{ "Event": { "published": true, "date": "2023-11-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-12", "timestamp": 1699833781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "798ecbdf-c57f-44d0-891f-0f724f7b01c1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7adb85-815d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699794951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794951, "uuid": "6516fd1f-8127-4f14-92e8-bc064f765cdd", "comment": "Malware payload", "value": "aea92f195e214e79c32a3d62fd79ca2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794951, "uuid": "606aa238-b200-4f00-8589-426dc1993c2e", "comment": "Malware payload", "value": "01a0842398ccd02d4ad01329e5d96c209b067cc31f93aa38b17a25e7cde8f07c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794951, "uuid": "8fa6e4ac-4c81-467b-b34e-def135069cbf", "comment": "Malware payload", "value": "8f22fbf26974a481579fb7169868e832e60d28b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794951, "uuid": "889ffe64-6c52-43f3-9723-e7ffca99508f", "comment": "Malware payload", "value": "a0a424a829a295c444d85ff146652800b49874d8b98b59db90ced594b221252aa7b8a317b92bb455be9b268fdf73260a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794951, "uuid": "cf97abaf-aed6-4b05-88ce-9f77557866e7", "value": "T198C52300B241DC42DDB906F41C6AE2BA50743FBB641EB56337817AFE2AF2E31954F256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794951, "uuid": "91e5378d-67af-485d-a721-4f9c61632507", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794951, "uuid": "fc6f785a-02d4-448b-b25e-34c0ef3532f2", "value": "49152:Cl2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsS:CzzX71oDCRAZUviAHImDqia7hsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699794951, "uuid": "2711d3f6-b15a-4a83-8f6d-87289cabedb2", "value": 2671901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699794951, "uuid": "504ca35d-a21a-46e7-b30b-513265cf2bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794951, "uuid": "3c34ecc9-53c3-49b4-b795-c91394ec6153", "value": "aea92f195e214e79c32a3d62fd79ca2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9599af5-8150-11ee-8907-42010a9c0042", "comment": "Malware payload (Babuk)", "timestamp": 1699789527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789527, "uuid": "a0169af8-36da-4165-a1c8-16e198ade5e9", "comment": "Malware payload (Babuk)", "value": "c82121875584b5607f9d8a9c5c10889a", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789527, "uuid": "b2a6c159-4d6f-4e23-a71a-36b0d544fab2", "comment": "Malware payload (Babuk)", "value": "01d4ced698c9826e5879e235a74bab2b794e85df04b3c693345ef1925a20aeb9", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789527, "uuid": "79cc6f59-83cc-4185-a8f2-277bf3ccb31c", "comment": "Malware payload (Babuk)", "value": "4bc0ed52931c44261aa1d40c42d01255427c683b", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789527, "uuid": "1d2b0b18-2165-413f-b84b-345fe2b3103d", "comment": "Malware payload (Babuk)", "value": "87aa42526069b9446fa41affe3962ff22af8fb9a637084b46fec5579b2aec2df66b824e72bc3a9a940fdca2e2f95f204", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789527, "uuid": "49cb13dd-caf9-46b5-9617-1e998d484931", "value": "T138263B8228DF0D9AEDC13BB861C3632A677CBE61CF6B4F27A60841355D532C57D2AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789527, "uuid": "46e80583-f6fb-446a-a87b-4a7de2420363", "value": "daded6775a8b352b79134b7639b1b4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789527, "uuid": "85d3cf98-f149-4dc4-9642-af50eab994e9", "value": "98304:8PXlkUBvBfVFKea3IxoSLdtOUHu345hsMXWruBhW2:8PyUB9G7YxLdtOUHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699789527, "uuid": "bf921c6e-3476-4a32-a460-29c02d2c4ee0", "value": 4777351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699789527, "uuid": "a8c0f28c-72f1-4fd2-aaff-cac7c702d0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789527, "uuid": "8d1876f8-5408-42d2-8a16-c81e7c522a20", "value": "4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb225d8b-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795436, "uuid": "3f639e06-a205-4457-89a6-ae046e5f92be", "comment": "Malware payload", "value": "9c0aade50e42f696258c6a26fcf44b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795436, "uuid": "d065122d-8a02-4d78-911c-a7fea864d929", "comment": "Malware payload", "value": "02451442070347dc5eabb568d97a3e29cfa25c6c0244908c643f6b441609c036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795436, "uuid": "d34d8650-466c-4fb0-a6ca-2ba934d0a698", "comment": "Malware payload", "value": "0ed93e5821f1c5be6dc6c8f40ce514bd89634351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795436, "uuid": "16928890-fa91-4d1e-a262-02c59ca70428", "comment": "Malware payload", "value": "d760e8b10fac09b8b143c6da0a5a425f9ca10b42fc8dc86ac3113e3caa16b9c8f41aba2449ede80e36956874a15b6786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795436, "uuid": "fb84c98e-9856-4250-894d-92ae58454300", "value": "T1256523A5DA827C5FDD7241F138EFB6335025329FF2482A4656AF9460E72BF0EDB10612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795436, "uuid": "16eca2dd-57f2-483b-b9c8-c08ef5914efd", "value": "f11f9d43992b002b8d32d99190434e0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795436, "uuid": "c3200d08-a962-4a9f-a87e-37260f7c6a9f", "value": "24576:z3josqCvcFVnqxSN8Z0is2v+f7nUQo8obqRRu0jzv9VvB9:Yfvzv8Za2v2nUQOY00/lVvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795436, "uuid": "b40093b3-292b-479a-a4c0-4f434e261e19", "value": 1508688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795436, "uuid": "8b9fce2d-bb09-478c-b805-36c34db392bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795436, "uuid": "7607925d-6491-4fb0-b28c-463ca253a9aa", "value": "SecuriteInfo.com.Trojan.Packed.Heur.CjWaoWnmbWeae.7962.7616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecbbd6c-8136-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699777967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777967, "uuid": "df2a3c3b-1c0e-40e7-b232-bcf217ef9121", "comment": "Malware payload (Formbook)", "value": "3eb312ed06adfc13fcbe32e87050f059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777967, "uuid": "f3cf9ed2-8725-4aa7-a67d-f9288aefc21d", "comment": "Malware payload (Formbook)", "value": "0322ac069d3777358bf3ccb0af596a20dcaa1d0888dcea9e043dd969eae4bc3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777967, "uuid": "ce3881fa-62ca-4322-94ee-9388af0458a9", "comment": "Malware payload (Formbook)", "value": "ee88876b0d1327cf142bd8d84959bf8bda1ff173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777967, "uuid": "734e032e-f283-48a2-8f96-0e8a2a5a602e", "comment": "Malware payload (Formbook)", "value": "084ed36b8afb8d369ec66729cee9e57990698d31eded5209977d9247417e799ed75a1992165feba0138c407ecfbf9538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777967, "uuid": "fe587600-5c29-487e-9114-f187e0cda6f7", "value": "T168F4CF4DA3544293F1182F74CA6E3E1552701C3C3882E7D8FAA9765BEDEABB6143311B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777967, "uuid": "f8b9eb09-439b-44f3-a8c8-f553a514f26e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777967, "uuid": "2764a9cf-7dbc-4d21-a38d-1ff9d05f6765", "value": "12288:LPU7s9FwN2FU7FxtA46mmFDwj2opzfHNy6ItEPZbwzAzeHlT:DU7s9F3KdbQJw5zHUjEh8zOeHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777967, "uuid": "84491010-77e4-4310-856f-0d1ee77c6e31", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777967, "uuid": "d9662983-a26c-4b12-a787-46156b57ada5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777967, "uuid": "f0502640-f5b1-4142-90ab-15692f0045bf", "value": "Confirmation receipt PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1fe141-815d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699794981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794981, "uuid": "d29fce6b-d510-4748-96e7-c003445265f0", "comment": "Malware payload", "value": "c01872a66c8322a1fd69cc176ed27ed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794981, "uuid": "04a5ada1-f646-461f-ac3f-92beb8484bb5", "comment": "Malware payload", "value": "032f26f7c71b4708ef64690328fc415c97a5a7a28c4f21ce1211516b18a50014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794981, "uuid": "3d2fb1e0-3167-4579-bfb1-019d122b866c", "comment": "Malware payload", "value": "2e6c3373babd7322d68a5b41dc1688053e56fbbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794981, "uuid": "a403c851-d513-486d-8e83-d7177448a767", "comment": "Malware payload", "value": "972a0a6297ba86e6f42b30333499f5885d30552e5714bb4a1382ca361c5fefb510b7b12176e96a1619e6efa70a91cb52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794981, "uuid": "d3154857-6d9b-48f0-ad6b-86bc05449206", "value": "T144363303366704CBEC8C9C739A133DA53AF551D28355ACB9E1F6ACC85C896DCAB0AC35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794981, "uuid": "b5701651-1b33-4d6a-85e4-77d0d96d2f21", "value": "98304:JhiiVwdU6VIYNYrYgkBYd4qBT9ZfvLxyGlacsXpZjQY3clsime:7Z2203czkB24qBHfvLVlahXDZ3clsi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699794981, "uuid": "74eca0d7-df73-4329-b2b3-e59e753f52d3", "value": 5334661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699794981, "uuid": "6791ddca-e7d0-4af7-971f-ba23ec301dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794981, "uuid": "a879f60e-71af-4242-9f77-56e513a4806d", "value": "c01872a66c8322a1fd69cc176ed27ed4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d3e558-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795427, "uuid": "23565a8c-9da3-4573-b695-d3cfc0aa3771", "comment": "Malware payload", "value": "de01ddb06fbeca815cf11394b3eee74f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795427, "uuid": "1d925075-79d4-400c-8fdb-9491b278f076", "comment": "Malware payload", "value": "05003d3663b1d2452d71c25e75a4b58bb13ee0ac0119a0461767637516a8d945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795427, "uuid": "617ed1dc-c335-4637-b154-2d14d8ae1369", "comment": "Malware payload", "value": "997690d813af3004b15f2c3819efaf8e4ee0adec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795427, "uuid": "2081da4d-933d-4841-bd54-0264c10833e7", "comment": "Malware payload", "value": "dbf2b3259cc7f89751a14a8eaf32ec58d93a4f260f2ca3ff52181a2d684eb06eae5174b07b98c6d8934fa97985c89924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795427, "uuid": "95a1c9e9-18b3-4f29-83c3-ca0a09658348", "value": "T166452836B1414832D567F53B4A17BD9D8425BED7CDEC245A2BBC7D082D30E42AE21EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795427, "uuid": "ed5efe70-7076-43ca-b843-32ca70ac4b37", "value": "24576:PPDsLRcMxDG+xHdhHcqnkbm83Ukn1DVy:PP8OMogHLkF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795427, "uuid": "335d194a-2957-4a63-baa4-8c0d907da061", "value": 1217536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795427, "uuid": "83a40278-1f4d-4e3f-a948-eb1c6825b309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795427, "uuid": "9fb28cef-0c78-4495-be36-f34234635832", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.5775.9530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68af940-811e-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699768048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768048, "uuid": "e612db58-d623-40c6-80ea-8e44750b8924", "comment": "Malware payload (LummaStealer)", "value": "4bb2473f19d24fbd573a45050f59ea62", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768048, "uuid": "e5943bb0-702e-4327-8414-78fb7b695e9d", "comment": "Malware payload (LummaStealer)", "value": "064c16bb2715e8f8713605c4ffc75962302cf0c8a7b06dbac92b40a05f1dd3bf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768048, "uuid": "a879675b-51ab-443f-b742-c2a3fe8a2493", "comment": "Malware payload (LummaStealer)", "value": "32cc57c1f1f0716e810b9dfdf101dddc02faeb0b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768048, "uuid": "8b2f10cc-06bf-428b-957d-c9cfd6865285", "comment": "Malware payload (LummaStealer)", "value": "813372cea7230cfe92fd7daec855600b99a89fa7843844c01dcc53fd2d7dd649e6ec63e45ce5974864c65170f80641aa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768048, "uuid": "b660185d-930e-4256-a33d-3f7ec12b9626", "value": "T1C2F63A87F89054E4C0A9D3718A665263BA703C885F3027D72A54FFB82F36BD46E7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768048, "uuid": "2de71b1b-7d42-483f-be10-77cb0ee1c02d", "value": "b2e121c8fb86c781c89c83ffff7fe337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768048, "uuid": "01c5aa9b-1335-454d-80dc-5381827b4ff4", "value": "98304:1v6XUnPDZu6ojtmGucdHMYZ/oc4EFsdPboW8htlveB:1Cku64UGusZ/ogulU5f5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699768048, "uuid": "0a6d172f-a93e-4a86-9dde-f440a47ee5f3", "value": 16265729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699768048, "uuid": "61816712-39e7-4371-b2b6-dc13281628c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768048, "uuid": "29c07d95-12ec-4147-b740-d0fd825a5a61", "value": "4bb2473f19d24fbd573a45050f59ea62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c036d8-8139-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699779339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779339, "uuid": "461f2a45-4fee-4bc9-94c1-19bad3d139eb", "comment": "Malware payload (Smoke Loader)", "value": "81e316aa4ad2b21b86ee294b728f6feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779339, "uuid": "5abfce64-d488-4833-96de-5cd6385e94e2", "comment": "Malware payload (Smoke Loader)", "value": "099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779339, "uuid": "b64e6b09-3c7a-4187-87d8-1a1836e21910", "comment": "Malware payload (Smoke Loader)", "value": "b1c88a94cb2f11d5ca19c25d73a5d811a523ad92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779339, "uuid": "dab8cffa-6321-446d-9803-a98d57eab09d", "comment": "Malware payload (Smoke Loader)", "value": "35b7bdc63983e04407db0e5b062fd1d76a7f136730fb8cda87cc1cd35d603b7fc8fcdccbb92b2bf1c8ad9ff972293eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779339, "uuid": "9135331d-6a1d-49e5-9f4d-1fc98cfc4729", "value": "T13C652343DADA94B3E8F0073155F70A870E797E306D3E922F5628A8079C72D95683277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779339, "uuid": "e449676d-75f4-4756-8fe6-509e4a45c221", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779339, "uuid": "dacda23b-013c-4193-a7df-e599b7bf310d", "value": "24576:yyW03Kg4GLQvrveaIsXxYGmy1DMWKnc4TJyfsd76yfNARB9kSgrit/lK:ZWDgL+Dehq6GnIJTkfsh6yfNAf0iRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779339, "uuid": "51e95440-86b6-43f1-92be-22ec547d71be", "value": 1478144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779339, "uuid": "85481f8d-2d6a-4638-b1f0-a5fdabd2369f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779339, "uuid": "53389a3a-7862-4c3c-a080-16e9d3cd7eb0", "value": "81e316aa4ad2b21b86ee294b728f6feb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4f030d-817e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699808891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808891, "uuid": "ef7c03d7-e1c4-419e-ba67-f2df9505f5b9", "comment": "Malware payload (AgentTesla)", "value": "91e62b82d7cf4103ca046ac65bdc29f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808891, "uuid": "72fa4199-31d2-48a5-bbcd-839a000028fd", "comment": "Malware payload (AgentTesla)", "value": "0b3eb1b7ea815537f5af003389ee217f6c6462c28de2ef46a806dddb80d8cea2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808891, "uuid": "6a7905d5-e850-4d21-b9b8-0004f93a9444", "comment": "Malware payload (AgentTesla)", "value": "af9a1bb81e6650035cc929ba86f46bb684096a08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808891, "uuid": "664145eb-1eaf-45b3-80b2-6c1baec4e025", "comment": "Malware payload (AgentTesla)", "value": "94e98f74cc329d67a2a5ded7d2df8e105e40c995cd56f41f79640bdfbbb318eed779255a0633bea5855e36ceadf91987", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808891, "uuid": "09b5af33-132b-453e-99e6-37feae78aa7f", "value": "T1E7D42328A1BCC316D99D8FB32A10A9481F32B2631635DF8D9C8B51CE2D37F452356B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808891, "uuid": "f42fc052-71a1-417f-b3d5-eacfcf0a5621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808891, "uuid": "d5f542d6-7212-436c-8087-6a4feed90a97", "value": "12288:uR04an5Hc2L13lYdt3nHUpmhDgQXcqqpVs:cFQ5jhqdZUpmaUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808891, "uuid": "b8e1dd71-56a4-4992-94e0-42bea3f5767e", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808891, "uuid": "9e2cc588-147f-442c-a54e-516f181f7b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808891, "uuid": "8c0d3356-4523-44cf-a7eb-a53fe86edee8", "value": "91e62b82d7cf4103ca046ac65bdc29f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa952b6-8154-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1699791068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699791068, "uuid": "a44c7527-bfb0-4d48-af83-8b4bafc6a8ba", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a98cb1aef56d5c245e2c91d7db7b555c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699791068, "uuid": "21eb74f9-7413-44f8-a845-5640e28becee", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0d27d9acd1f0a0664f77f75b3d1080d40f8a04fdf1fcb2661a5778e184470814", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699791068, "uuid": "c3a3fd2c-2b93-4812-917c-f162f355ddf6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f977b5f07703f3541bf09ccdbfce738e3241672e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699791068, "uuid": "e137b127-577f-4f42-b6ea-f494d4ff193e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d2aadc99facc4299f666bceb85d29b70a48d7ba0b50cdd37771ce9f819d04ef375e10da56292bfeb859b270a7d0e5f80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699791068, "uuid": "f8326232-bfe6-4c75-a13b-6f9715269b40", "value": "T15E563358FC8E9CF9C8172831590E8A72910B7F602C5D795C3DBD664EEE3C9A0847CB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699791068, "uuid": "bce141a0-18af-40df-b81b-ed47a25ba2b1", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699791068, "uuid": "19ec7e3f-e777-45d3-8f4c-9260dcc40348", "value": "98304:qiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:/Rm1syxacY48eda2TMpQdZ9nc+fyhNjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699791068, "uuid": "053d1b73-df6e-45e5-888f-b996f58d637a", "value": 5900637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699791068, "uuid": "19929b60-f817-4619-a5ff-69260d7e573b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699791068, "uuid": "7741499d-783e-40b1-85d4-426619a37d9a", "value": "a98cb1aef56d5c245e2c91d7db7b555c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2795bc21-8164-11ee-8907-42010a9c0042", "comment": "Malware payload (TrickBot)", "timestamp": 1699797765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699797765, "uuid": "32b332fd-0b62-4e53-9d2f-88c3ebff99f5", "comment": "Malware payload (TrickBot)", "value": "aeb08b0651bc8a13dcf5e5f6c0d482f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699797765, "uuid": "09d015a9-ba9d-4e3c-97f8-421b14d574b3", "comment": "Malware payload (TrickBot)", "value": "0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699797765, "uuid": "2f02300d-0dca-4747-b50e-3ba2532b4470", "comment": "Malware payload (TrickBot)", "value": "bd5806791f86cda3a36c1c030a0e6e5da380e0d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699797765, "uuid": "a623426a-19e7-42c1-8fad-48c97f571617", "comment": "Malware payload (TrickBot)", "value": "d6441b6b4b3457ad30945eeffd769c525b855888e08a10bbf84da5ef2b57577a2cd2bafe1d7c9afe72c53f54b76bdecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699797765, "uuid": "9c73074b-c04b-4946-aa1f-484381b0c218", "value": "T100B2F61233F94450E2B686B9DEB3CA33DA7135C52839DA2F02A4C5592FF1612ED28F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699797765, "uuid": "819e7286-1f72-4609-809e-1c4594c671ce", "value": "516e12c64fd0a1d4eb25fccd60d4295e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699797765, "uuid": "371dd65f-378d-4857-8182-6e53f528d07e", "value": "384:9gNoyO3N8MPYmvRsnfdil5SyJ5b0lrEhj8JbTv6DUA86:9gNoyyY/fdEP0t0QTTB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699797765, "uuid": "681a6e08-cb31-4db7-869e-a904b4c9eea5", "value": 24200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699797765, "uuid": "df376ac7-bdae-4672-bb33-47cc1cb1700b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699797765, "uuid": "669bd5f5-fa91-43cd-9f98-bb9aa72deea7", "value": "network64Dll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefe0eeb-816f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699802770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699802770, "uuid": "a0d724ac-8db8-4823-b759-98a2920ede26", "comment": "Malware payload", "value": "15555fce221e352b1b7fc7680a6c8b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699802770, "uuid": "452ed342-e20b-429c-abad-58fba6c7ef36", "comment": "Malware payload", "value": "0e215db250b307a7eb0217189c1de5d55495d4f7fc6f607501a7a0c7f6cc123b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699802770, "uuid": "c830123a-5563-40b5-b177-2b9d5d31a3ff", "comment": "Malware payload", "value": "b1b5c8a67a002acfea63c9601fd876b775dbbaeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699802770, "uuid": "3a2296fc-0e28-49f2-b9cb-9d1f79458e3f", "comment": "Malware payload", "value": "d1713e6f550f116eb468fee65cfef9c53a3fcdea1a49df5164de0f7647e57bd11da2d67d21f720d1a10cd11789a19074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IDAT loader", "colour": "#23D030", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699802770, "uuid": "4bbf0dbd-e392-4ae7-be3e-ae42d07d6913", "value": "T19A346B12E704D075D96321B58676FF3A5D2DAD60530222CBA3E0ADAB7B615C0FD3872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699802770, "uuid": "251a7b25-e005-4ad9-82d7-c6e6d181747a", "value": "392b4d61b1d1dadc1f06444df258188a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699802770, "uuid": "04adb49b-9ff4-4260-a862-0741a74b76a6", "value": "6144:i4VU52dn+OAdUV0RzC+720AqqUtmtime:i4K2B+Ob2V7NAXIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699802770, "uuid": "ee7d647d-a2d5-40ad-b33c-7328d9de9c2d", "value": 236563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699802770, "uuid": "2218e317-9062-4345-b1d6-ee40f5b0668d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699802770, "uuid": "1aff204a-c7df-41d1-a621-12fd150c695e", "value": "0e215db250b307a7eb0217189c1de5d55495d4f7fc6f607501a7a0c7f6cc123b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f19565d-8139-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699779336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779336, "uuid": "dd18f24a-9397-4183-80de-76368dab01e4", "comment": "Malware payload", "value": "b076e67bd14cd772f82e0e0ceb3bca34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779336, "uuid": "60825ca4-9083-4c3a-a9ea-e7b49aade44e", "comment": "Malware payload", "value": "0e3753e23d5505b008170e9af87a573aae3f7bee92cc7dfcca75651ed33e88b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779336, "uuid": "1ed101a1-c06d-4a2d-9661-c1e9f001d570", "comment": "Malware payload", "value": "ce8c7efb9c35380380946b100d4481014c38c6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779336, "uuid": "dfed7664-4a8b-4efc-b655-907903789038", "comment": "Malware payload", "value": "ff7754d9bf2b5ad8c6fb27e2e613cb676181c76c5f269b9bc4636a32fef03fc70c294b8c354df5249a0e28454c4026ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779336, "uuid": "b34c4729-3e05-4e11-a8da-a1b71ec21706", "value": "T15156338421900FE9FDB2943ED482A645EB65B8B95760CAD70FE4D6621F3B7B04E3B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779336, "uuid": "edc01bba-53e6-4c7c-a535-1823788de67f", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779336, "uuid": "ab270cf9-c559-48df-86bd-339d05f446e9", "value": "98304:tsdays9cLExPjuuf8VPR0XD5dCmrWLs+0MqK6LH7XENhfFT+72uW5MI0mj:tsdays9cA4YYR0XD50mr2puHUHNTdL2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779336, "uuid": "76fc2347-3848-42d6-832b-f2c3b58391fb", "value": 6084190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779336, "uuid": "547ca335-e0c5-4637-be2c-553298a614e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779336, "uuid": "7b209d36-d5b8-414a-8151-17150b016681", "value": "b076e67bd14cd772f82e0e0ceb3bca34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fa0a95-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822722, "uuid": "0893c541-5439-4f94-acbd-935b761d46f0", "comment": "Malware payload", "value": "29db43fdcfb3023a6b783e7cb6283cca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822722, "uuid": "e98b6987-64c7-4c77-8111-d734afae11bd", "comment": "Malware payload", "value": "0e663685983364ca515359b1a0e866cd2d8a022791498cfc2dad502cdb911c22", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822722, "uuid": "9c4581c9-12b5-4d0c-a521-9f2d1936adf8", "comment": "Malware payload", "value": "1efc3e9f455e0713daa5294aeb8ca7605923b485", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822722, "uuid": "38493566-4141-41a3-932d-67f7eb9fe217", "comment": "Malware payload", "value": "aeffb8da74dac2d2672bb69dee70ac1a0ba8f408a67606016bcbb80975ba3217df71ffe58be4da64c9d9fad8f3df2b98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822722, "uuid": "2d906391-95ce-45d8-a87d-30a94c8199e3", "value": "T10D130956F9924E26C2D413BBB67E5A8C3370A3D8C3DFB213DD506B61B98640F0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822722, "uuid": "ab0ca7f7-70b9-4918-b3b8-a07cea749b3f", "value": "768:QFDbU2NvG5lMFv/7mgPaNHA/89aLJumtIRs+PIvotXVMP/O3RKz5wswbZn:b21G5yB7mg0HNEtIR3PIUV8/O35swbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822722, "uuid": "380a4cdd-06c6-4267-a3aa-f608d924016d", "value": 44620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822722, "uuid": "c26b740c-1db2-4f52-8d01-bfd710b6fbce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822722, "uuid": "712560b7-1199-4617-bcb9-7ad13dc05fc3", "value": "skid.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d2e3f7-813b-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699780211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780211, "uuid": "e41aed90-c0ff-4029-8195-dcec6c0f85e7", "comment": "Malware payload (Glupteba)", "value": "326781a332c7040492dc96b13fb126e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780211, "uuid": "3397a084-f6ce-4f7e-a47b-97320ac0a71b", "comment": "Malware payload (Glupteba)", "value": "0f09f8f60741e8b3c28dc927ff1b3318d8faa623d641704b605bc38142f54f28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780211, "uuid": "033bcd63-4ac7-4bd0-8613-5d82502e07f5", "comment": "Malware payload (Glupteba)", "value": "d03d8e89a6c75a14f512eeabf180a2f69d30e884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780211, "uuid": "fd8185d8-75ec-462c-b3b1-9705bbf973e4", "comment": "Malware payload (Glupteba)", "value": "7de7b7ffe563f43ec689424c46d5fbfd3653246db3bc0c4b74ed8164e98c7b6a37c8a110a541e35e3962d0643118c86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780211, "uuid": "c79db095-f4cd-43f4-a379-d8812eb1df91", "value": "T18FE37C0BB2F9A2D4D5F64AF6D97930500371746A2A3DE78D4D04328EF824F4196C7BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780211, "uuid": "c6a125f5-1ab8-4ffb-8769-ae99e77761ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780211, "uuid": "5452e107-02b8-4b2c-8802-cae999ff033e", "value": "3072:Oq+kTdFfyZfJ+xjLkTVXbpL9FCOjrAJDH+9s9uAFfvUC:OkTdZy18JLgXbp9F5bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780211, "uuid": "5a10767c-4e86-4193-ba61-24accddede57", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780211, "uuid": "2228ad74-437e-402d-a33f-1a73f6ca20f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780211, "uuid": "459ac025-4385-462c-b81f-5693be618db4", "value": "326781a332c7040492dc96b13fb126e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a346ad-8119-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699765825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765825, "uuid": "e94b0efe-92a3-44e2-a7cc-4632989ceb79", "comment": "Malware payload (RedLineStealer)", "value": "e1a7f2e76693560acba39c30c44d4c89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765825, "uuid": "cdf8e599-a68e-426f-8f9e-1300df8303d4", "comment": "Malware payload (RedLineStealer)", "value": "0f592a77b60030b75ce1df1312bd60095115a60af6270f07a703932ff2b44a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765825, "uuid": "083d1e38-b9d4-45d8-9d76-232d70438739", "comment": "Malware payload (RedLineStealer)", "value": "b4f516fdffab80098424380feb7f7687bea8872b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765825, "uuid": "fa290e90-8fe7-40b4-a2fc-ba91ab8858b7", "comment": "Malware payload (RedLineStealer)", "value": "936f8658fa1309155ccfd5fc7e3bf9c5c2f0ce9d7c99bd66f9f1a9e551e4de168fc515b8f134fa9c7cf66950a8c6364b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765825, "uuid": "49cd84d7-79d0-4183-88d6-8b22eff81b48", "value": "T162652342B9DE81A3E4AA337148FB03531939BD66DE7C921A7149A8BB8D73F901471327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765825, "uuid": "710fec69-af46-4eae-93d8-708ea4425653", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765825, "uuid": "0af2829e-ce70-467b-88d1-cfb7ecbd99c5", "value": "24576:cyiHZ+xupt39GU6eP37heOIsLEaGsFwDUcfZGl8/K/WLpaFpCdpPx0TT5L9b3Seb:LvUt39BPFeNoTG9/yKK4pajw6d3Bj1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699765825, "uuid": "f80c1e7b-7506-4be7-aa02-9ecea6b945ef", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699765825, "uuid": "251c932f-8bfd-4e4b-9d08-d23534ac7e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765825, "uuid": "dc7a908c-cd30-456c-b9a3-8fe3360d2ccf", "value": "e1a7f2e76693560acba39c30c44d4c89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6556be49-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774246, "uuid": "67b01383-17f7-474e-91a2-88fe262c7054", "comment": "Malware payload (Mirai)", "value": "a7bec5f5dde6e0b39a52ce62d1ba9bff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774246, "uuid": "1ae955a5-8abc-4742-82e5-c34fd5ce8e0a", "comment": "Malware payload (Mirai)", "value": "101ffdb7abd6979db7134c6b3378b5725e979a6d0286ca8e8429ef0734015559", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774246, "uuid": "532aefbf-9411-435e-9da9-608b2f9caa40", "comment": "Malware payload (Mirai)", "value": "8c4aa8e1bb404a9c20de58a7dcf78526b7cae54a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774246, "uuid": "50919901-4c8b-455b-9a9c-3f07a131bcdb", "comment": "Malware payload (Mirai)", "value": "02397c0efdbeaf49c6434159b0a8da13dfffbf012318eba33fcff4bf752cae769f55c2cdc5b08396cd02c02dedde63ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774246, "uuid": "40d8f4a9-3f7c-448a-bbb4-cb9e73061f90", "value": "T18213E792A8926E26C2E0237ABAAE51CD3360B7E8D1DF7217CC111F447BC951F0D6BB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774246, "uuid": "b87fca51-4c14-4991-bc50-aea33f078e86", "value": "768:io5+gbIgiwB/m/prWJA7T6p2EoWGarlBmMH8YQxzmYCtDt4RtrbblUyjHyLPN:i6EgLpm9XWGaBBmTYQxSYCmrbblN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774246, "uuid": "f5b04df9-a09a-4321-8791-86d59a2ba01a", "value": 42252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774246, "uuid": "15f5c501-f83d-42ec-b441-2cec969a54c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774246, "uuid": "3fe13e6d-c38e-4905-ba16-93933071a32f", "value": "a7bec5f5dde6e0b39a52ce62d1ba9bff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05f03bb-817c-11ee-8907-42010a9c0042", "comment": "Malware payload (BlankGrabber)", "timestamp": 1699808383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808383, "uuid": "9ee2f25a-144c-4326-b137-8b7d8bf4a60d", "comment": "Malware payload (BlankGrabber)", "value": "b5d9ec4463780fe7ff0cad5b7e794ec2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808383, "uuid": "125288bf-6788-41f2-83c9-09f866ce9b98", "comment": "Malware payload (BlankGrabber)", "value": "106e7414f8277f8dc4b666bc1ab54e97b0192e677f4823d3fdd265bf1366f870", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808383, "uuid": "6927a7df-7837-41ba-805a-6cd68e78b1ad", "comment": "Malware payload (BlankGrabber)", "value": "69ab8569815e707acc253a3b1fd98f2559a2c7c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808383, "uuid": "e3ccaa10-8e60-4330-86b8-123242d39439", "comment": "Malware payload (BlankGrabber)", "value": "3b1695c316c2d30347840ccc76b89e32eceeb20623fea6e6cb7ab7b7c0ebfeb1861fa3468248686a04b472afd85860a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808383, "uuid": "def7cbb5-2820-4e48-b222-25cbe6f6fa37", "value": "T1FCA633B7C86C07A5EF87E474252C76993AA18D4342ACADC63781736A737258B043CE77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808383, "uuid": "6a0de115-310c-4569-9a6e-dee536b93833", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808383, "uuid": "478863cc-ce26-45b6-a388-55d60a8f5ae2", "value": "196608:UaIWH9FfNGQXC8Txbwpef25Cr0qoS6cQaWSuk4I4dsxZhecCOk4GG:UaIWHxyox8pefsCr0npcQaETszhecCO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808383, "uuid": "86587428-a297-47ec-ae6c-5409c9b2056d", "value": 10137600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808383, "uuid": "49ebdbd3-812a-416a-9fe0-89cec5846b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808383, "uuid": "92adcc8b-28a7-447a-87b8-6dd9f5088329", "value": "b5d9ec4463780fe7ff0cad5b7e794ec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717e6b5a-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774267, "uuid": "25ce987d-6569-4e2c-bf62-5170c5a2ec9f", "comment": "Malware payload (Mirai)", "value": "1433ee43c440f9f2e98a37b782d44a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774267, "uuid": "085c1b7b-94ed-423f-af9f-90072b6cf513", "comment": "Malware payload (Mirai)", "value": "15f9c9454370c8ff289ca803efe77666f94051298c6bb56cafdbddec45753cd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774267, "uuid": "741411a7-f175-4503-a2a7-d68d018b8c1a", "comment": "Malware payload (Mirai)", "value": "6cf485dd35714f4590f4eab448f6ad0e097e7db5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774267, "uuid": "9473f2ea-c75d-47fb-beaa-b05bc8fdb6b8", "comment": "Malware payload (Mirai)", "value": "6f28d3068bf5b9235d0949de67c8b7e79d687f75bfc10e0c6ec06139498e8180c5306159d4d07efa06a24c6c98df4a3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774267, "uuid": "6cd47b34-8a0f-4a4e-bb15-336da530f876", "value": "T180231996F4019D3CF95FE7BF84134908FA21775160A30B2A57ABFD936C721A89E13D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774267, "uuid": "cd4ce4d3-bcbf-492f-9f16-b01e912c7e84", "value": "768:kaPiKOKCJyo7gtJnfTrYNmXrX7cCyJ08Iw9reJTKS8VB:b6KcyoUJfPk6rLcP08IwxeVN8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774267, "uuid": "2616cf5d-dd3c-46b5-a03a-6c2bfddb3a98", "value": 47252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774267, "uuid": "0e4c98f2-a76b-45c9-9c6a-7418da1b8d05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774267, "uuid": "71c9f1d1-0d16-41b3-9d9a-2fbc00494cb0", "value": "1433ee43c440f9f2e98a37b782d44a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b81f7a1-81a7-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699826655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826655, "uuid": "7a0316e1-81c7-48a9-9d49-370e8fe97b26", "comment": "Malware payload (RemcosRAT)", "value": "12e23edf40fff249fcf008756d5fa5cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826655, "uuid": "9c9b3057-b174-47bf-bfb2-8f28daccbb71", "comment": "Malware payload (RemcosRAT)", "value": "168ee98b47d7033e8429fb86c5e22fd9adcd4e77eb56b086f4863ce376ca5103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826655, "uuid": "f888a6eb-890c-4e56-b0fb-0152a79319d7", "comment": "Malware payload (RemcosRAT)", "value": "3ad253454c8ec120078fb276b34de58c47f15107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826655, "uuid": "9c40f89c-4ed8-4181-b41f-0de1eed2ddab", "comment": "Malware payload (RemcosRAT)", "value": "1b2e8225f0e2d936ec3f617a38251ef44404643d1f10e282496dd297ad2f21403766b7bc8984d8ed3c6e4b386d8f090a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826655, "uuid": "a82d2246-52e3-454e-bc4e-eb8f4f7b8ede", "value": "T1D80533B1C772C89BE0A092BE5875CF5FC9EDA40569A401438390253F3B6E2D9D564BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826655, "uuid": "75f3ae33-a204-4d06-875f-6b9c7c331758", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826655, "uuid": "2e552bd0-5398-4828-b891-218aa7b79b85", "value": "24576:Lg/YpbdyVouaS+OQpPDVDzqjIYOk+Lt02:uG5MR+HpPDaIYO9Lt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699826655, "uuid": "8c8b9458-8580-434c-b71d-5830dd5745ad", "value": 836961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699826655, "uuid": "44d2e612-e43b-48ab-907b-e7da420f8618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826655, "uuid": "4d2082b4-c45c-409c-9a90-018b44fbb410", "value": "Postsigner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0360e697-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795127, "uuid": "409e7bc8-4eeb-415b-95f5-84b109497c09", "comment": "Malware payload", "value": "cfaeccc08a809a5c0044ddc1927519cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795127, "uuid": "b6c13b44-de8b-4442-94b4-a1e487678d1e", "comment": "Malware payload", "value": "18c87ff4db9395b047e6f886d424267fac64b0e232685923e1cdfd2f23563f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795127, "uuid": "eaf30df8-2ab8-46b0-ab7e-37a721d86fdf", "comment": "Malware payload", "value": "5d9de4e2320eb09fd50c02c95d67fef703ef3d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795127, "uuid": "bcc10a26-a634-48fb-9c1e-695c6e21960c", "comment": "Malware payload", "value": "67bf0580e5a67efe2789b105efd3c604c2a1c473ceba2006a06ea499f7ab358b65719cc50e93cda48c2a60c99df3b121", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795127, "uuid": "8bdb50d9-54ae-45e0-8733-bf0f13155be9", "value": "T1161623A1A24818E1C0CB36714831D56BD311EDEFAAE4DC95A5E8E7BA1F721CC5B0DB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795127, "uuid": "815d8af9-9d92-4ac5-b971-04f29a533ec3", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795127, "uuid": "11a85cea-b1b8-427d-a598-cc0b82c9fa1f", "value": "98304:/dL9xWLs1Esvx3VRy2XOwnqoQyVHXoblgL74+7e:VzwM5S2X9qM3oqLU+7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795127, "uuid": "248cc432-1aac-44ad-a9f4-f59c6675af01", "value": 4178766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795127, "uuid": "11cf7165-95b4-420a-8eb7-0d9b5baa9d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795127, "uuid": "de3e065c-a518-4f17-8f5c-72e8be6affe8", "value": "cfaeccc08a809a5c0044ddc1927519cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d7c365-817d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699808664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808664, "uuid": "bd49a53c-4ee5-4140-8f9e-b5a3c0b1c77e", "comment": "Malware payload", "value": "a822b9e6eedf69211013e192967bf523", "object_relation": "md5", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "GMER", "colour": "#DF9F86", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808664, "uuid": "552e9898-1d54-44f2-88f2-a9cef775bb47", "comment": "Malware payload", "value": "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7", "object_relation": "sha256", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "GMER", "colour": "#DF9F86", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808664, "uuid": "95e13649-92bd-4e11-9587-e40f89937acf", "comment": "Malware payload", "value": "83506de48bd0c50ea00c9e889fe980f56e6c6e1b", "object_relation": "sha1", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "GMER", "colour": "#DF9F86", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808664, "uuid": "02a4694d-b775-4d77-96b0-e9b1e8519852", "comment": "Malware payload", "value": "9fafc6f5b72f47f57532dc0e625d217f852641e9484bfb0997a6fab85c9067a4a3da9348a99215107fde233db06a41de", "object_relation": "sha3-384", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "GMER", "colour": "#DF9F86", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808664, "uuid": "2bb14ec9-4543-45fc-982a-faa8d6a480bd", "value": "T197434A52D7E604E8E567C5B1CB6A9773E7B0F80A932116DF43A0C8851F127E0A73D356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808664, "uuid": "10595de1-e3b6-4df9-9198-022700e6c115", "value": "a998fe47a44bfbf2399968e21cfdf7ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808664, "uuid": "cb6616dc-3e94-4fbd-88dd-56132380f728", "value": "1536:yZgulMALpoQSMTt9kKRw/9ug9QdB1PqpVai02VtqMqa:IgkaQhX7Rw/9t94B1AV+Mqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808664, "uuid": "ed598200-d028-46ea-8f17-0a22e595b3f9", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808664, "uuid": "a6439176-0084-4582-8a0c-44dde592f39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808664, "uuid": "ae89d53a-2e9b-45de-ba47-8488a64a5380", "value": "gmer64.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d8a801-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795445, "uuid": "360ba1ee-caa9-417c-a227-287634173363", "comment": "Malware payload", "value": "ef556cda8ba54604861cf80c289e9530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795445, "uuid": "6f9c1a24-2ebb-4662-8630-6617991f2582", "comment": "Malware payload", "value": "19e68dcb74bf8d53e20163dbd6809b756cdf6e6d0d88e103a81e968dc1a0452d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795445, "uuid": "f02595bf-52a3-4a98-ad83-f043200ec979", "comment": "Malware payload", "value": "0227efb115c8446e5be7478573b1f6139fb33c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795445, "uuid": "b915d123-3069-47ff-a9c1-95387148eb89", "comment": "Malware payload", "value": "c8e1f4ca57aa459e39f080a034df8704b7a9612ce41eb5e61e7041b91e847c8c260bec722b88fbf441d084c3f37b2b23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795445, "uuid": "b96ff3be-44ab-4e94-9e82-4283673baf90", "value": "T1D8E29513E9A94922FAA68BB10DB24EB409637C655C60DF0F3459BF1C0D31A835EF4B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795445, "uuid": "1ffb9b50-74a8-481d-9152-493896e39a55", "value": "2e7060e3fa7d5ec7eb6cb684c9b839a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795445, "uuid": "20779e7f-e67d-46d5-94e2-7bd6201a95ec", "value": "384:lyAM2K4iZNioaSItgDLV7LqbZIBCMMDJWrEh:ly6Sa7t+V7GZIBcJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795445, "uuid": "b02e5637-0673-4cfe-8e14-46b61638cedc", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795445, "uuid": "a7b24793-503a-4ac4-8acc-19bce910ec18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795445, "uuid": "bf2fcf08-c8ac-4576-99e7-5a3d0bca8bda", "value": "SecuriteInfo.com.Win32.KeyLogger-ASS.14390.30742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355684df-8148-11ee-8907-42010a9c0042", "comment": "Malware payload (PrivateLoader)", "timestamp": 1699785762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785762, "uuid": "4dacfef0-0e19-411d-9f8a-0b2679cbfebf", "comment": "Malware payload (PrivateLoader)", "value": "ff6c6212c086b2ea7bb1537a6e9b0abb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785762, "uuid": "acf6f3d1-fd86-42c0-9879-4bb9414795a0", "comment": "Malware payload (PrivateLoader)", "value": "1abe626a7cbd4639f1ba56a6c4dab7f2dd9ad08396eb80ee4a21b0f7ef69d875", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785762, "uuid": "5246724c-80cf-4841-b3e5-3048c6b19a9a", "comment": "Malware payload (PrivateLoader)", "value": "f058d292f83c16450af74d870056cb742d23b3a3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785762, "uuid": "cc1f8dd5-95d7-4db4-92ac-dda67fbefbec", "comment": "Malware payload (PrivateLoader)", "value": "60b6b7ad50fcde403641bda658a25ec7dfd4db2a99be7cedd989c1888e1ecc04431d9e939df7a2ca8f0a316c73d69c27", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785762, "uuid": "3a9e66e4-1809-409a-bac6-f3f80e92e16e", "value": "T1F93622507B8E5CFED235C37D9022998FB12B2763E6A57484338D32A29F72BA40D27355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785762, "uuid": "1ac09d5b-0ef1-4c92-8d05-819d0e71d008", "value": "6a74b885a9c5892b3723e4ff1d6798be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785762, "uuid": "19754733-4c44-44c9-b240-c1cf703fbb4a", "value": "98304:hnaLI4/Y9rgwwUz1T1n5nwRRO8UXTJFBh01397E+TTHZfm7isI:EI4a9xT15wfle013qo5fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699785762, "uuid": "e3840232-284d-40b4-ab3f-f3c3c8ce6583", "value": 5039104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699785762, "uuid": "22aca862-da3b-4e17-9f6c-a525e14c6fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785762, "uuid": "f760d4fd-cd2d-41fa-b409-b24f292d42b9", "value": "ff6c6212c086b2ea7bb1537a6e9b0abb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ca38c7-810c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699760124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760124, "uuid": "89edee00-1ed0-42e2-8e80-cd0a3f7874e1", "comment": "Malware payload (RedLineStealer)", "value": "f7bce3836c364ecd1baa6686179edcea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760124, "uuid": "d41fd150-1229-4d8b-bef7-f8d0c4c97cba", "comment": "Malware payload (RedLineStealer)", "value": "1e003273a6cf7c60048cbc8ebd7dc4e9dd14ad52b444be80bf6a06781c87eeee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760124, "uuid": "7aef5e1f-8bc6-4961-83b8-98ce77be3ed1", "comment": "Malware payload (RedLineStealer)", "value": "92bd6422b31d35b32041d815c2dfd92fece79ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760124, "uuid": "ea41f392-18ab-484a-a8ed-f8c842e0e6ff", "comment": "Malware payload (RedLineStealer)", "value": "3ff1013c204e46f3231c820b2b2df7b41cd2655a415ba1f1cb602390143d8b2b798c78c4a95d1a63fe025e9d054f93a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760124, "uuid": "7f04efd3-614e-4cd3-91b5-71345d3c73bd", "value": "T1366523076BEDC436E8B0137198F516070B34BC629E7E825AA746DD5B8CB2AC17932337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760124, "uuid": "60bdb90a-8b87-4b1a-8735-f196a7c40d42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760124, "uuid": "3d8c1c18-f322-46ff-8cfd-ae868ef1deb7", "value": "24576:syFqrnrnH98e6IswBjGP6kD2H0KU+n6VJ5hCt/8TWusPmG6:bFqrnrHKeBHFGpQZU+6VJ5hy94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699760124, "uuid": "86b9be0d-fa1a-4694-9ccd-829bfb29d0a6", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699760124, "uuid": "f580ac61-afcd-45f3-a31c-bb907849d503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760124, "uuid": "d9138ae3-7846-42a2-aa9b-8fcfb72e5401", "value": "f7bce3836c364ecd1baa6686179edcea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05896a4-818e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699816007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816007, "uuid": "bf3f614e-22c0-4986-b4c3-6f882c2f4535", "comment": "Malware payload", "value": "62bce6ff55d3895c496382433d79ae15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816007, "uuid": "850cbe9d-015d-40b4-926c-1884d3c3f048", "comment": "Malware payload", "value": "1e81ba1dcf7bea1c0c3da17eb3bcd01a4c0ea0ca6acc6f0c206c4b1b0e1b7537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816007, "uuid": "2d70464d-e784-45be-8234-f0b311e8147b", "comment": "Malware payload", "value": "9c02a0d8d3e23c88aa23ead3e11f3547f64176d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816007, "uuid": "6d0dbb6f-8242-473e-b5f0-721246eeda4a", "comment": "Malware payload", "value": "0ed2786d7be54f48e81e8ca8ef16344be6d99fcf4c8ff4ca11830b5903877b54c72d76a9b8d87e54c645c3bcb966ded4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816007, "uuid": "4dd172e0-6fd3-4e14-a6f0-308aa2ac1b97", "value": "T14FB6F2197DA21CA5C0E38878AC2F39356E7D74131B01C7F329516489AF327A3D62AFD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816007, "uuid": "56f60e20-2b85-45c0-9bdc-2c30ff714f36", "value": "196608:sOyqLNsxsmbWZNvYzhsch7stnbfF4sdJ+k5y8BepV:7fLqtbWZizh3hAN4sd8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699816007, "uuid": "aeac2417-963b-456d-9cba-07816c026d56", "value": 10866498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699816007, "uuid": "59eebec1-4451-4c05-b7bf-aff06e96a327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816007, "uuid": "3f486930-b581-4550-996c-1515113bf254", "value": "62bce6ff55d3895c496382433d79ae15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa51a70-80f1-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699748593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699748593, "uuid": "60007f0e-fd5b-43ac-838e-911d341a1463", "comment": "Malware payload (IRATA)", "value": "dc9af32c88dda3930c106a536575e460", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699748593, "uuid": "190cbdc8-40e6-4a66-b994-3b649b0a6ad5", "comment": "Malware payload (IRATA)", "value": "25ff0c5de86b2a1a11eda832f427c945884ba8a95d27698266e18cf09a05819a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699748593, "uuid": "7e05173e-8c5b-4e10-b59d-db700375842d", "comment": "Malware payload (IRATA)", "value": "a79583d81919e8ad949ff9df24c5563c61fcd879", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699748593, "uuid": "35f6feac-f562-4d95-8d1e-e60e296e56ba", "comment": "Malware payload (IRATA)", "value": "ca763947630a76a246e39a9949b90a55b8bc638fba03e3fc5d87b4ea26dc59de6aac57362e4b733d53c1af111cea0d90", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699748593, "uuid": "79e1c875-8bf5-4135-811e-b9ef98c228b6", "value": "T113D52383F227A82BC872D5327106233954468D59CF42B786399C77EE34BBEEC0B856D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699748593, "uuid": "f4499315-40c0-4ece-8490-3722a63d50c2", "value": "49152:QE7UIMCQj5NLumokhjIqOr7aWDk5oYHj4UeBW+HLHEwrIMS78RXm4RdHDbC:QbOoNKmokzSe6qTj9exHTEqf13RdHDbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699748593, "uuid": "12f1f376-86b7-4538-97ba-a6aca679dbce", "value": 2756746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699748593, "uuid": "82ed96d4-9bc1-493c-a4ac-478ca5d9c472", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699748593, "uuid": "c42ecc5f-4d89-4d96-884d-774a4fbfdda4", "value": "App.