724839877, "uuid": "ad58f106-266f-4c8c-b52f-de308f75f418", "value": "RFQ STS3780082024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4d6d90-6526-11ef-b7c0-42010a9c0002", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1724840281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840281, "uuid": "4ada8ada-6777-4d34-920e-ee065cd93a0c", "comment": "Malware payload (SnakeKeylogger)", "value": "c8010e37593232f89ba23f3a90c36ce6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840281, "uuid": "48f4f8fd-e775-46ac-8a74-734ca079d327", "comment": "Malware payload (SnakeKeylogger)", "value": "f7d3353c6b3095b264f6e2b43c9eb6faf8e02e3e171fc1bec507bba9fa554672", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840281, "uuid": "685afa4e-c304-49cc-b4a0-01e552e60f03", "comment": "Malware payload (SnakeKeylogger)", "value": "97b295d539f01a1b7630793cb8f990c323c4920f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724840281, "uuid": "0892e228-d76f-4d3f-9df5-4561fa02b567", "comment": "Malware payload (SnakeKeylogger)", "value": "41d5c333cb69757b5165f11ea507d1e7904e7c585de7d917c4018cd491e1b5f91605512dfc43dd74fb1261ccc624e3ec", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840281, "uuid": "ae7f7efd-0c95-4acc-9cd5-97d245110388", "value": "T12CE4231AD0DD844A68663472ECDB4304AD0ED910FF25AC71D59738B103567EDE8C66FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840281, "uuid": "9c8baf5f-62e3-492c-a293-8d58fabbf7c1", "value": "12288:jJYVSidnKGHHi0YLXsQia1c1jjvkbcp7coxffngRn8Kr6oCgjnbMmusSY5usp:OVXdnbntG4XrWoJ/gRnth1vuVExp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724840281, "uuid": "e69457e8-145a-4a03-b71e-2b175ccac347", "value": 702343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724840281, "uuid": "d9d1be2a-f987-439b-95fe-50fccf150806", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724840281, "uuid": "6b4b5122-3121-41dd-ab2e-ce2cb755913a", "value": "Request for Quotation No. KTC 56376.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97dbb5d-6575-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724874257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874257, "uuid": "252a2b89-f918-41b1-b4de-6a24523107d3", "comment": "Malware payload", "value": "365c7243259666885e6d322d0527786a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874257, "uuid": "3068a7e2-3a53-49e0-9800-441897c038af", "comment": "Malware payload", "value": "f829a4ec323e6fdc079d1892954e389849da576dae129d036b155402f571a9be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874257, "uuid": "f2357d50-9a13-489f-a29c-5478684010d2", "comment": "Malware payload", "value": "49828e7a0f87f72c2a246bf12b9d9b7207484f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724874257, "uuid": "13e204e4-6787-4942-b678-25082c99750c", "comment": "Malware payload", "value": "7011da0edb3a8ce19e15d2ea2aa4c981e23e0027d7c65033fece87e5db3e17dec2db748f81029cc808eaa0e8aea56ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874257, "uuid": "90a4a535-c324-45dd-9717-c51fe87d85fc", "value": "T1E7252378B6AD5A73EF040EB3D4656C78157B900B2117E7CD1AC4249E6DE37E80BD2A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874257, "uuid": "963dba3e-bb73-49a2-b838-24a8afcbb12a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874257, "uuid": "0c1186ae-0cca-4a95-8825-458dc922912f", "value": "24576:YR6VVFbG/HsCuPFHmLwWEUBw6CBiF3ldpRf3hqc0EswqM9:a6VbarmVYPEpCpRfhqc0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724874257, "uuid": "721d0c23-a5a6-41e6-81ac-a0ca7201783a", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724874257, "uuid": "29c10c05-1ec9-43a4-bf3b-97adc36fc7b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724874257, "uuid": "89dc266a-585e-4158-ad14-9d02c698e743", "value": "zWqL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4c372a-6507-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Sliver)", "timestamp": 1724827042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827042, "uuid": "1f856b13-53a6-4960-8e69-f583397d7478", "comment": "Malware