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0440419-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795417, "uuid": "ef29d6e3-8923-4b95-9498-3fa2c612c239", "comment": "Malware payload", "value": "e70cf4e5539ed593ee19b09aa85df02a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795417, "uuid": "b4db0932-1a41-4549-b540-fd014d533981", "comment": "Malware payload", "value": "2749bdc11bc0496f613cfd5f22440ca51841f39144b86ebe85e755f87d36fc91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795417, "uuid": "af58f793-275d-4236-9851-f475807a4083", "comment": "Malware payload", "value": "44b34d7c6f17f7c674af2581b88289dd4ce28b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795417, "uuid": "003428e9-be6e-4cb4-a6b0-1848029a8ec6", "comment": "Malware payload", "value": "ba0b05ba5c098fbf252883ebab248ddd3ad23783a37af9b214a4b56c859e86dfd1e403271821aa74c80828888390bea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795417, "uuid": "9a664583-19d7-456e-b9a2-f0fdd73019ac", "value": "T17F745B5310B46975F85CA1794CFB3BF185A5F8360B16EAF35290DB94582F0E21E32B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795417, "uuid": "266d02fc-2b2a-4891-9afb-02930588045e", "value": "2810f6026583be00b62f1f407a643448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795417, "uuid": "c5e7943e-2f07-4d57-b3a2-45d1f932732a", "value": "6144:GZLWOfKqiQt+qvgirTay7i+qxBCxcUwCD9KC:ELWcV+qvpbhxcTkKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795417, "uuid": "560bcca1-b428-43c9-afc6-b7ffe504fbfd", "value": 365232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795417, "uuid": "dc54e066-dc3d-4388-9481-15da16fb4bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795417, "uuid": "eceae8d8-10ab-468c-a306-33d5c900f263", "value": "SecuriteInfo.com.Win32.Evo-gen.10698.3058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccaecd5-8168-11ee-8907-42010a9c0042", "comment": "Malware payload (Nitol)", "timestamp": 1699799572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799572, "uuid": "0a132d18-d83f-46a7-b5c2-3902dbe3629b", "comment": "Malware payload (Nitol)", "value": "82cda6dff0369daf45c2d87fc255b17e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799572, "uuid": "bcd0a401-ab81-4ab4-ba31-98918fe505db", "comment": "Malware payload (Nitol)", "value": "27b1a426cbe8250b695562c84407f117df248f61652364d1c2ecfcc55e77e1b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799572, "uuid": "fd868c17-fed2-437d-a2ff-4f2d3f4160ab", "comment": "Malware payload (Nitol)", "value": "7df4aca8422e249dc8c6a62411f13d8c41a5f3ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799572, "uuid": "8ee28429-eacc-4f51-bc78-6a5c549b5aea", "comment": "Malware payload (Nitol)", "value": "9cb00287a6267035c83e8772bb20a3ccf66f9be0adb5f4670a2d56cfea2e0845b3dce8119563b1aec006fdc0f0f9a0c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799572, "uuid": "fa59ac40-6bdf-4944-a7dd-0f0f63ae26b7", "value": "T169736C217691C1B6C44964319816D7B25B7E79305BF8D9C3BF590B7E4F223C0AA3A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799572, "uuid": "33c6d50c-cb52-469a-893d-60dd68e4d08d", "value": "f61b3498a024e1606e5633ff05e57b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799572, "uuid": "9fa41812-80ca-4f8a-bd70-57accd0927f4", "value": "1536:awsdCFnE4Nz1/SXPtpoprAeDYxUfGChK5O:awsAik1a4pGChK5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699799572, "uuid": "52a57559-ecd4-4ea1-80c5-e8bd323174b2", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699799572, "uuid": "845e90a3-4605-4ff3-9ec9-e36b5cad3e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799572, "uuid": "13a1aab6-d9a1-4b79-b71c-4ae248b7d662", "value": "82cda6dff0369daf45c2d87fc255b17e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cee104-817c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699808092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808092, "uuid": "6381e3a2-faa9-4fe0-8f01-47ccbfd76189", "comment": "Malware payload", "value": "cf4151b638a71c1cd8b36edf4476579e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808092, "uuid": "a73d3d63-93e5-4b8a-a824-57ef78708be3", "comment": "Malware payload", "value": "27e98d1fbe8fa985a4e5c67e57a7e0225fe4114ad918cdf84d3163f32da6c937", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808092, "uuid": "501eac91-02ed-45e1-84df-2202952a1fe2", "comment": "Malware payload", "value": "8784d5d7d99b396a517727b095dd21d9bf713a42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808092, "uuid": "67293b13-6dd4-4507-8397-115a98d12112", "comment": "Malware payload", "value": "a29b6fa2d36661bc2f13232ebbca2cd6b312e4344559f167c12b55eed42025b2c02742dd2b0e55d0103cdc317c6e7190", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808092, "uuid": "0e6a1fe0-e066-4a17-840d-3068010ca746", "value": "T121E53303F1916379E2265B7318BE98A8423259DBE76BD86C4D6BB3C83D773514C04E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808092, "uuid": "46aa966b-3f34-46b5-b6c8-84372223bc5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808092, "uuid": "80f34b27-fafd-4125-b26e-4d7991d9efae", "value": "49152:Y/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:Y/FTi++Ql4FEQaxuMBh/DqLdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808092, "uuid": "1c6f184e-ed88-4732-9eac-42b7c8c12cba", "value": 3233792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808092, "uuid": "ff4d6ce4-dfad-451b-8d6a-72792472ab80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808092, "uuid": "f11d9e32-dd25-40f1-920e-443e2509e262", "value": "cf4151b638a71c1cd8b36edf4476579e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f269a5-81a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699825438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825438, "uuid": "a92d4e78-ed36-470b-842b-fb32272d101c", "comment": "Malware payload", "value": "bed8c74592582ef55e9cabebdd449fb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825438, "uuid": "2b029596-f494-4494-bfe0-8728b39378e8", "comment": "Malware payload", "value": "29a2681601ed2682043ef39e5f94bb6eb441ba802b1eb3883de225e623fb3f0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825438, "uuid": "ece37af7-93fc-4feb-8420-1b5d38fa2114", "comment": "Malware payload", "value": "b231a328036175996b0a60c1a1cc6412d7002e9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825438, "uuid": "066399ef-2578-4857-99a9-46db824ff944", "comment": "Malware payload", "value": "49b201f8342dac0a3edaee391bb337e2a13b7506bf755009a90954c857a120e7c59ff0176124678be84bf420a3c3227c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825438, "uuid": "306055b7-edd6-4ef5-b607-72a7b52d274b", "value": "T127635A31BA761E17C0C5903A21F74B15B6F143CA25A8C72E7DB21E8EFF24A406587AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825438, "uuid": "5f21d405-feea-4e89-96bd-e6daf6b5a4e0", "value": "1536:Yh7dkfulnDRXXarjIQ6MiE2575StwTwbZn23:EPMk5VzTwbZn23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699825438, "uuid": "90348eb4-2843-434a-9971-47ec61ce9add", "value": 70480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699825438, "uuid": "ac640637-4f42-4cab-8761-e9900eae862f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825438, "uuid": "ff710973-3fb8-4d86-b08e-c68698b15de7", "value": "bed8c74592582ef55e9cabebdd449fb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cbcece-8197-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699819856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819856, "uuid": "4eb878bd-fde0-48d8-a861-eba900c371c0", "comment": "Malware payload (Formbook)", "value": "fd9e8542326102cddb7fe94c6c1f2065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819856, "uuid": "a9412fc7-4dba-49b9-b4d0-d8c414aff5fd", "comment": "Malware payload (Formbook)", "value": "2a347e81537122aca6656bd41eab07d8abd57d85684e71c877650c96963f9123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819856, "uuid": "7beb3796-4ffb-4bb8-bb59-9adac2cf2b8f", "comment": "Malware payload (Formbook)", "value": "52ffd5ca1b2ac76e8ad26b653a56c3bb44987c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819856, "uuid": "e9acd2f7-c65a-4592-b1f6-c25434a3c3ba", "comment": "Malware payload (Formbook)", "value": "2190112e51a75eacede8cede7f9c4a8ad1328ba471516b3470c9a5fa8f3a3b4df4b938d7e290308cdc602d0c31c2c292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819856, "uuid": "c36d8062-b255-47ec-a5c7-49e1307ad03a", "value": "T135C5F2E2B3E40433D3F35A388D4BD2946C2A7C256E64F886E6B91D5C5A3C541BF2E253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819856, "uuid": "ea469516-25bf-40d6-81ed-eb2bc399ba43", "value": "74fa4eafbabf54ed84e7ed9acb48dcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819856, "uuid": "015f58be-2927-4675-a82d-267121db9170", "value": "49152:rsVjOztRwohuzcMwF5yNkr+eHlBJ/k2IDNu2+Rd:rsVjGAxcMEyNkrzpDi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699819856, "uuid": "2aae0145-f771-498d-8f30-cb137b4e03e3", "value": 2511360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699819856, "uuid": "48ae43e2-665e-40f0-93b4-afd6ce9aba97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819856, "uuid": "311efd52-2bec-42d0-b1da-f471d8676722", "value": "Factura de proforma pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f2a236-8148-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1699785757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785757, "uuid": "d8afc01c-b3b1-48a5-a15a-b88d95fc62e3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4a294bf90ec3dc469d755c20b7bba633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785757, "uuid": "7cbaa352-4d90-467f-b420-43bba7fedf46", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2a502ac036099cb1d7f4558d0233791b6ce49a9fb95f76f669839fc905bc6aac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785757, "uuid": "ecf0083e-e994-474a-b064-4b3028fc80d4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f4f6e02eaf2bfb45bed359e033bd319a0beb3c06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785757, "uuid": "9d27b63e-1335-4e5d-9eb1-ff224517c0ec", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f13ac3dc72c5d85357ab79491b741ee83d530eb5f704d5e0348f513240ff189e6b5101c587d69799cd33af29073dbe41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785757, "uuid": "db9165e1-4477-4987-adc9-d482b9a81cf0", "value": "T106563358FC8E9CF9C8172831590E8A72910B7F602C5D795C3DBD664EEE3C9A0847CB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785757, "uuid": "c37ad324-b494-428d-878d-d1a346921f10", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785757, "uuid": "904bd773-9939-4143-8462-f481dfcc154b", "value": "98304:WiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:TRm1syxacY48eda2TMpQdZ9nc+fyhNjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699785757, "uuid": "e2949aa1-1102-4894-80bf-9624eb50b8c2", "value": 5900637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699785757, "uuid": "5e06acc5-cd40-4270-8ac3-0b4c1851be90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785757, "uuid": "a5d86059-774d-4dfc-affa-e5f7343e4148", "value": "4a294bf90ec3dc469d755c20b7bba633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fb03a9-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774226, "uuid": "dfc197e2-2db2-4a0d-a4fb-f6ff02d45388", "comment": "Malware payload (Mirai)", "value": "6d8c80a57cffde509eb132d829d622d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774226, "uuid": "04e7d281-cd3c-4c51-98d7-3e7323a18277", "comment": "Malware payload (Mirai)", "value": "3333df822016ec0ff1323474d9e8a29e97303981431bb40a432a115a233b8e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774226, "uuid": "b0e35d68-7eb0-4cbd-b22b-dc83bccdd85f", "comment": "Malware payload (Mirai)", "value": "486bdc72e7df92f1bd9e129a3e73aa6b4d9bea73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774226, "uuid": "a0c9e3a0-0f81-4d08-bc96-64db6286721a", "comment": "Malware payload (Mirai)", "value": "3620e2510e47a3ce1e4028acf54af230435d18e49ef092af0b4a0a116f04e8b7d94614e197ee0919acf5090abf19107e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774226, "uuid": "8fba134a-3602-432c-8438-e483bf6f4fd5", "value": "T1AC138E76C86D9DD4C2448678A935CE781F63F104C2671EFA1E9A85A68043DFCFA093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774226, "uuid": "7fedc99e-cbea-4562-b17e-320cc2e116d5", "value": "768:Xad0wtw3XyPp+leFMeyiKrKUnUAwkmNoZMCroZFkC7:XaewtwndMMFBUcWaMT3kC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774226, "uuid": "0c3410f9-593c-4fde-ab7b-97537c951dba", "value": 42676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774226, "uuid": "805cb898-68ea-4e95-b6cf-61d4935055b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774226, "uuid": "523765ea-8165-42df-933e-f9cb1b7a7689", "value": "6d8c80a57cffde509eb132d829d622d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb2f0d0-8172-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699804027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699804027, "uuid": "e240472a-4d8e-4a85-abcc-ab92e83ced9c", "comment": "Malware payload", "value": "1c3d9678b10ba9ca0a0601b63a135344", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699804027, "uuid": "83e23c25-7b02-41ca-bdc0-8d2255dfdc7f", "comment": "Malware payload", "value": "33d9630eef362ad300b8a8c000e4172d18330bfbde8c0053e0ba8d37b9537220", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699804027, "uuid": "e87f2a39-0f3a-4514-ba83-c77bff560b7f", "comment": "Malware payload", "value": "4d73430883f23b31a2f9515fe655b0530721473d", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699804027, "uuid": "7fcfcc40-9db7-4655-93d0-1458d0b53151", "comment": "Malware payload", "value": "9021f504317f33360c1c790a3fd3b54fb69f17e7219f206ce54e391f7c2298805d718c4617ea22e4eba6390b190b41eb", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699804027, "uuid": "79c5edd9-e960-4714-b43a-482c5e59922c", "value": "T165F733317286C13BD1BA05B0296EDBAF51397EB14B7240D7A3D81E6E18B59C24732F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699804027, "uuid": "90ad54fc-9257-445c-bddb-43aa895f53f5", "value": "d8bb7ff20ee28065e7f762f91eee2327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699804027, "uuid": "3fd91a37-9794-4c04-ac76-a1874fdd07fb", "value": "1572864:TrlqhpZDdkekSjofjyjsUSnSTt2mjN6LIFTtAmriZnY:3lqzpJkSjobmsUQC0mjN6QbsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699804027, "uuid": "f8033e0d-eb69-47b3-894e-d0cf3729549c", "value": 70682006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699804027, "uuid": "1c9d0ff5-5b96-477d-8f56-85ac35b10227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699804027, "uuid": "f32d575d-45c6-4ed0-a595-538e2973f4e4", "value": "legit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5429368c-8139-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699779372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779372, "uuid": "68bce5ac-9f9b-4ad7-8b64-9bbbec42abe0", "comment": "Malware payload (Smoke Loader)", "value": "6b8f772decbfb5cd1c2139c3c75286a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779372, "uuid": "8d568909-e8b9-4419-bf75-adab38aa729f", "comment": "Malware payload (Smoke Loader)", "value": "3455690561867bf0046352f788d3ff43673d0f093118f3de1c6e0f7bcfb8d3e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779372, "uuid": "1369bd06-809f-43c3-90e3-f6b621da7113", "comment": "Malware payload (Smoke Loader)", "value": "059492bca1fa69afacd5e08ca4da5a1a3863b27f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779372, "uuid": "78766f49-dac3-4b04-a865-e4d9d53df709", "comment": "Malware payload (Smoke Loader)", "value": "563e8a9233494884f8ba48367b4b8f0f466bcba638f03dffb8afd24129b17a3d3434e226b11edef1133b6f33ff4610e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779372, "uuid": "e5518b4b-727f-488f-9fad-fd30fba21d1c", "value": "T16B3523829EE88472E5B64770A4FB0343077B7CA51E7C836B3218496E4DB1ED46A3473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779372, "uuid": "1452dc36-1088-4868-901a-2c07462de727", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779372, "uuid": "d867ef7f-d9c1-4323-9b1f-8b185f393f78", "value": "24576:by6z0bg1JxcBkoae9IspCAGl7bDiTSHB:OH0JK6Reuq3GR2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779372, "uuid": "51d581e1-0cc6-4bee-854e-a0b47159d319", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779372, "uuid": "daf44f1d-bac2-4bd6-b830-502c1f01bf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779372, "uuid": "81e5268f-9cea-49fc-b709-afe0db4029a1", "value": "6b8f772decbfb5cd1c2139c3c75286a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4717242-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795424, "uuid": "595ffe57-4fb4-41d3-9739-499065657097", "comment": "Malware payload", "value": "ff33c37f2e1f9b88564ba560bd366521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795424, "uuid": "96777a31-b8e7-41fa-a7bc-cdf36869f9ac", "comment": "Malware payload", "value": "35d2cfcff0eeb32b3f7f15fa5245b96b9813048a8e6a81e458e425b338f50360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795424, "uuid": "9816389a-184f-4ddf-8db6-17263f561630", "comment": "Malware payload", "value": "ae7f5aa6ddecf6c7a20e101de2abb6b3fd8b373e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795424, "uuid": "365d5f72-fe0e-4a25-abe5-900692dc56a0", "comment": "Malware