payload (Sliver)", "value": "a451b3d7b2a29d7a1c2640f1167c87cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827042, "uuid": "d3ff2ffa-86f3-4b4d-8de7-9f114d927ae0", "comment": "Malware payload (Sliver)", "value": "f85c77e8516ed091939080aa7f9c6323c5ce3ffbef9adb635dc9fc1a82c446d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827042, "uuid": "2e5b98fd-13ca-4479-a09b-e0f27e1f563a", "comment": "Malware payload (Sliver)", "value": "f67cd08894ac6fba2f043a43b79ac35dc90b7115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724827042, "uuid": "fb7d8a2d-dd5c-4e2e-bfe5-084b6907ebab", "comment": "Malware payload (Sliver)", "value": "63bda987c5a38c4c3c756f568a026cbd61e6c131fa0144640d158adaa8e8d1312b5c17790c8a90f3cfa608ae7d5e3cc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "redslv241f166bdf98-eurotechconnect-com", "colour": "#9E5C61", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827042, "uuid": "968e9445-d05e-4fb4-a423-b4e878363d1f", "value": "T141F62B03F4D51095C4E9E1B4892542A2FA70385C1B7933DB2BA5F7B42B32BF09E7A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827042, "uuid": "f0cc7737-1b74-4db4-ba1d-09152be7ade6", "value": "98304:c6jZRi0sf4S7kmspX4ZAlcLbiXWNFbMXIUGCnmEbc+ZTSZqWZ/e7:c6jfi0sSZqgcLbMUZM4nCDXSZVW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724827042, "uuid": "d8229d60-ba17-4c0d-8fa8-e0e86f8f09dc", "value": 15704064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724827042, "uuid": "57c3d2a6-476d-431b-8bbd-d7df03e07098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724827042, "uuid": "9f2849cd-58d3-47c7-b52a-aa223e695d16", "value": "f85c77e8516ed091939080aa7f9c6323c5ce3ffbef9adb635dc9fc1a82c446d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966e535f-655e-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724864239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864239, "uuid": "8499404b-c91c-4141-b678-3c4071139fae", "comment": "Malware payload", "value": "7dbe41400fb858a1a7cdbed069f4b6db", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864239, "uuid": "72be720d-d41f-477e-aad6-3a67ae3638b7", "comment": "Malware payload", "value": "f8cd254f0525bec50e76aca3d4b8296822136ebff7b63df62168df22db7d27e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864239, "uuid": "54cc6a69-a16c-43c2-a4c6-931b93133a22", "comment": "Malware payload", "value": "d6e999b4dc6116e49305c05f04b9d738a318cc58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864239, "uuid": "36bda8ab-0e4d-48a4-9781-7e7c9cb42d9b", "comment": "Malware payload", "value": "8c7cf41feefb174277e6228ee9ee92b35d74e6555d1b405fd89156be34d8cdfb75ce844a369e4b2cffdb8c9691f42e02", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RobotDropper", "colour": "#7C22D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864239, "uuid": "4693ca1f-fa35-4063-a2cf-37f1bbde367b", "value": "T1086723675A3BFA50D662F27D20985FA621F3B4B24719D8FFF3B877D62418442023A853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864239, "uuid": "b2fceb14-dd3b-4535-8870-6b68278d2fa3", "value": "2b3999cd35a0b27bc0e98e38cac91cce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864239, "uuid": "b56c5ca0-cbcc-4ce7-a4a3-1e7d2924e100", "value": "786432:R3UyTDXySTjxA4Ztx2+G+N0WYQYBXPByttH+dktHEDv0y:RX7xVLYjsp+ikJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724864239, "uuid": "dea719a9-00ab-4051-83d4-1a75ab66cbdf", "value": 32489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724864239, "uuid": "c715c07c-ab6c-4a8f-ac5f-c9b08a0644fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864239, "uuid": "8c42fed7-8e4c-4b60-8c42-e4bfd52aecf0", "value": "f8cd254f0525bec50e76aca3d4b8296822136ebff7b63df62168df22db7d27e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5fcdd1-6534-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724846180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846180, "uuid": "b8de0931-1703-4322-958e-1227e84b3e53", "comment": "Malware payload", "value": "c741912812d73b60ee300813c0b62f5c", "object_relation": "md5", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846180, "uuid": "7de83322-4870-4c06-bfaf-621dca414f7f", "comment": "Malware payload", "value": "f8dc6b5aea1a23e81217fa1ad228612d852d54844042778c14e70155da8e1a50", "object_relation": "sha256", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846180, "uuid": "e797d489-5b51-4d9b-ac71-e837ac0159c2", "comment": "Malware payload", "value": "2ede35c51e4b0c84032508551820ceba3678add6", "object_relation": "sha1", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724846180, "uuid": "7128f8e1-51f9-4b48-90cd-73bf6e3dcfda", "comment": "Malware payload", "value": "bd57807f8075d4fbbb97211324da6140439f69f556804a945e65063f2597bd491d3f993baf0ef814509e26676d0cedeb", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-116-5", "colour": "#6C7165", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846180, "uuid": "f773aec7-0d6e-4a1e-aa8d-413535dd0a3a", "value": "T18AC549027B4191FBC98F42B1A01ED33D6E77950893018EE7C6A4ADB86DF57C12D3A66C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846180, "uuid": "b2a1ddfb-30ae-4469-946d-b1215050f09e", "value": "91298fb09c1027c7a40c24d707c0ea92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846180, "uuid": "12fa0dca-674b-489f-a9f6-875bd4344216", "value": "49152:ig87eg8epkPQVR/wMXlkLM0zbIJCiEzOKHosOSrlW5syKFRBV:DUpkP0RUSJCiWtI2RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724846180, "uuid": "50a0c31a-c685-49ab-9b4c-96ac25e94fa6", "value": 2711040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724846180, "uuid": "d9f15427-2d22-4ef8-876d-6d6424db776e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724846180, "uuid": "28a6db95-632b-4876-a410-7a416769b13c", "value": "g2m.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c590b8b-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload (XWorm)", "timestamp": 1724818588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818588, "uuid": "cb8a0d55-c315-48f5-9a27-14e8166486a4", "comment": "Malware payload (XWorm)", "value": "27e441b3576b769d45415a88fc5bb4ae", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818588, "uuid": "3af21f8e-1328-428a-9735-7cb162660448", "comment": "Malware payload (XWorm)", "value": "fa4d685e37eac187e38a0ca78b5eee9c2a27deea8cbcc678579d4d844106e33b", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818588, "uuid": "49a29a7a-754b-4de1-81e1-4029d12fd3fd", "comment": "Malware payload (XWorm)", "value": "1bc2a83a13461dcea1e2de3329bc7eedbef3bc1b", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818588, "uuid": "1abc2849-9f2c-48b8-9892-c005ee8fef78", "comment": "Malware payload (XWorm)", "value": "686263b3a9746a18dbd1326a9eeaed0e0213ef0491e49dcda67024954c1c5b030164e874311da3a474bbaa3764e0b2d3", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818588, "uuid": "aed93742-97f7-49e2-a77e-f4a15cd2be07", "value": "T10125124467FD8A2AE7FE7FBCA8B002121AB5B856AC37D7AD061450ED4863711EC20777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818588, "uuid": "7642870c-b052-4d25-9cd8-70fc1b0106e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818588, "uuid": "2931720a-b71a-4b85-9c2f-a676339d685f", "value": "24576:7kHGhl3VqyoNKbWipq0a6f1+69TutHx+NxV+JJp+B6:wmhBVYN5aq0voYu1oNP+t+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818588, "uuid": "d5150728-c234-43ea-8d5a-7f3e4434363b", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818588, "uuid": "397a7866-1b08-46c7-b34b-dac1ead44281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818588, "uuid": "cb7fa259-f4fb-44d4-b91a-ae19eb274c47", "value": "gol1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57af1edd-64f4-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Sliver)", "timestamp": 1724818607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818607, "uuid": "857866c4-b550-411d-a74c-a8e0cec7914d", "comment": "Malware payload (Sliver)", "value": "5c7488ec96109d6d71e0762cc796f3ba", "object_relation": "md5", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818607, "uuid": "729228c3-79a3-42e3-b821-e75114627bd7", "comment": "Malware