payload", "value": "1144a7997634cd6c5435d76bba86469b58ee2ff26be3e3007af3ca43773ba3c10256d27611a547544dbb9b467417cfad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795424, "uuid": "13e153b3-db88-4b11-a9ac-a9d7ba924688", "value": "T1B9A633E2D6404178C0D2FFB1A3A0D94E17BE2A5710297DDC7B4CEDE93F2A645D90A88D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795424, "uuid": "47728eb9-4f25-427e-ba9e-7108ebfba289", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795424, "uuid": "510331c5-c0e7-4deb-8a1b-73addfb855db", "value": "196608:dkH9KzojLo/wVtPesoHU3Fkhbk/j3kbuBTeLCSz/skMf:aHoUuq2s6cFkakiBaLCSzjMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795424, "uuid": "9963fc2c-ba20-4c50-b049-4aa5d5bb6000", "value": 10406507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795424, "uuid": "3a0843a1-0126-4897-af3a-e0a8a667014d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795424, "uuid": "63cd9843-4c25-44f2-8799-0112666af6ee", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.31694.7882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39c7dbe-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795450, "uuid": "accf829c-8515-4a2c-ae5a-fa9274caa3fe", "comment": "Malware payload", "value": "62539cc988c4a0f4bac9ceb04879661b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795450, "uuid": "a506b5d2-5837-4717-bb38-1861fff034cd", "comment": "Malware payload", "value": "3da3613cd6ff26b95905b5510c5201ddfa8efc74041e19a365326b52c5be3999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795450, "uuid": "d63d742d-6b82-422a-9184-0bd390c23193", "comment": "Malware payload", "value": "c73a5e016a9aefd23d23a5749abef79b6db60e05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795450, "uuid": "42e3c97c-ddd8-4d95-92f4-6a51e4426e5e", "comment": "Malware payload", "value": "cac5bb66243b546c4c13a357a046635a2b80605cbfd4c89e8ceb5b491b80fbfde2c905fb475095b3e03bbb9e66c6c3c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795450, "uuid": "09a51629-9c25-4578-bf86-34d9b1eb5828", "value": "T15925AE0AFEC284F5C3553472055A277A9ABFE98B1B34DFDB93A8DD2C5D22190583B132", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795450, "uuid": "b368e2fc-fd9e-40f1-a347-d23ca85f2755", "value": "12288:rXCtPs+5HFSepm67yfgbQwm3+W9Vs/+2qFG3Ju:rXCtPzHYepm67yfg2Vs+2qFG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795450, "uuid": "43040200-692e-4dcd-8423-63f3d16b99f5", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795450, "uuid": "8845dbb5-5ba0-4463-a8cb-8540007d7b12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795450, "uuid": "08f0fcdc-3d47-46bc-8621-218df59ce68a", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.20367.14343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6925f84c-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774253, "uuid": "7560c33f-5047-486b-9693-25b3da5cf43c", "comment": "Malware payload (Mirai)", "value": "9a2b50549d78a0ea2283a9da96e08396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774253, "uuid": "647bbd03-8ac5-4cc8-8e1f-2828c35cfea5", "comment": "Malware payload (Mirai)", "value": "3e1fda14c257c51da8566253716c2c71b506173836f136a3baa6321746cc59dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774253, "uuid": "a2b1959b-63c6-47c4-baff-ab311da61bdc", "comment": "Malware payload (Mirai)", "value": "0273634752cd6f783e2de91e982e724d52b82840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774253, "uuid": "84344ef3-51c1-400f-b116-316b7ca16d39", "comment": "Malware payload (Mirai)", "value": "40b14fcde115ada19a65d07caa7ba13fd75d3c0f4e136f4b490cf9fd7eb01f565b24baabc340bc2186fb8c22fcef9e83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774253, "uuid": "4ebe2ced-b79d-4f89-9d78-2c6b4424bffb", "value": "T14B43F845B8818A12C5D4137EFE3E128D33126778E2DFB2129D116F147BC6A2F0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774253, "uuid": "77875240-6eb1-4fcf-8308-20fe9168799a", "value": "1536:p9ndvNnjHlKpWdKWhwU98jJW3CtCBUwrgkuL7IbxiHsiNQc:dpjHQUdphiWytiXosiNQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774253, "uuid": "49a1badd-e7eb-4953-97d3-f91600314749", "value": 58704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774253, "uuid": "80a3d20e-7c06-4f9d-91ed-212375964860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774253, "uuid": "5bc633cb-ee2f-4e5c-bae7-3d9a800a985d", "value": "9a2b50549d78a0ea2283a9da96e08396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ceaec47-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774232, "uuid": "ba4e52c1-f506-4328-b8ba-cf5ba73815ec", "comment": "Malware payload (Mirai)", "value": "be84f6fbdbac54d6a78e42e2e9cefa31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774232, "uuid": "8bc66a7b-3326-4341-bda5-a73dfbf6a145", "comment": "Malware payload (Mirai)", "value": "3e900bfd9eb5fbe5ca21f0976ac620cebd57c725faaf8f4d733c984f988ee7cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774232, "uuid": "d1485d75-f34e-4456-83fe-b80ce2191cd1", "comment": "Malware payload (Mirai)", "value": "d33fc616e20cf43a44587a48ca4cba68c24cf0be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774232, "uuid": "6aac1723-b7d8-495c-93b9-c85e226be1d0", "comment": "Malware payload (Mirai)", "value": "467a3fda29a3b067626716061016d636d6b7b3b5e73403bf32c65d5a3ea5d9a9beed5bfb36129ae543df3c0d37b8c6d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774232, "uuid": "e70a2d7c-06a6-4b6f-8917-cb8690fccf69", "value": "T1BF332A21793A2F17C0D4A47A62F74758B2F11A5E66E8CA5EBC730E4FFF60940A4136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774232, "uuid": "64b77208-3c10-4dac-8bab-46b4b27d5655", "value": "768:Ncu2oSxq9wiNZmPScYRXdgPI2BzUT82EtO+vDI1:eu2FxSwiNZmPSnRXdgQ2n2Ed8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774232, "uuid": "e8d3a3e3-0d7e-438c-bf58-2df39820851a", "value": 51124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774232, "uuid": "ae5b4201-62a5-4f2b-8182-7b3e9ccc14bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774232, "uuid": "7e86b82f-4c36-40b2-b30a-f81bffd15cc3", "value": "be84f6fbdbac54d6a78e42e2e9cefa31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22a452b-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795447, "uuid": "14d3177b-3645-4e3b-9b63-925d0027d443", "comment": "Malware payload", "value": "291eafd5104938b405952e1b8d07aa90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795447, "uuid": "b4ab0e1d-005a-4d0d-a05f-fa45e3e3e5a6", "comment": "Malware payload", "value": "3f122bee753762566fd28608a1b861dd3e7b1945e923382d0a47d13aac3bc1e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795447, "uuid": "1117ee4c-6a2a-4149-8436-24f22c965374", "comment": "Malware payload", "value": "321f19fabc8a333d951e0f53c69dba887b44b246", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795447, "uuid": "4a7aae1a-ce94-4dec-a413-ddcde7ff17a3", "comment": "Malware payload", "value": "3dd183a1cda20dd0abb12f84e24ac4f9834c1858f8f5389c8a6aa17514a5b78e093831b10534d07f088ca766ab048b0e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795447, "uuid": "e2d2b078-d035-47e3-ab0c-263e86ba07ee", "value": "T104D46D0ABA9FCA2BD33C3530889357F4AB13FC966DF986031758555C5C322506FA36AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795447, "uuid": "347fa757-4e58-46ef-95d5-65c004550203", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795447, "uuid": "d4e8e67d-6d44-4993-971d-11866b976bc7", "value": "6144:+RR5rhZFQGrsUwF7vlPoS/MXXnDX543KrBhEve9j9IRqqDLuy2xTBLu:+R5nWFpPoSKzG3aJIsqnuy2xT1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795447, "uuid": "5d4ed8ec-8d34-4e95-a412-74726be35963", "value": 614333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795447, "uuid": "cad10b66-4f99-4252-9f62-c2dbc2c29857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795447, "uuid": "a3cd44cb-d03c-4fec-93d4-dc7ccd447d8d", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.31191.18541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17523156-814e-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1699788289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788289, "uuid": "896f4d9c-c68b-4fe7-988c-d90aef7ee6fc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ed7f05d9d23e2e7ff47850dc619491e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788289, "uuid": "590c2d4e-b00b-477f-b7d5-2f0631f014a1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3f41ef5bd4d42bb2de41dc80d4d9ed6c5e0ea417438f0d13b9eff7b2c73ad1f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788289, "uuid": "1c263f1d-209e-4b73-8ba6-a390440ffd4a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d015d50383455b761c6922dcfc19171d4489a559", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788289, "uuid": "f0c8a096-cfa3-425e-82fb-cacc9e22ebd8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "81c1e24d8dacb9dbedde09db879ed7f043412e120df6d4d963f9560733a8b979743fa448f1515594e164aa10756e93b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788289, "uuid": "b34dec88-1a9f-4088-b567-794f45563be3", "value": "T127563358FC8E9CF9C8172831590E8A72910B7F602C5D795C3DBD664EEE3C9A0847CB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788289, "uuid": "473bcccf-8ca6-483b-b690-4be5998a091c", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788289, "uuid": "6f08b2e4-4c43-4eeb-9d99-937c84c40f68", "value": "98304:tiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:0Rm1syxacY48eda2TMpQdZ9nc+fyhNjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699788289, "uuid": "d607f7d3-f515-4f38-9383-bf5f9cba0ba8", "value": 5900637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699788289, "uuid": "1a18e0a9-b264-4e74-a4ee-3edad0b08a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788289, "uuid": "59cdfcd2-c39b-4ece-bdad-7a12747d36f9", "value": "ed7f05d9d23e2e7ff47850dc619491e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f430960-81a4-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699825427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825427, "uuid": "d7ad36a0-d196-49e4-b316-03344a331d44", "comment": "Malware payload (Mirai)", "value": "98ade4a81422655e4ad21d8599947284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825427, "uuid": "d426f43a-8b67-4437-b323-4ea76fcf05df", "comment": "Malware payload (Mirai)", "value": "4331e8ae135ed7c3ec39c608d37c6128657e8efb8a9ba42f356aa32fb8ae2e75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825427, "uuid": "c97a5636-2fd6-4133-9b14-e11a7fec01b3", "comment": "Malware payload (Mirai)", "value": "0347349de06e2ccc0308434455540fdb41f25857", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825427, "uuid": "0af9a1a5-98cd-42ad-b143-51c27c4c8040", "comment": "Malware payload (Mirai)", "value": "d4f572516fae52164338ee06ecbc26c2199a3293009abc37fe56cc11fec3d95bd268edaafe743c88d2922b12de7a09f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825427, "uuid": "323b9ed0-2182-44d0-81ba-4c9429f87314", "value": "T1A9439E33DA1A2D14C14A823070788E757B53E1C842E67EB65AE1C2BAD443A9DF94DFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825427, "uuid": "97c4d2a9-81c9-4dfd-afe3-5a919f723339", "value": "1536:A/a5MuHEQxJ/FUFYPkawKtKFTwSJjTMjUI5sCgRwbZnNX:EaMukQx8FYt70FrjTMDstRwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699825427, "uuid": "0064fdcf-4fa3-4310-bf92-d0d0fd2c39e1", "value": 60328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699825427, "uuid": "cc03c1d0-8b48-4848-b4a2-81fd3a7a99b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825427, "uuid": "efeb2c43-d20a-4caa-a520-66fb8eb260e5", "value": "98ade4a81422655e4ad21d8599947284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536fd57a-8136-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699778082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778082, "uuid": "b7f8c85b-1da2-497f-83d1-fdf6b9c20ea2", "comment": "Malware payload", "value": "c75cca43891c0ac1943c9e6394078cc5", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778082, "uuid": "94826be9-fe7f-47ad-aa9d-19c8184ff20f", "comment": "Malware payload", "value": "442fce0d1a2dd3f042d6c64b6965f55590ad7774ccfe8d8a4893f4e444bea8b4", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778082, "uuid": "2fa2e665-24e3-4811-a30c-4641cff89b03", "comment": "Malware payload", "value": "2046b59b6576e6607c51053b915c807a67596730", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778082, "uuid": "8d1ab250-b3b5-456a-8f57-acfb32569afc", "comment": "Malware payload", "value": "eb750820b739b3d72f7614875e19f44bd08852cfd0726ab00606ba6634058aed0fa08a2777893d2ce4571d061feaa7e5", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699778082, "uuid": "a2e46120-db5b-4978-bf34-5045a74c3e77", "value": "T1EEE11A6D85BA8034C71A203591C5138BC7697D550B0F0B2B36B8E15E2EE7EE30B2936C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699778082, "uuid": "b4191ab4-c990-40c4-b49a-9a29454a472b", "value": "96:+/Y7yb8fvZ4YcTjiMhVVCvkwQEeGIRf3UNa52ZUnfFllCPotUYuL9cSlYJV5Vhc:+A7yb8p4LOOV8vdQjm4nNKNYuCSlcrVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699778082, "uuid": "8c5b6f46-9fd1-4516-aaf9-341f165d251d", "value": 7159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699778082, "uuid": "1063211f-778a-4970-85e6-dc86b68165da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699778082, "uuid": "86ef6f8b-82b1-424d-b8d8-93f2c3c96cf4", "value": "PO-No.40861864QTT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52ae972-81a8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699827316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699827316, "uuid": "7216a4e6-921f-4ae5-a9a5-2cfc14671385", "comment": "Malware payload (RedLineStealer)", "value": "6455b2a348ce8f6325b980da8abf0b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699827316, "uuid": "1eb8777b-731d-4dbf-8476-2c1e54a3e9b9", "comment": "Malware payload (RedLineStealer)", "value": "46c54732e36152f2ba4ecd49c29670acb0c36beb4abcce2785bfb0c9922e972d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699827316, "uuid": "9c83f4e9-2275-46fa-959d-f89fad9f997c", "comment": "Malware payload (RedLineStealer)", "value": "aa4b366999c15461f785a95a3e6b0945bf7b5df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699827316, "uuid": "cc3c1eaf-2292-49e2-8cbb-c8e0af3d0a1b", "comment": "Malware payload (RedLineStealer)", "value": "00432f4ff60da713d00f31f00879abf6e74a16aeb7c5fa1791c8227adc9dd76c78ea6aabe52cc0e9248ce9a1a2f31a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699827316, "uuid": "4cead962-7470-4aec-9d20-40fa4eb5cc07", "value": "T169944A291C77F15FC1CDAD747280A58A4FE5472B0A08CF5CD6FB023A259F4512DBA2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699827316, "uuid": "77803c28-5f9f-4d6c-933a-475750c6d7c8", "value": "ba5b149a2e4fb51a5d20796e3fe73b7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699827316, "uuid": "5c3a64e4-62fd-46e0-8d0d-187b8d41b230", "value": "12288:RaqR/DmYCSMMMMMMMMMMMMMMY5551G/YkaJ:RB/lCSMMMMMMMMMMMMMMY55m/Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699827316, "uuid": "de9d19bc-e109-4ad0-938a-361947dba12e", "value": 416340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699827316, "uuid": "b7a27dd9-04e0-44aa-9fb2-f8917fd02b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699827316, "uuid": "0bdcbe41-a65f-48d5-997f-2640fb3acf95", "value": "6455B2A348CE8F6325B980DA8ABF0B10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092f3352-813b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699780105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780105, "uuid": "08f3d80f-bab1-4f3a-b80a-d1242510bda4", "comment": "Malware payload", "value": "0c57f4d4c69728e24bb9fe49a861fa39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780105, "uuid": "050bb5b7-14d0-4a58-a388-fe22e940baf1", "comment": "Malware payload", "value": "471e7356f5688b05ab5ae1608a09f1af680ed17b7b857138f404a6321dcca7e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780105, "uuid": "5156f7f1-740c-4ae0-b01f-b322b4575d0a", "comment": "Malware payload", "value": "0630f239b1585534cba77702b04904e476932421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780105, "uuid": "b71c3938-8fa8-4f8e-80dd-fc66023aa62d", "comment": "Malware payload", "value": "5c3e7ccea30738c110f0929ed8652867fd0e57c7b9d714a1884bb196c514b149068fa09294dda1aa47dcf68907d036ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780105, "uuid": "7508cace-ff7d-4044-8cd8-ba5ef00d6f8c", "value": "T1F3C6010162D2EA4EF182BA2C93F567979276F30193E7F03DE6607A15017B178D3362A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780105, "uuid": "619bc1b6-e131-46e6-a0e9-b11b1eeb00ec", "value": "196608:yrmkTQoH4bFbS6x5qtgguBFXpxobpk+1YSn+nOsphb+Yh3nh2oEc3R:o96bS66XubXpebu+2Sn+Lj+W3nnEcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780105, "uuid": "2f6e5a2f-99ea-4ab6-9cce-53238677cf26", "value": 11889258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780105, "uuid": "885dc7fa-db30-4baa-95cf-4ae144830adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780105, "uuid": "caaac1b9-1f4f-4496-9e5d-f34eeaacb39a", "value": "0c57f4d4c69728e24bb9fe49a861fa39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4a0b24-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822734, "uuid": "ab1b746e-791e-4188-a027-a61286d25cd4", "comment": "Malware payload", "value": "e0f5089716b7e01773324dd5290b7e75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822734, "uuid": "a6059917-50ac-4d63-812e-f0629ce72c4a", "comment": "Malware payload", "value": "475bf354dad517129903f7f1446f44f74f79a7643bff2a26f8890a34976f61a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822734, "uuid": "5ebf716b-23fd-4d81-9204-617c72fd1ccc", "comment": "Malware payload", "value": "22ca517afc07036838057949deb3a16e451639ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822734, "uuid": "bca86fde-07dc-4ca8-a500-71d550bb870f", "comment": "Malware payload", "value": "efece70111a97a20d6929dc88fe787aa508acf3a74b47502a604ad0c76a4acd9cba6b85a3b5373a9e2f56f146b9ee106", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822734, "uuid": "4936e05f-4f42-4d75-b5d0-b800109ba96e", "value": "T1F3532A03BA4184FDC09AC1B41B6AB93AF87631FD1338B5AA77D0FE366C49E211D4E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822734, "uuid": "34b794fc-0882-4952-ba55-f5480f58d60e", "value": "1536:8t7HjUwUhxVwlizBEwUkygBSF9BKPyLkXGugZdufgkGaMUwbZnFf:A7HAwWjwlvKyMSjBK4kXGugyfgZaMUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822734, "uuid": "a1d80b2d-c426-46b5-b58e-c8c876febe8d", "value": 66496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822734, "uuid": "2666b21a-60bb-4f96-a53e-7c00832c6045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822734, "uuid": "91957bc9-0335-4df3-bbbf-932eac96c66a", "value": "skid.