payload (Sliver)", "value": "fb04730f17b7eb8ef68a0dffeadd720a36a47d00a393a84ff323cf137b351cf5", "object_relation": "sha256", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818607, "uuid": "915e74d7-a569-41e8-a501-3ddaf269a0cb", "comment": "Malware payload (Sliver)", "value": "941ae1ddcf2a5cb43e43c34dfb7e169cf62c17e6", "object_relation": "sha1", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724818607, "uuid": "623ac3c8-0d67-4ced-9c30-0e24362d1115", "comment": "Malware payload (Sliver)", "value": "bee39fb3a4d26139302cecba90d87b1d3cb805d3acf000e7fc3f4baeb4a6f0631dfc97ff30b0ba55102287b76dc3f17c", "object_relation": "sha3-384", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818607, "uuid": "3e293f57-5e5b-418e-ad16-f602b63a7494", "value": "T1B325125A63E8062AF6FF3F7CE8B005101A31FE5A6D36E71D490884DE06637909DA17B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818607, "uuid": "62b7a233-eeb0-47d5-aab4-83b609e0c9fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818607, "uuid": "cc965258-ada9-438d-9367-a49b25fc83c6", "value": "24576:KbPnPGn27J0eLQViJw7q3+lUR/5A7p26Zz/onold8:Kano6wn4Y+qRhA7pJmQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724818607, "uuid": "8f014be0-cd78-4aed-a300-0ede11bbbad9", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724818607, "uuid": "710b47f0-26a1-4579-9294-b6e9b23c2cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724818607, "uuid": "b952ce1f-7b0f-4ad9-9189-3141a807e17d", "value": "Fone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d82a9ad-656b-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724869620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869620, "uuid": "7c671abb-a58a-4b3a-8969-45ae9a1252b6", "comment": "Malware payload", "value": "4cad86ed173ff0dad198582d86bf62b6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869620, "uuid": "51ec71ff-1e2f-44bb-b377-909523e5bf20", "comment": "Malware payload", "value": "fbff2ebba99bfa194af533852062c6d60831c7cc3801d4af980c329721484a28", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869620, "uuid": "878a6891-c948-48ff-a3b6-a656e16c2671", "comment": "Malware payload", "value": "d25bd59b411076ccc1ed4b4daef78aef093a9d3d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869620, "uuid": "3ae60eff-19c5-403b-8e89-85ac3f13a73d", "comment": "Malware payload", "value": "212692186c411679650b4d1796ff0a43f10ce255fa5a3eebd6dd78a10b1a76e89abbf9696de191e1a993f7ca39908b1c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869620, "uuid": "beb59084-3232-499b-b19e-b3b6659f960c", "value": "T1DC662222ECEAA12EF937413920434566353AA7D9DECBD4E109E972C1D46383A5F9337C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869620, "uuid": "abb3b720-3588-4462-bb87-e60955a1b3d9", "value": "196608:N0EY4XwEff0cxykwL9g1leOnAU+1blTRLXKrC05:KYDf8FkHXAU8dJXKrb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724869620, "uuid": "952ef9a3-4aa2-4db7-a4a9-82d82da06b4e", "value": 6899272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724869620, "uuid": "48abb5f8-6812-460e-876f-6e5e0a1b486c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869620, "uuid": "79505a87-eaf7-4c66-ab67-6ee6cf7cf1e0", "value": "Aristois-Free (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a72429-656b-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724869679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869679, "uuid": "390f6460-fc18-4e70-9301-926203bceade", "comment": "Malware payload", "value": "44bee57fb508135458812a1ed6431a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869679, "uuid": "76ee7725-47c3-434c-8fde-8f2301e491df", "comment": "Malware payload", "value": "fc86e5bfea8a759be87dd3e752ab37158699b93d80fcae470ec2394eb1c66b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869679, "uuid": "b06051bb-b488-4e66-a084-e9cad04d44e0", "comment": "Malware payload", "value": "bf639352f0b8183c8a421794ec85696d91a467ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724869679, "uuid": "55ed2cde-f844-4dc3-94dd-e8a45e06ca5f", "comment": "Malware payload", "value": "8b08f1527319701d1821ac2b5df128077895844ecfb69af4cb98261d4104e1fb531048e85c21163dd92b0b94dbab7744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869679, "uuid": "0331e1d2-e340-40c1-96e6-f41a89b0f594", "value": "T1D88533DDCFAC8928DA1A0BFF891763D156B298C94DEF4538E3413D798D2B1126A63D0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869679, "uuid": "23f2b7b4-8f04-4f25-9ab6-7fd88eba3960", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869679, "uuid": "58a29b5a-a146-4e89-a712-e9d9299a86be", "value": "24576:Wd4Ry/OwH0II6L+2tvBlyAwFFZjkf6FysFH9ZPt5Dywsl5iFOeWpG2ez:WdZ/ZFIA+2c46dTZPzBIsCpG2ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724869679, "uuid": "7e860d37-2538-4e6b-ae73-f277052b9f1a", "value": 1804288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724869679, "uuid": "7bf49a51-4e38-4fb5-971a-4f6889fda8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724869679, "uuid": "22e7ce42-1609-48d7-b97d-1475d3066c5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c861fa-654d-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Formbook)", "timestamp": 1724856990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856990, "uuid": "ed748a99-478e-478a-867c-770c6d25cdf4", "comment": "Malware payload (Formbook)", "value": "642cb03ac35f9346035b5926fd1f11bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856990, "uuid": "20ec52c2-ed5e-43c7-9c81-d0d7837a81b9", "comment": "Malware payload (Formbook)", "value": "fca9f9323e43242411c9cd339b86c9aa465c6d59adc66bb6492eb237d5435446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856990, "uuid": "ca5d77a8-d894-4d0e-b3f3-ef3933dc04e7", "comment": "Malware payload (Formbook)", "value": "f088d55ff1cc4af22185efc2109cca260beca66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724856990, "uuid": "7cd0a727-adcf-4511-9a21-5f0eb26291b4", "comment": "Malware payload (Formbook)", "value": "e40deee127d84b5e77a1ce4d294746ee16afc4dc86f4c4945d63ca782547028bb42f88ac1cf253639699448526063e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856990, "uuid": "efafd553-c23d-41bb-9e79-9fd2ae097221", "value": "T1E3052385E3BABF26C7FE47F9805254000731ACD5E646F3A35DC9A0E66D227A459C8F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856990, "uuid": "9ad35a6a-0bbb-49a5-815b-fc7bfe6430dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856990, "uuid": "f72615ff-0cc3-4e56-9c14-405c337029db", "value": "12288:tiX0ITtSlNgpQnutI48WHZrKYKPxfcLC8Hgg5YhPNaNvLGWasyBPtA2C8/V4j9cg:vQS4IyNuxELSgoPMFLwhdMGeqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724856990, "uuid": "71bdcf89-1a7f-4c60-b34c-bbf5e198d4e6", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724856990, "uuid": "7614a3ce-a897-44a4-8f33-2cc2e70e444c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724856990, "uuid": "39e4b501-281f-4f43-9d71-4bd084639f20", "value": "Purchase Order.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6eb6206-6591-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724886279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886279, "uuid": "f4fbab6c-2fb1-4d64-bb87-86b6b3d88e66", "comment": "Malware payload", "value": "4ed09e048949521321f0369d2e908971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886279, "uuid": "621757f8-b596-49fb-8194-88246eefcf30", "comment": "Malware payload", "value": "fd4381ca3c61af07fce01917ddb0aeee9d848ee0f5b7a4471bcea08ef89efa8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886279, "uuid": "bdd8ae18-32c6-4a83-af37-da5da0d19c55", "comment": "Malware payload", "value": "cde6f4133e6912f1eb982f010bb49ab6219831c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724886279, "uuid": "d8aabbab-4c8e-439a-bede-5dd2a79143f9", "comment": "Malware