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934ae7d9-81a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699825434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825434, "uuid": "f09add02-ea43-4ef9-b3c9-63f73c15e70d", "comment": "Malware payload", "value": "89a4f7fa602a7ac72228c2700bee8853", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825434, "uuid": "3229ccfa-914f-4fe8-ad94-3d1ae8475a5e", "comment": "Malware payload", "value": "47d69ee35640d29fbf9854cf222e40f537dfda4f85f807aef650006626431168", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825434, "uuid": "d20acddf-cb7c-4233-a478-27fad20a02e2", "comment": "Malware payload", "value": "1f98bbf0ec4743e7cd9fde1b42bfa830ad0faed5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825434, "uuid": "e78c250e-114b-4b01-a545-1740c0b6f2b5", "comment": "Malware payload", "value": "1396cb7bc8be73ece00f57ee616146ff9d3e4c19f5146d9476ece30e024887354cbe81c9fb1779f73f387fed6dc4c422", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825434, "uuid": "db360fa0-953a-4064-a1a7-d2b3e3ee3377", "value": "T11E633A96F801ED7EFC0BE77A40470909B570E3E456A20B3777A7BD93EC721A56826D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825434, "uuid": "52fc027b-0376-4520-94b6-03dc3c5809d1", "value": "1536:OHUsUVIwrKeq3JY+/RxNt8TC83aecHtIBT/jrEVBS89eTBnHT:OHUsUVIpZ5J/RxNbicHyxv89eTBnHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699825434, "uuid": "ef67e335-a0b8-421a-8385-ddf5c0f5ab62", "value": 71788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699825434, "uuid": "2fd829ee-5068-4cf4-bcfa-453d678a9c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825434, "uuid": "7df5d5db-21e4-41a3-bc3f-ca7c5c8c6838", "value": "89a4f7fa602a7ac72228c2700bee8853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1062606f-815e-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699795149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795149, "uuid": "13b30479-e90a-4372-bca8-549fa7284c31", "comment": "Malware payload (Stealc)", "value": "1a8ef3bded8abf310891f496b8b20245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795149, "uuid": "e19961ce-e376-446c-8576-d05f87f9a55c", "comment": "Malware payload (Stealc)", "value": "4a5df0d4b15783038ab017abf7a6233ee1d0d0843ca4e641d5170d29d0b46529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795149, "uuid": "ed533a3c-dc21-4007-83fb-8fe47217daf3", "comment": "Malware payload (Stealc)", "value": "b334123ae443f6e31fd84b14d7ea7f461555b3b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795149, "uuid": "5fb34027-668c-432d-adc9-35fe3d1642ec", "comment": "Malware payload (Stealc)", "value": "693251d5bbc154538c23f44eb627669bef6854fd6534dd990aa4c63c94c910e422a803539cd5c3e4437028125caab9f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795149, "uuid": "5ecc6407-9459-471b-b29d-141615f1ce89", "value": "T11565238E6BDCA076D5721372A0FB868306367C729D7C975B2399259DDCB2DC02934B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795149, "uuid": "65f08942-7758-4507-96d4-121eb7ba7427", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795149, "uuid": "55caf0ee-3347-48d7-97d2-ec04e6c039f0", "value": "24576:PyEA/LwKCnEniXC8eqIsl0IG0YeDaB0Q43Jnooa7EzYrhzPzmLtvHqq:anzgnEYzexmXGwo0QFoa7PrhzrmLtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795149, "uuid": "1d7c9d6d-ad38-4e06-bd0c-499d926ac7f0", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795149, "uuid": "4be55e39-d013-43a4-91f1-c90a62b0e041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795149, "uuid": "af1714ec-36b1-4546-96f3-253a3e8b26a1", "value": "1a8ef3bded8abf310891f496b8b20245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0258f2-812f-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699775008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775008, "uuid": "cbf9bdfe-2260-45ce-8a07-90e37da9723b", "comment": "Malware payload (SnakeKeylogger)", "value": "b1c08999736441acdbaacc4ff1845d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775008, "uuid": "13675230-7ffc-40de-92f5-d4d6662f9823", "comment": "Malware payload (SnakeKeylogger)", "value": "4b3bab16ab902ffc20293209b8fe86c6e93502648b6788601b41a1934d2822c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775008, "uuid": "20f31070-9c9f-4716-877e-418fd7448417", "comment": "Malware payload (SnakeKeylogger)", "value": "b28e3408648a55f92a203554b74cf0fd1a078427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775008, "uuid": "e597a20a-c4a1-498c-92c2-080d3dd422c6", "comment": "Malware payload (SnakeKeylogger)", "value": "4f0297222ca3d97833a3a40c137fd10ee29020f73ca9f00adfa9a92055260a43bf25ed3f84f088e94397fae26d92c574", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775008, "uuid": "fc462661-e7ca-402e-9482-29aa8e6cc1da", "value": "T139C3F71C67F88800F6FF997311715211C776FC42192ADE1E6AD0F95A2A7D7A08E0AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775008, "uuid": "7d31f25d-2953-4834-aaa8-d05ab4d432fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775008, "uuid": "80138f95-6802-4948-8971-c32fea9a72dd", "value": "3072:qjdK8uu56pQKU7X7ca392b73FwBNZDgbY:uj3IbSZUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699775008, "uuid": "8ba37866-ddfc-48b2-85e6-866ef03086a2", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699775008, "uuid": "dd204705-d5e3-44f7-8d87-e09bfe5d0bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775008, "uuid": "842bf1fe-f57d-4d8b-bf35-a8ea569d6fe0", "value": "b1c08999736441acdbaacc4ff1845d82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f26da2-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822732, "uuid": "cde6daf3-549e-4af8-982f-02b538566918", "comment": "Malware payload", "value": "5f5804b0be9367558b7a863d6d0dc9d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822732, "uuid": "c6ff23b6-5c87-4512-9395-457b976137fe", "comment": "Malware payload", "value": "4c7147056da1dcc8063bb4876fd4f83b6bf5d863c65b34ab91ae3545385b7948", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822732, "uuid": "72cd9947-66ad-4ecc-b0a8-9a422fa699fb", "comment": "Malware payload", "value": "436092c8ec27b018a9aedf41215fac2561756845", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822732, "uuid": "1183f3fb-27a8-4b87-ad6f-50b59509003c", "comment": "Malware payload", "value": "95115987951bccaa7baec0573ff6f7f63484d05743bb41f46de77402b5f15f2fa3ee66cc50697b52ce8864a2f903e755", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822732, "uuid": "e166751c-9b6b-437f-92ae-14aa2aa20368", "value": "T1AF633A95F9815A13C6C602B7FA6E428C3B2513E8D2DF7203DD216F217AC781B0DABE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822732, "uuid": "f521cfb7-7335-40d0-a6d3-72707ac310ba", "value": "1536:KnyorX4GaLApVhWXi8/CAkFfrOcJYrAuvyZwbZnN:KnOqVhysA8frOZvyZwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822732, "uuid": "84337330-c7bd-4294-a305-b351c7b4b601", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822732, "uuid": "6047d937-7281-4451-ad5f-94d6590fda5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822732, "uuid": "0cc8458c-2bb1-48a0-906f-a755343ae27d", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36e0cae-8196-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699819528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819528, "uuid": "f26bc08f-e113-4203-acde-39696590488c", "comment": "Malware payload (Mirai)", "value": "078a4519746a362adeb1ba2e84762478", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819528, "uuid": "381f93c9-8079-42ab-a583-1bbdc5860ad4", "comment": "Malware payload (Mirai)", "value": "4e85b7f68902d191af18a0de5263882dfd32a66329960928d3b696a533a6f73b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819528, "uuid": "9d82e15d-3d00-413f-8381-c34cbe97fc01", "comment": "Malware payload (Mirai)", "value": "ec78e5b14cb12deaaf1ab59e2e100480768e59d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819528, "uuid": "b63ad9fa-9f6c-4fe3-9edd-e7ed05dc7f26", "comment": "Malware payload (Mirai)", "value": "5e2bf7a7d7c6e37ee45c1d4127c5940452c3efeca0694c75613a10ebec29f853fcdea36bd93c5f7589b650e36f82db26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819528, "uuid": "6534102e-cc27-43da-8d40-43ee175399a0", "value": "T13BF33AC7F800DDFAF80AE33748534809B130B7E115925A37625B797BED3A1993867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819528, "uuid": "33bc5319-65a1-4aef-8cbe-1a6872c0bae1", "value": "3072:FuT91DDqvMqg7oZ+/JAQ9nY0JVrjbifLW7ezGHyxxxDKL:ATP6+hAuY0QLWCoyx/WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699819528, "uuid": "bc6ab7e0-28c3-4c72-8d20-d3edd1bb6feb", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699819528, "uuid": "a1f1e7c4-6ccd-453c-b5b7-85ce12e949cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819528, "uuid": "9a7de89d-93c9-4e8d-b554-863bf5deed75", "value": "078a4519746a362adeb1ba2e84762478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3486bb04-8194-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699818403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818403, "uuid": "c80c0dfa-31d1-4e81-8600-3661a4ee4761", "comment": "Malware payload", "value": "912a9f5960f78c14a1bfe528860b5cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818403, "uuid": "9fbe01fe-7c63-4a76-9075-ca283bfd3792", "comment": "Malware payload", "value": "4f49150cb8b4ed358d59ab2d9e15a6161b69658e45e54419c536dd77487a2fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818403, "uuid": "c5eaec64-cd1b-41b9-8878-a7eed732758c", "comment": "Malware payload", "value": "6e23c3b72f56358efc066b6ae60d173902a0f033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818403, "uuid": "3d57ad08-1ebb-4000-b075-65dcabf2c1f0", "comment": "Malware payload", "value": "ccdd85580e070c367c5f46704155a10c3b715029f2e626287afb968bf492cc7a38149d11cc629edb16c3c553df529a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818403, "uuid": "6646e193-d238-4fc5-b040-2cb47331822d", "value": "T1A6F4120E9BCB0AE9C5EC0A7693B658E412F1A2BB2501F3BF45C491F1EF5235B45921B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818403, "uuid": "697cf191-a79f-4e03-95c5-4e9c51e900e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818403, "uuid": "8fba4c67-b97c-4606-8f17-f23b7628f216", "value": "12288:2ufjVpNKUF3OjhlYnf8KPGNaTp7WeqCdmgzKrQXOxTXbebLw7:2sGQOjhlYUUGkp7FzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699818403, "uuid": "4048c44d-3a21-484e-b701-92847dc154c9", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699818403, "uuid": "00897eae-a141-4461-b733-7dcdf413051e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818403, "uuid": "155abf84-48fa-4df7-9e37-ac185ea6b324", "value": "SO-0093848222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84707a0-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795458, "uuid": "1741446e-3a00-4704-aff6-0876dedc616f", "comment": "Malware payload", "value": "8475431474b19678905c1fab45fbe6ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795458, "uuid": "5cbdff8e-04ef-41cb-85c1-ec2d5501e4a9", "comment": "Malware payload", "value": "5145a51514f62d49ea0124a2e659ba9708bd67db840fff193fa00268c32edb45", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795458, "uuid": "6564fc61-3e3c-4988-85f1-b74a35cdc989", "comment": "Malware payload", "value": "2cf4a643ba3794310933d1e5471aa6bcc9bdf3ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795458, "uuid": "f89018f8-a322-46d1-ad15-d2eb03420fca", "comment": "Malware payload", "value": "57d3fefba65169912e4d253d9e3987d632d6c9dc77ed37cbd1f4725f2ba99cffd2f0bb62a5e1f801eb36bcbd9c845dc5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795458, "uuid": "f26fe458-ba91-4d79-a659-e6b11bcc19b1", "value": "T132A46D1936A3E8F7E2B88B301A82DA9CD96368515D1487CF7DD4960E2C7F1D4DC332A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795458, "uuid": "76a4a195-f5ac-4d42-b3c8-0e1dce85620a", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795458, "uuid": "937419c7-12a9-4078-b10d-850075de4f5a", "value": "6144:+RR5rhZFQGrsUwF7vlPoSa8CAVhwxzS/MIxOyYT:+R5nWFpPoS0AVym/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795458, "uuid": "e3233ae7-b703-40cd-a352-6e1d0d5551de", "value": 486297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795458, "uuid": "4b94e160-8dff-4f1d-9813-81de7400bafc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795458, "uuid": "5c44520b-cd72-4b81-ac0e-bce69474c93d", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.27446.15917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac8f0fa-8139-11ee-8907-42010a9c0042", "comment": "Malware payload (Adwind)", "timestamp": 1699779329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779329, "uuid": "563158b9-a0b5-40cf-b561-1782b7abcf2a", "comment": "Malware payload (Adwind)", "value": "f858788e48ae55d66e9ee3e32bf8ffe8", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779329, "uuid": "a3fb2c18-2964-4982-b82b-ba7d0c253f30", "comment": "Malware payload (Adwind)", "value": "53c6d1f46dc1afaa9b9f11ea5966a1c4368675b298a16c0396f39074ee5b5b5d", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779329, "uuid": "85f42709-8579-44db-a776-1d215fdfbb22", "comment": "Malware payload (Adwind)", "value": "ccfbeac8e2ac39c140a517b64317db0f36d67f15", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779329, "uuid": "d1d76606-de6f-4d79-963b-e80edcdeb1cc", "comment": "Malware payload (Adwind)", "value": "b44d792043c450786ac47d828854cff5eb22eb845faca512624a13590dd6532014e8825101bd21041cdc3e21820be12c", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779329, "uuid": "fb7b0c62-f8ff-44a3-88f8-c6844fd420ac", "value": "T16424121865E3D25AE8477631532D918C1E7E8AC176C178EF650EF3A370ADCCAC692E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779329, "uuid": "a86ffc56-c5cb-420c-aabe-745c1682b3ef", "value": "6144:pr0qgVWHpvKfbliPw/ar688jpmO1oSz4D+i4WagXeatLK/:+qNHpiD4Pw/arN8luD4NgOatq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779329, "uuid": "2457a058-c924-426f-ab66-d01bfd16a8e9", "value": 211064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779329, "uuid": "08b7cd39-2a5f-4357-9d33-6d48af8ebc22", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779329, "uuid": "3dfb631c-d5e5-448f-801c-eaf7285fb7d2", "value": "f858788e48ae55d66e9ee3e32bf8ffe8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856b2b60-8147-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699785467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785467, "uuid": "3898b564-6f0e-4c34-b33c-e94416e65356", "comment": "Malware payload (Glupteba)", "value": "6390ed8c0f7fc76f8438e2fc48140183", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785467, "uuid": "d95c789e-80d9-421e-a79b-cb26a0a571a2", "comment": "Malware payload (Glupteba)", "value": "57e6d08c8b17fb8b5d0774e7faca77c094c565239e0abdbfb7a3592521c97c65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785467, "uuid": "29ab9467-0d43-4165-8215-92e7dc0ca568", "comment": "Malware payload (Glupteba)", "value": "58634cb84d7c425b68e642a53b85350cb41ba676", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785467, "uuid": "cb1f8331-34e4-46cd-99a8-aa002fe027d2", "comment": "Malware payload (Glupteba)", "value": "c9abf9eb1cea561a11f48d3922e9549a9fe13c3cdcd379205a3d24c97e5c647b27847107edf3df6151c1c25992363307", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785467, "uuid": "5ed8e41b-9558-47f3-a231-e9915567a2ca", "value": "T13116330352E03DE5FA15CF728E1ED69C7A1DFA005E49BF5E120D8E7F09B11B6E262A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785467, "uuid": "8191337b-b6cd-4905-9bbf-2586a51f88e2", "value": "a61108037be4958099c89e54a69d67fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785467, "uuid": "885a6a66-c12d-4f63-8ef0-82fcb6d81c94", "value": "98304:Yn3gI4jRfCb12GFB3fMb7XOobdcEu3ZdSLF+VggZxpt:g3mfi2QEbSMdcBpuiggP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699785467, "uuid": "b76ee5dd-daf4-4241-8927-c726251c7241", "value": 