payload", "value": "4d60afdcae84a945ad42140a6ab56e238dc62cc1e225e1989249cb273ce62287c84c48e264bee3c41b324f305f63bfdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886279, "uuid": "a6a07dcd-9004-4e58-9972-3167f96298bf", "value": "T10A45CF027391D062FFAB92334B5AF6514BBC69260123E61F13A81D7DBE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886279, "uuid": "a1aaab0c-f726-469e-af05-70f605d0686a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886279, "uuid": "a2a194a4-88b3-42e2-bfb4-983f4e1b2b43", "value": "24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aKxd+a5vnOoZCV:oTvC/MTQYxsWR7aKGKndC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724886279, "uuid": "b8033efb-82c2-4404-bce1-19dabb988b0e", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724886279, "uuid": "785913f2-79c4-426d-93a6-dd537e21ac2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724886279, "uuid": "66d522d2-f525-4398-b5c6-ca36b7f1a303", "value": "z55enyioma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5527960-655e-11ef-b7c0-42010a9c0002", "comment": "Malware payload (RedLineStealer)", "timestamp": 1724864291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864291, "uuid": "48777854-3938-467c-b3b5-0deeee8c7bc6", "comment": "Malware payload (RedLineStealer)", "value": "afed25699b68eb6b0d7fa7fa382c55b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864291, "uuid": "ab2b49b7-692d-4d66-9651-46fae1d56932", "comment": "Malware payload (RedLineStealer)", "value": "fd7f353f2d972a7e3bdb396a66297c190407d117074b8f4945c0190c06e69c3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864291, "uuid": "ff1a7d90-960f-4a45-93ee-bd5a1edf2fbc", "comment": "Malware payload (RedLineStealer)", "value": "9ee32ce1d7dab57f66aec3f5443738aa49eb9c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724864291, "uuid": "64bd0a1b-69c5-4214-9c63-5bc4cab376d9", "comment": "Malware payload (RedLineStealer)", "value": "95572401f07aa23b76de701950f30136eb1c086f45d68583526b385ec5959a380ee7d4804f7eca3468461d91493d3bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864291, "uuid": "78d3341b-7ffe-487c-bf0f-e92cfa652a05", "value": "T10025121130C1D233C4B691B445D7CA7A9F743126477A52E777AD2BBA6E203E2A3742CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864291, "uuid": "6353cc74-df82-415c-8ff2-ed8da54897fc", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864291, "uuid": "bcfe847b-ca1a-4dc4-bb5e-6684f6dc3b91", "value": "24576:8k70TrcWU/AG8VM6Lnjpzv71x13LzCwd2nAYJ5RErUkSVtUt7+DH:8kQTAWU18+wjp1xVL2/nIwkSVy5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724864291, "uuid": "b15e3850-d9be-479e-abe0-7f979cc15b36", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724864291, "uuid": "a19a26a7-98bd-4cdb-88f4-da2601c3e991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724864291, "uuid": "ae281762-40c7-4cbd-bab5-3168464eab7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32bab17-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822626, "uuid": "b2f6db14-dfb9-4808-a0aa-b8769a9b1845", "comment": "Malware payload (Mirai)", "value": "8466f3889ba112753e6c0728453eb225", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822626, "uuid": "32703bd9-b99b-4509-a345-7fa9f1b96c19", "comment": "Malware payload (Mirai)", "value": "fe6781c6f27c596a8f07793e7937ea5759d38ddafb864d58156026f7df5a5cb4", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822626, "uuid": "6e1911c8-ad08-41af-b7a8-bc950999fd36", "comment": "Malware payload (Mirai)", "value": "10096a4f7500363e239f70c898c15360ab5c38bb", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822626, "uuid": "2f03cfc1-5fe7-44e5-9f2c-f9809600bf10", "comment": "Malware payload (Mirai)", "value": "543020b5127a1dfbb21b7290ba302bea3080844580397a5379f8bf8c5d196801da2ab88b3df592a333210530da60185a", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822626, "uuid": "2e5e2eaa-cb79-414c-a707-93611b18d854", "value": "T1ED04855E2A228FBDF268833047B75A25975D63D617E1D684E2ACC1105F3039E681FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822626, "uuid": "e5b4411f-8b01-486a-8382-8210419a0aa4", "value": "1536:SThsEbmcV6kXVAkUUBM8eRwhC1of+LnQyV1r4DzGFpDs1UM+EwlWj8utKAHbsf9t:6n6oVAkRiAE/r43shsSZm7KA7zVakk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822626, "uuid": "93f0ea58-81ba-444c-b3c0-5ede772d08d8", "value": 176976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822626, "uuid": "382edf1f-af4f-4610-9944-8057fb041037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822626, "uuid": "255182fe-e2eb-4960-b61b-f210d25fd2f0", "value": "criptonize.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149ada26-653c-11ef-b7c0-42010a9c0002", "comment": "Malware payload (MarsStealer)", "timestamp": 1724849418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724849418, "uuid": "fe171cfb-e337-42d8-bc24-0b495864d044", "comment": "Malware payload (MarsStealer)", "value": "c7aa36a7e6078d5a76f9ec56d46a8e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724849418, "uuid": "886b973d-7b2f-4d90-9294-83117f3eb61a", "comment": "Malware payload (MarsStealer)", "value": "ff3e0c21df251321b185964109585b307ccc4e411d5d9d4c60d6d5c19f60defa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724849418, "uuid": "612e8ec0-3d77-4adf-99fa-9746ea3026aa", "comment": "Malware payload (MarsStealer)", "value": "59aa71bfdd5fdfb534c386c026334d87144efc93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724849418, "uuid": "d06810b5-12f5-48a9-a9be-46c72f4f0aea", "comment": "Malware payload (MarsStealer)", "value": "6884eac1c846eff69ec778aef04e6ff957d90f3067008cc98690fb9053d5d8bafb79f0dfbf776176fd5cfdb7f51eb586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724849418, "uuid": "ab3cff99-0cd4-495d-8f79-344f6d11dcbe", "value": "T14585332935E294D5E3DC9FB7D20E4964E1D0E3F280BD11DE3B4B8879912FCA1D8A1267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724849418, "uuid": "f1226b46-7ddc-46fb-b204-8da18c4a563e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724849418, "uuid": "db644e50-e758-4d01-9a55-0c9dd71af97f", "value": "24576:7zM+M6yha9IU06XHt0EZBdEIH2E7w0evgRP9dbMZLC/ZA1uWwA6r13ZjGRAS2Le4:7wh8IUbXN0E7dEIH23PEzrFA6r1AA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724849418, "uuid": "3f5ba94b-1f2c-458a-8f75-3de16dbfab50", "value": 1858048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724849418, "uuid": "71c94ebc-6267-4148-88e0-53ef158e8b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724849418, "uuid": "f39a392b-9618-4503-aa26-1c8a60932ef1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab0e3a8-6501-11ef-b7c0-42010a9c0002", "comment": "Malware payload (AgentTesla)", "timestamp": 1724824411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824411, "uuid": "64c7e5e4-6cf4-4bcf-a9fc-e5d5c55345ad", "comment": "Malware payload (AgentTesla)", "value": "c11de0f345b1700dbfe6dc9f9b09e33f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824411, "uuid": "82417d99-6a9c-44c9-9636-d89b64d30117", "comment": "Malware payload (AgentTesla)", "value": "ff487e2ea6195cc78c6c3f1d9d23aae0902eec37964143cf85cd425252a0072b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824411, "uuid": "3772841a-fbd2-4c02-a28a-8e33a8ffa950", "comment": "Malware payload (AgentTesla)", "value": "1816d6d91fecf2522c23fd5244195305cfd63a72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724824411, "uuid": "fd33f89f-6746-40cf-96dd-1390e7039286", "comment": "Malware payload (AgentTesla)", "value": "cc47e243a942852c7fbf233c5d0f52f322a9cfe32c8a0789dc627e57d654ed617b5549d2c7504c99e093f1021336dc2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824411, "uuid": "a47b498c-3c63-44f4-94f7-3f367b88cd96", "value": "T1F9E423F6BAFDEC5BC13904F6D12655095AE2C50D7C82E94F18D10D888AA3FD480A779F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824411, "uuid": "5eeade00-8bd1-4911-b52b-3616f923af48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824411, "uuid": "cdf4ebce-c6d9-4dc8-8335-929679fecf96", "value": "12288:MHfPo81EJOA/++djTruJLFeRzccQRbomwaYuEhIdz0xeggFGM6Q5auK:X84jTrutFexcU6EhewxldMb5au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724824411, "uuid": "aa3a7e97-cba3-4223-96db-2ce59269815e", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724824411, "uuid": "d2734cc9-1079-4547-8261-c015b57a1025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724824411, "uuid": "f2093d78-043a-4981-93b4-54f0564154cc", "value": "Port Agency Appointment - VELOS ONYX.