4315536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699785467, "uuid": "491fbc74-8a59-4a07-bb57-8a7106d535b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785467, "uuid": "d6587d31-1e28-4daa-a64d-b0b01a5732db", "value": "6390ed8c0f7fc76f8438e2fc48140183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6f9fa0-8151-11ee-8907-42010a9c0042", "comment": "Malware payload (Ransomware.Babuk)", "timestamp": 1699789561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789561, "uuid": "c2d353eb-8e4c-4922-85f3-19012227b676", "comment": "Malware payload (Ransomware.Babuk)", "value": "c187a67964317906c0ca397fee23edb0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Babuk", "colour": "#A38774", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789561, "uuid": "f7c0cd6a-b86f-433a-a986-59a5ad5eefa0", "comment": "Malware payload (Ransomware.Babuk)", "value": "596896cccc33940457c3b7067409a69279c5fadd8a442f72d01f9cfd53ac777c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Babuk", "colour": "#A38774", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789561, "uuid": "51787891-761e-4c77-a95e-0a81878ef6d2", "comment": "Malware payload (Ransomware.Babuk)", "value": "5cd31001fe8304f4171d2eabff6e83db265cb967", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Babuk", "colour": "#A38774", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789561, "uuid": "57762b89-849c-4228-a67b-1ef39c95eaf2", "comment": "Malware payload (Ransomware.Babuk)", "value": "1e9402036d2f155c8cf1aba73a223761b80fc019fae31a80f108706e8438ce8bd765fe6572137d85ec3a57a9552b96e3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Babuk", "colour": "#A38774", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789561, "uuid": "34edd39c-407f-4571-bc3c-b667cb160135", "value": "T1A40633428B7DDB749EB3208FB899A9815F0D6599C0E5C3F23D3197190A337E524ECC9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789561, "uuid": "36946a20-cdfa-4119-8cd2-8a3acae25d68", "value": "98304:T6TP0yqAerg5QxLzEHZorJC1bnY36cL1YSmxmJjEPqjJE+tm:T6hAJIHZxSSx0YPqj21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699789561, "uuid": "4236eb1b-f165-40e2-bbad-895892950eeb", "value": 3962824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699789561, "uuid": "e417ac6b-61d3-4131-abdc-ed5b649671a2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789561, "uuid": "1713ddf7-47cb-49c7-bdb0-8ad3b34d7848", "value": "demo.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a68c8c-8190-11ee-8907-42010a9c0042", "comment": "Malware payload (Nitol)", "timestamp": 1699816739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816739, "uuid": "67981a9d-1d38-483d-a936-0cfb7f5915c6", "comment": "Malware payload (Nitol)", "value": "9870d85590d3cf20dc427bbe4c1f0d73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816739, "uuid": "bc22e1d1-f2d2-4565-8130-d329eec3d87d", "comment": "Malware payload (Nitol)", "value": "59a845af74150d8fbca355b6248f4e7b46ddddd243c45c1117892c97b33d82d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816739, "uuid": "7747c426-56fc-4bb3-9454-b14bab6bcc7e", "comment": "Malware payload (Nitol)", "value": "b232a972d9c368cc72a4a1fccc8bc3dac87a039d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816739, "uuid": "9d32e22e-082c-4997-a8fe-b9457d938776", "comment": "Malware payload (Nitol)", "value": "39d8c3db245447fa566d6bcb6b6e783a42d6f23bd4d1fc0b77148bd49c41ac5377732a347f6c2a2adaff4b34e127aa6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816739, "uuid": "c5e88939-55f5-4fbe-8cf5-88167d95c3eb", "value": "T1E4736C217691C1B6C44964319816D7B25B7E79305BF8D9C3BF590B7E4F223C0AA3A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816739, "uuid": "c26e9316-40ca-4df3-82cb-1e34cdd0ab7d", "value": "f61b3498a024e1606e5633ff05e57b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816739, "uuid": "0883e85f-edec-4e36-a78f-68598381fb4d", "value": "1536:awsdCFnE4Nz1/SXPtpoprAeDYxUfGkhK5O:awsAik1a4pGkhK5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699816739, "uuid": "6fc04cb9-6840-45d7-a045-4ecdd20d4d00", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699816739, "uuid": "0e878f55-0d42-4831-88e6-c64aa85b0e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816739, "uuid": "9a0bcda7-33c2-4340-8ebb-d240ff5f242b", "value": "9870d85590d3cf20dc427bbe4c1f0d73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d1ed81-812f-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1699775027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775027, "uuid": "e73f822d-677f-4806-958c-2858817e9dd8", "comment": "Malware payload (CoinMiner)", "value": "16238bd34081232d2ab2850da8abef37", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775027, "uuid": "5538648c-ff1a-42b5-be7a-f7c6b68ccc89", "comment": "Malware payload (CoinMiner)", "value": "59cb46a6e83ca6232d834b473a7aea04b56905a486ee872f7282ea83493a66ba", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775027, "uuid": "dea704e0-5fa3-4a34-9bd5-92335adf0e0b", "comment": "Malware payload (CoinMiner)", "value": "1a823248b9793b0f74264483eb328adf1e8623bd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775027, "uuid": "9adb83eb-147b-4009-b2c1-64f11bdf422e", "comment": "Malware payload (CoinMiner)", "value": "3e66ddb32ac7607b4a7a37ad83d663bb76ed11602b43b6b32cba15cd17c59b72fc64a52c03fcf12f693707bd5c344bb9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775027, "uuid": "3bdd89b7-170d-4658-9208-14be83761c0d", "value": "T190459E2276C2C536D57F0670292DE77A056E7D200BB185EB53DC5A2E2FB24C29632F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775027, "uuid": "de1f73cf-f720-40eb-bfe0-7488eb7478f9", "value": "24576:xWIYKztdfG8NQGafA5be/IEFXsaV5C7eYVLsTPRDKe:xWIYefNQGoAlRaV5C77yPROe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699775027, "uuid": "156cbf28-4ec9-436f-bc08-f5a32d7cf258", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699775027, "uuid": "bdfb99f4-abbc-4a02-9a31-f6dbd86907ff", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775027, "uuid": "5f1f4ac0-2c36-4e21-ae9c-667dc64fa267", "value": "nf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a1d254-819e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699822834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822834, "uuid": "79c114ba-5eb2-4af1-be05-2486c72836a8", "comment": "Malware payload (Mirai)", "value": "de0eb825f0bce40296089a12810eddb6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822834, "uuid": "1401c643-68a9-487a-93f9-0115ccc9d9d5", "comment": "Malware payload (Mirai)", "value": "5bcfec1f5947a55191835b069db5fa95bc0b9ecb5844c1d5675f0bffa20ec35a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822834, "uuid": "eb2708f1-1d6a-48f7-8bb7-653f39cfd713", "comment": "Malware payload (Mirai)", "value": "463e4b187f4490886215b16b3473fac8585ac609", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822834, "uuid": "02c2dc50-9e2e-4261-8717-77cb25c43958", "comment": "Malware payload (Mirai)", "value": "fd5e2b3a5d80a0514f1de0511db9a37af0929e0f2cd64e242f67b576a85dbee3ddac5766025865ad660674ed0af3f7df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822834, "uuid": "21602935-6774-494d-9285-590ca6867eef", "value": "T16CD33B46FA408E53C4D5177ABA9F42493333A764D3EB33068918AFB43F8666F0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822834, "uuid": "62e0721d-0464-44b8-90d4-d7159fe70148", "value": "3072:BILerNPcNuiwwOqwqHiL4mnfee6gbORn+F6M/9MB1x:6LerpcNuRwf9HiL4mnGeKn+4M/9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822834, "uuid": "cb0df086-65fe-4db2-95fe-6ee5f8c528ed", "value": 138561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822834, "uuid": "7de0d0c3-4a32-4d1a-9b43-85046804600d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822834, "uuid": "61202753-8169-4eb2-935a-57b39f89602b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30dbce8-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795422, "uuid": "78eaad4e-f775-491e-aea4-4e33275e211b", "comment": "Malware payload", "value": "685e93f869fb500275b479b924071318", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795422, "uuid": "928bc169-aaa9-44ae-805f-255354a2191c", "comment": "Malware payload", "value": "5db6f88d34a97dcbeb1ef4807be9342534fbb9e19cbcc797a7b8aea44af1217c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795422, "uuid": "560ed374-0569-4723-aa8c-a91a8f3dd477", "comment": "Malware payload", "value": "9451b321988c9d9012db6aac54bf2b5db070cae3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795422, "uuid": "9b49a004-01f8-4911-a43d-5d24b08ed08e", "comment": "Malware payload", "value": "d88a5940557380b932eaa526cddcd23ffc6d7f791d3ee12fe572a581eb4d7b6a30ccf58f2ec60b0d57a74b909e9ec801", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795422, "uuid": "c5394708-9305-4cac-a05c-95d9aad54e8b", "value": "T1AC54A21B3AF2CC6BD1750B300CF686A69973B5206DA28387A7AE57BD1C271539D33136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795422, "uuid": "a0dc1dfe-177b-47bd-8d67-f1e25e4980bf", "value": "6d653b32e0efb1ff87f3cfe21a9d8db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795422, "uuid": "4de38f46-0c3b-4979-ac43-f85b9ec05ecd", "value": "1536:zH3Tr0Jxo71nK1tjgv05ons+QD1ryr5LCruzh5PJvX5njQ2OQUXJwt35oe55REVM:zH6xsK1tNgjnU2OtutlctkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795422, "uuid": "f8feb082-e2c7-4160-b3f3-6649e8d8daf0", "value": 291141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795422, "uuid": "acd58c4a-21db-4117-9101-30cf409c340f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795422, "uuid": "b34886e8-1618-47ec-8f4b-0ebf78a80f52", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.22071.19600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426d446b-8112-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699762591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699762591, "uuid": "8b6734ad-104a-4efd-82d2-461f41f9607b", "comment": "Malware payload", "value": "6afe6a81315cb958ee185a29465efa86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699762591, "uuid": "409582cf-3361-4837-9163-a55cebaa35a5", "comment": "Malware payload", "value": "5dd72236be3ec2c844aa4d33f9dea29884b78adf0d27ae6acdde08f7212a175d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699762591, "uuid": "785a7d08-5b0d-428e-a9b8-0ab7ef4e0ec9", "comment": "Malware payload", "value": "8efebe3eec367c32ecb61940af7dce6db17f8c8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699762591, "uuid": "5d60da73-13c2-4f18-9e3c-b3dd3ece7af2", "comment": "Malware payload", "value": "b966112ba09532d81f590b29f9aceeb97ef10a0962994922be691f7a63086ca312b7947728083d6463d8f4637cb0f08f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699762591, "uuid": "308784b8-0ba5-4405-9655-8bacd69fc792", "value": "T1F9150E9D765072DFC857C972CEA81C64EA6078BB531F9203A41326EDAE4D99BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699762591, "uuid": "2e602258-eff3-448c-803a-a0b3fe78d60a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699762591, "uuid": "3d14cd43-c499-4a1a-bdb7-ba15352d04f7", "value": "12288:kdWxEqX46DR5KDIQOxFcJam833G3sjl0Bdf3OBzRhkZnfPx1V4tZC9yNddopxNKu:rxlX46D7K2joam87Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699762591, "uuid": "ae53978a-4c66-49ed-8846-b5fcdaf93755", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699762591, "uuid": "3dc864c2-7065-4ddb-ad6f-c23145e971ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699762591, "uuid": "f03a111c-da07-4c8c-87ef-b5e7fed15ea8", "value": "6afe6a81315cb958ee185a29465efa86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47209863-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822729, "uuid": "3b2797f7-750c-4fab-bc6a-7956b5381f31", "comment": "Malware payload", "value": "8993a1e671b231bd2ac9a0c92e3b3013", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822729, "uuid": "ec061013-aef1-4c7f-b306-32b5b083132f", "comment": "Malware payload", "value": "5e5912e867ca7ac9804f20548d3eb7c59723f4b426a62f42e115784a5154ded4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822729, "uuid": "4f95cd11-aeef-4d17-9f3a-710927e1d2a2", "comment": "Malware payload", "value": "002a9ba01f98f03836532a08c951861bbbd1c72e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822729, "uuid": "424e2775-5724-4f66-94ae-5512cdd07e4a", "comment": "Malware payload", "value": "d8be5afa4aa8cdf13f7fd75c1b8d19409779daae818859d65fabd44cc1d8f880095d114643e1e1f92046f3aa1f03e018", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822729, "uuid": "828f63f7-b071-4ac8-b7cf-e5b54b446801", "value": "T1E1E34A46FB804F13C0D61776BAAF4249332397E493EB730699287FB43F8669A0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822729, "uuid": "93e92cef-5d0a-4f55-8e48-b6c27496ff2b", "value": "3072:DVtbZqTJYMwZpJafTWSn8bWO2t6XE95qwbZnIMXy0+M/9l2IC:DVtbwO7bJafTWSn8SO21jqwRIMXyFM/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822729, "uuid": "85da36c6-8e19-4c5e-ba7b-2a269702f042", "value": 154968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822729, "uuid": "86ffdb04-2bf9-4214-a2f6-1a50f314d132", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822729, "uuid": "5ff1d7b6-8a6d-4361-9746-e29f1636eb1b", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10f317f-815d-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699795070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795070, "uuid": "b1699b11-50e1-4b88-a27d-d770e255f4d1", "comment": "Malware payload (Smoke Loader)", "value": "63d0c51992d6315476ece5968e37f9a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795070, "uuid": "ab15097a-e20d-4a3e-9c01-38db584ca10c", "comment": "Malware payload (Smoke Loader)", "value": "5ee5867f9daa90dd41bd839aeac7b34c8f2942372c00a290bd6807f3c8aa7a20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795070, "uuid": "0437626b-42a9-4e85-96e6-7cb7ff609e6e", "comment": "Malware payload (Smoke Loader)", "value": "8c4ba0f506a4edd2d3180b76de73770b20153779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795070, "uuid": "a690e5b1-d585-47e0-b3c5-3c0572891e44", "comment": "Malware payload (Smoke Loader)", "value": "60493d84d67b2d71e1c1d4febf90960a252c397094407146349bc2863e5d6dc4d2b05cfe5d1541a4088ead4d8e0b6b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795070, "uuid": "3a46e88d-2d1e-439f-8346-c25c2c933d85", "value": "T1BC652367BFECA023E8BA4B306CF607170B34BD41EDB8921F7259995B5C328A09571367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795070, "uuid": "3210625f-a621-4367-aee4-650c6ae407fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795070, "uuid": "55cb03cb-ce22-4cf0-98f7-aeae39844d8e", "value": "24576:UyS//wJijsLm21ePIsT8UGcC+DVeXxDGfbZlEq37d66K9yaZGmitX:jqwJijDWeg0BGu5UxDGDZGqJwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795070, "uuid": "3c951d52-b203-4556-b5bb-d6bee8c24432", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795070, "uuid": "b832e3df-2d23-49f4-87b5-c86dea5efa75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795070, "uuid": "1f004afd-e297-4f65-be9e-db315908de67", "value": "63d0c51992d6315476ece5968e37f9a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f892c3-817d-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699808681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808681, "uuid": "6e6ea4a2-8b89-4655-9f57-c6d777f27ae3", "comment": "Malware payload (Glupteba)", "value": "1726bf86aee28d66f2310b5563ea6a11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808681, "uuid": "47cbd75e-167e-4091-afb3-88f6e96c1316", "comment": "Malware payload (Glupteba)", "value": "5f8189c278f4bdb8bd8be6e198a4a1b1d79e38261f299d1f2c8c7d3d00354ef4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808681, "uuid": "34fbf38b-b2f5-4fd7-a3cd-51c1583090de", "comment": "Malware payload (Glupteba)", "value": "3a051d0a4a79e28ed41539cc5d6fcdc5aa5b42d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808681, "uuid": "48280f23-a122-44d9-810a-2a1b8ba862fa", "comment": "Malware payload (Glupteba)", "value": "8beef22e5dae91ba7b338be204bb292a99fabf4907c9cc0525ba02462169e297abb46062c853b0dee28aba6ba3f26e12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808681, "uuid": "04235788-823b-4b27-ab16-75994d77ed51", "value": "T18316335381F13DD4E5348F328F5EC5EC730EB6848E19BB6826289F1F05B22B6D196762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808681, "uuid": "33ab6c21-3622-4051-a469-6029ce193058", "value": "b9f69a119dfb935d85204ae1d9e63436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808681, "uuid": "2948f829-321b-43c1-a78f-5cf6e5c6e7a1", "value": "49152:H2+JiQYrzZsy4qfPcmNCuwwVapNjfaWhrRbGkMAkYJB5gcZ2ldoTTdZIrftuzxZD:W+XYJssfNN8wVor5xGk7JBwofIbtufZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808681, "uuid": "6ce76447-fae1-469a-bab8-08c29e203c1b", "value": 4316056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808681, "uuid": "26678e08-b777-466b-9da6-3096930118f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808681, "uuid": "94ead8ea-497b-4daf-8140-0a72ea05e83a", "value": "1726bf86aee28d66f2310b5563ea6a11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38c9547-80f6-11ee-8907-42010a9c0042", "comment": "Malware payload (N-W0rm)", "timestamp": 1699750836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699750836, "uuid": "141bcc34-c56a-42f6-943b-80cab0b0207f", "comment": "Malware payload (N-W0rm)", "value": "55816a7763d094b31acb49042117a11d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699750836, "uuid": "abdb3997-90f0-4f99-9d7d-9098a836c3d5", "comment": "Malware payload (N-W0rm)", "value": "604d74771e04b36b54d5dba085da04a6a45f9c0138618576edc5a063ba5a36f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699750836, "uuid": "1c57668b-654d-42de-ba1f-56ed6a290748", "comment": "Malware payload (N-W0rm)", "value": "ae380a2f1bd1dea1ed7ee3c194707bebbacdad81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699750836, "uuid": "b29e05e1-7cba-478c-82dc-7ec186d001ae", "comment": "Malware payload (N-W0rm)", "value": "26ba3b66a07e177010ca0ffa9831483bfbcb5fb89203bc9c7fbe6c574fb0bd97f1f56c229bcd7a65803b0f641cd3d2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699750836, "uuid": "dc868312-76cd-4c5a-85b9-b780a8d3e3d0", "value": "T1EF6523462ECD8133E9E61370ADF3069705797921AEF9A16F7222984B49B3BD0713433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699750836, "uuid": "b1c5c100-8511-4c85-86bf-32b361784929", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699750836, "uuid": "bdfddf49-2864-43aa-8a9a-1f9e1b62e25b", "value": "24576:lyahlyaBM6ThQSOqVeAIsgwHGHl/D/bRjcv6gaHNj9M/MIPpzzmd+wMsuz/6WItj:AelyaqK5OueHPmGpfRjcvsIlzmsslt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699750836, "uuid": "0c3394d3-21ef-4857-a7bc-c21639b33eb6", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699750836, "uuid": "36ac7965-9346-4ae4-a792-edaae2bb16c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699750836, "uuid": "c1c580ed-cf08-4231-a334-0fcd142af577", "value": "55816a7763d094b31acb49042117a11d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb74d683-817c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699808428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808428, "uuid": "9887090a-1b2c-425e-be4e-a986e9f62191", "comment": "Malware payload", "value": "9214380af5825690c614e10a198c7aa3", "object_relation": "md5", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808428, "uuid": "3ee60387-e26d-42e7-8047-045d6e4066c8", "comment": "Malware payload", "value": "62e36675ed7267536bd980c07570829fe61136e53de3336eebadeca56ab060c2", "object_relation": "sha256", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808428, "uuid": "aaf73b6d-2fba-498a-890f-3b18781b960a", "comment": "Malware payload", "value": "3618bb406f3b1cdc01aee95f9e9f1ff70a81ebec", "object_relation": "sha1", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808428, "uuid": "32747a5b-fd55-48d7-aa24-4ddcb642de09", "comment": "Malware payload", "value": "a5479dec5bafe0c6d9b14ce9f04f2535984596ddef82ffe125b5af57234fbc6db4c632493d511c4f119f4da1f78e0378", "object_relation": "sha3-384", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808428, "uuid": "3dc71fa3-e42e-42cb-878e-0a7103b2a4f3", "value": "T1585114E54214FDBE5C7298327DF1E47641150274869C6D9DE2CD0E0B978ECBE4B11EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808428, "uuid": "852e652e-96cb-4cb0-8522-ff42caf7d432", "value": "48:ynTN/8H4g92cuvcX8ibcS+/mmH7+6eb2+DATRSFegtfhvpSpa6WMJ4mN:4uR92cuvcjcl/gb2+DATRSFTtCp5DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808428, "uuid": "ad4ae22e-f125-49bc-83dc-ad05aac2101f", "value": 2790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808428, "uuid": "868da2e9-c94e-4cdb-b04c-4f44626e2ca9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808428, "uuid": "ee3fb305-07ea-4297-a958-b953f4fd5bec", "value": "cnew.aspx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3df74b-8148-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699785750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785750, "uuid": "1ec8aa14-f76a-484d-b926-be241bb16704", "comment": "Malware payload (Glupteba)", "value": "97045e63bc352c15108323095a3c998d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785750, "uuid": "47080bd4-9469-4c72-8d05-fc447d51ba6a", "comment": "Malware payload (Glupteba)", "value": "6323df37636b64da89c7033177953281b72a376b7e5375eb09dce46fc087ffd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785750, "uuid": "bb5a5ace-24cc-48f7-9820-940fd6a3f4d1", "comment": "Malware payload (Glupteba)", "value": "b737dda5576a5ce411fd0af4b746ed0e585692b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785750, "uuid": "1613d5d2-f180-424f-88b4-517ec563c62a", "comment": "Malware payload (Glupteba)", "value": "2266743219e340ca5d2eaa95befb968d286fb5e21e21a94af1d7e4360bd79bef998228a7cc0d69e1a60613fb232ff9b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785750, "uuid": "556ca11f-c30b-42d1-b4d4-82453e2fd48b", "value": "T15716330352E03DE5FA16CF728E1ED69C7A1DFA005E49BF5E120D8E7F09B11B6D262A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785750, "uuid": "4621639a-877a-4919-8e2e-64e7e7186ffe", "value": "a61108037be4958099c89e54a69d67fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785750, "uuid": "b3c16f6b-7bc7-4f6f-b266-502df244a62f", "value": "98304:on3gI4jRfCb12GFB3fMb7XOobdcEu3ZdSLF+VggZxp3:w3mfi2QEbSMdcBpuiggB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699785750, "uuid": "9946013f-e690-4a25-a2e6-213b98258f87", "value": 4315520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699785750, "uuid": "b532df3d-0ac4-4777-b882-96fb5be6d6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785750, "uuid": "c8568b20-2eca-4bd8-8abc-6418655b191c", "value": "97045e63bc352c15108323095a3c998d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79a326c-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795457, "uuid": "57c182e8-7851-4552-91ae-453ee7ad46a7", "comment": "Malware payload", "value": "97bc2537d83f43f64476c0d1e3f87d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795457, "uuid": "a1ff2d08-4617-45ec-834c-5a37cd9dee2e", "comment": "Malware payload", "value": "64ec6a2adb4087719f0cd66e53a755a4ae4bb1979832196797327fde25f5795a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795457, "uuid": "4535de7a-2b95-49f6-857a-2f84ded37153", "comment": "Malware payload", "value": "536ae17ce048e8d9154dbb1041d7b1b6156de92c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795457, "uuid": "3ffef603-0b08-4bcd-af67-f12b6684398e", "comment": "Malware payload", "value": "c84161c5cc72dad00539ac49614a237e187f298b32d07861875abba681bbcbd01898586972b3ba74df61182b0b4d03e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795457, "uuid": "f5b56b1b-6b86-4448-b60f-97e12fff4df9", "value": "T12C357C0732915033E6B279364A1B429DC826FE161D78345A6BF9AC483E35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795457, "uuid": "a578564b-53cf-446c-b3dd-844ae3e0c0dd", "value": "12288:zGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3+:zKvzcrnyaLO+3Yb/wQeAh/7RK1vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795457, "uuid": "3c97c23c-2912-4869-b17a-1d12710ccd19", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795457, "uuid": "f1cd8ed5-61a6-47d9-b195-1e253564084b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795457, "uuid": "9ecece3c-ed6e-49ce-92db-a3395e4a2a58", "value": "SecuriteInfo.com.BackDoor.Pigeon1.13301.23252.29607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd74b68-8167-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1699799252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799252, "uuid": "ba21eb83-cdcf-4c07-8a06-a34adc172697", "comment": "Malware payload (RaccoonStealer)", "value": "1b754b7a0cf54cfed69bff2f2f199d06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799252, "uuid": "83fb67cc-fe61-4ee0-aef5-5e81c9af11f4", "comment": "Malware payload (RaccoonStealer)", "value": "6522e70f69b14a9022ca0e7c2c78c32a79f09ccaa94b2b50815af5144591ebb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799252, "uuid": "8a0c3b91-0782-4aa5-802d-ed9114e112a8", "comment": "Malware payload (RaccoonStealer)", "value": "1115f5fcf460b6edffa07a69e5b3c73ec8a4abe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699799252, "uuid": "12ee5497-3b91-45a4-981a-2d850a53fbad", "comment": "Malware payload (RaccoonStealer)", "value": "31782f32cf27a0fa75c6663f3ddc89fc28db4b5566804853527669be1262d5b37c734b04fd131899425c324c6f83ac97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799252, "uuid": "990d121d-a539-4a67-b069-ed5e3a9d3e1b", "value": "T1E95623A312B11248E5F9CC7C943BBFF671FA031B4A40BC7868E3ADC526569E5E213D52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799252, "uuid": "29ceb80c-5337-4685-a376-0418cef020a6", "value": "d169632280a5e35d00f0f3cc0aa0929b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799252, "uuid": "2cb08520-966c-4b89-83a7-16bfc18119b7", "value": "98304:31F8ntxu3bMM41eXNHer9UooV6ogX4E6GC4yhpfPCZhtcEtIuyTCmWalA90:j+txQbJseoOrV6/4kwyZhtcEtiCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699799252, "uuid": "f5688180-1806-4598-8dc2-8a687e0e6cf0", "value": 6433792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699799252, "uuid": "cc7b6918-fcbb-4157-a95d-fca1b361e6bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699799252, "uuid": "98d60d5d-9e6c-4b17-b277-4eca689f049f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f9eaff-815e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699795125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795125, "uuid": "ba5f53ca-5f54-495d-9e34-da962095a887", "comment": "Malware payload (RedLineStealer)", "value": "8996ebaf69a06fb129fbdaf404903985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795125, "uuid": "8b5839ef-7b11-431b-ba4c-c36f8d3873b0", "comment": "Malware payload (RedLineStealer)", "value": "682c22ad2f791ef9c22b6e34a03f21d556eee9176655a680f9365b5f40e4210f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795125, "uuid": "2adc08f9-96c4-4734-99e8-3b5cefb41ec5", "comment": "Malware payload (RedLineStealer)", "value": "a5acde35015c48611f186dccf9ef097ae7bfeaf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795125, "uuid": "076947f0-2001-42e3-a355-ea273a97ad1c", "comment": "Malware payload (RedLineStealer)", "value": "71746bf38e1705f534d530bb9f02d801452563570f0559088457baf6d04bb4b769f5b26afe2029f9c8a9c3c18fbd942b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795125, "uuid": "906554cf-8bfb-4aea-b116-21360ca7c8d1", "value": "T1AC553386B9EAD073E470237478F743631634BDA19D3883AE3765149B8CB3495A4B27B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795125, "uuid": "0cea47f8-805f-4fb3-9281-9350f547c430", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795125, "uuid": "ec263d9b-7380-497a-9e30-4bd53c6afd48", "value": "24576:tyiFlHKnBgaeTIs8CLGOvPDknJLAhxCT0aIKAN6DTPKC9eI+EQ:IiFlqB5e8/oGOiyxCT0aay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795125, "uuid": "c407b8ef-84ac-45a5-8211-220b50e5a299", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795125, "uuid": "4672905d-0b0a-4624-b8ae-3ffc5c1490c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795125, "uuid": "4a34a75e-ad07-48e2-9031-d4e097e2d924", "value": "8996ebaf69a06fb129fbdaf404903985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d6acfe-813b-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699780235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780235, "uuid": "ee6ef338-393b-4fb3-a858-9f38b428738b", "comment": "Malware payload (Smoke Loader)", "value": "f41974d2f5585608361d9cc23ec0faa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780235, "uuid": "f2dced30-0b15-4cee-a6cd-0dced062a27c", "comment": "Malware payload (Smoke Loader)", "value": "68ac757595f4389f9a5e9c9a7f660815db9dadbb494da73b7c57c5fb1ec66c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780235, "uuid": "4f204c6e-0e1f-46ba-8a16-c4d907cb4f51", "comment": "Malware payload (Smoke Loader)", "value": "01024c4392124c5e1621624e90af32282c1428f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780235, "uuid": "1972e3d9-9776-4ab5-ac23-d9c7f431551e", "comment": "Malware payload (Smoke Loader)", "value": "e8b71205d17d8e6cb31f3cac60873a538b70b62795b77ba568ef3d7c8fff624471474f9b533c78c6622ee59b00ffc637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780235, "uuid": "1761c666-0821-4dd9-a45a-2df7561b5f25", "value": "T1F2243A5392E13CD5F9268B729E2FD6EC771DF6508F59BF6922188A2F04B01B2C163352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780235, "uuid": "f1df009e-1514-418f-89cc-2754b79f6e51", "value": "790940ca85ea46614d5b25d37dfe4c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780235, "uuid": "7ac4642e-dfc6-46ad-acc4-a61a0e88f2e9", "value": "3072:6eigR7QLSItYP/HzpPhfiU9zFNEmir87aLZxO30RPkTBLF8M:6exR7QLSItYzpPrFNniBLeOkNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780235, "uuid": "3ec9c2ce-854e-47f0-9565-2119886bafb8", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780235, "uuid": "2d008abb-17ca-4345-ab7a-89ca71ea5180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780235, "uuid": "9514225f-050b-4994-b9a6-f84cbb00b0fb", "value": "f41974d2f5585608361d9cc23ec0faa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02ae26c-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795444, "uuid": "44447b0d-6fb9-4c6a-b5da-d46c3112fd91", "comment": "Malware payload", "value": "ec5c248ad1a479d2b2c4f99bdd3ddd9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795444, "uuid": "c316acce-3498-4e25-8a18-cb0ebd0b5fa2", "comment": "Malware payload", "value": "69f82fea3bcc030442773ca5af5645d792cdd0114188bbb5ec5da49bc890c948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795444, "uuid": "81661b32-9058-4a10-a05d-1cf5bbd29183", "comment": "Malware payload", "value": "0f23fff0fa692014f5983332ee176394c05d6d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795444, "uuid": "39d7061d-eb2b-4cce-abe9-db007656bede", "comment": "Malware payload", "value": "18e25ca995d6fe91473fc32e6e738f2434629904644977a4a44a6838dba1e2669a442fe92648915da28ac1f86dae1799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795444, "uuid": "c2a0002a-51e1-4d4e-b690-72d4bb2fc7e3", "value": "T11494D82D36F0E432D44D09360C72CFB99962F8D24D11874BA698BBBE6D3E3516C236B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795444, "uuid": "57934f74-3dcc-4d09-aae6-0750a68957d5", "value": "edf46b6a9aceeebc55eb9cb33ed4d508", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795444, "uuid": "e1846a6d-b736-4da6-9a66-3966af0044e6", "value": "1536:wlZoMPWT6OCf5pULp88uWJGt9UnC+dYlPcVvH7MyNTK6SeZZaxrQ055REVmS+pOE:wAMbXIVuWJGt9Un+cVvH7MyP2rwonoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795444, "uuid": "871062ce-492a-49c9-893d-6d3d9448b779", "value": 427232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795444, "uuid": "ad22fded-4e85-451b-975b-81d2b6c1ec56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795444, "uuid": "4cb7a163-e67a-484c-9538-87db91d63bab", "value": "SecuriteInfo.com.Variant.Babar.405080.448.25421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5435c86a-813b-11ee-8907-42010a9c0042", "comment": "Malware payload (Pitou)", "timestamp": 1699780231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780231, "uuid": "22212ff4-4a92-4dad-8229-625803f4c73a", "comment": "Malware payload (Pitou)", "value": "b7f84c0bd92850a240443e20d6a50a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780231, "uuid": "8eedbf46-9171-4422-b566-92d95a283d38", "comment": "Malware payload (Pitou)", "value": "6a9ed12c03ce93c32945020a180464af9589be469a9193160f6eb7b45e4ede04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780231, "uuid": "d12ef4ce-d6fd-46fc-9ad6-99e8f60e3777", "comment": "Malware payload (Pitou)", "value": "0459050ba9951f90258b614a578acac4938dd126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780231, "uuid": "06787aac-adc5-4d0c-a71e-70f642d75b51", "comment": "Malware payload (Pitou)", "value": "6f055ee91968c877a48b7e5b717d79cad38d42c66c22dd13c1085f48230976636de5c3d90145fee9dfc7bfc122dd737b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780231, "uuid": "7841f060-b076-408b-90f2-727fb90d177b", "value": "T14EB4D00392E13DD6F6264B739F2FC5ECB60EF6509E59BF6422188A1F11710B2D267722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780231, "uuid": "dedf9dbe-499a-44d4-951d-9e914aab727b", "value": "790940ca85ea46614d5b25d37dfe4c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780231, "uuid": "80af96fe-d5ce-4f4e-9aba-785223ed7d31", "value": "12288:Vd/oEk4weMYKH1D4FPOmVXNS70rEKNcCUzyZ6oISgICHQDRJ:PeE2BS5/DUOZ6oI1fwDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780231, "uuid": "8d