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358d3c43-64fd-11ef-b7c0-42010a9c0002", "comment": "Malware payload (Mirai)", "timestamp": 1724822415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822415, "uuid": "8cf9694d-aebf-472c-a28a-8abf6636894f", "comment": "Malware payload (Mirai)", "value": "4406afb443b3fef36e392811e2a5ff20", "object_relation": "md5", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822415, "uuid": "f7f0f519-2ada-4d81-b69f-412e19f1f7d3", "comment": "Malware payload (Mirai)", "value": "ff490ebd482a16f20517cec22d22b1400ad3824f5fd925dac4af8750b856a5e4", "object_relation": "sha256", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822415, "uuid": "d1bd5768-e91a-4335-9f8f-b78d8abf2dfe", "comment": "Malware payload (Mirai)", "value": "47bc5a3889bd590ee08415fe41c4a9c3313554ff", "object_relation": "sha1", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724822415, "uuid": "5f178047-7e5f-4bca-8398-f601d527c80c", "comment": "Malware payload (Mirai)", "value": "8de80991fe4d01b5bcaf57a0f66abd1fcd564ca58b5dd3af817b9de90f0bb41ab6744480b6741f3a5b39e11be264a994", "object_relation": "sha3-384", "Tag": [ { "name": "criptonize", "colour": "#374541", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822415, "uuid": "2ba9357d-aefd-4fed-bec0-716d63c67a6f", "value": "T1B7936DC5EA93D2F9EC4708F900A7B73B7B30EE2250A4C943E7583DAAED13950591D35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822415, "uuid": "f45123fd-84a2-4749-850d-2bd1cf8214e2", "value": "1536:L5W52Fs8gFukf7S/R/oa7+5PS9DAQ1r4E6yKokFF2a7RSJZHQeOHC:NH7gF9zsTSBS9DuoKdFF2xPH0HC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724822415, "uuid": "e066eced-e409-4b22-9237-d5f131a2d392", "value": 92684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724822415, "uuid": "49422223-5d0d-4f57-9fcb-6fd32b5cf9eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724822415, "uuid": "daa89ae3-3771-4443-a44b-426ad30e4231", "value": "criptonize.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5f8d55-6564-11ef-b7c0-42010a9c0002", "comment": "Malware payload", "timestamp": 1724866957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866957, "uuid": "73fb01ee-1699-40e5-8e19-646c9072f919", "comment": "Malware payload", "value": "b96cd71256079936fd91f14257b98a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866957, "uuid": "92cd0853-8dee-406f-9447-a6521d54c1be", "comment": "Malware payload", "value": "ffadb77310871371825f5025eb38a69348e521df09fa1169e65fb0b38fe377da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866957, "uuid": "fef9fe0f-ae2e-4139-a59d-b8d235c7f84a", "comment": "Malware payload", "value": "5a8567f7f0b001d03f1d07dff0ee4ee14dd010ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1724866957, "uuid": "0fe6eb3f-926e-4e1d-b1a8-1d16a4413802", "comment": "Malware payload", "value": "75e6e3cf6d4e95375148eb4f8b505f1c7faa1e0ce7f72d0c1304728eb11f86d0345451d3cb4b4b9c94764fe918cf5a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866957, "uuid": "719bcebb-eabe-4988-b193-999ca6cc3fd4", "value": "T112073945FECB49F5E94398325457B22F6334AD058B25CBCBEB547F2AF837291093224A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866957, "uuid": "6758e798-e061-46a2-884b-0d902cee3a98", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866957, "uuid": "6b7161f6-0554-4a98-9d2a-210cdb7c67f4", "value": "98304:/nV1w5RUwrcvomByUQBdmFQ6QnxIIC8LSlHbtLcUl441uzTRgjw/q3I2QscE+9FZ:3M4/In6Q48WB441CTRgjwKQXyPl4hPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1724866957, "uuid": "befed5ca-3514-480d-b1fa-29b5c6a9ce9f", "value": 16939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1724866957, "uuid": "bbcb6a8f-299f-47f4-bb47-58172ed5c719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1724866957, "uuid": "f9f982c8-d9f1-4011-94f5-a59b07f467b7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }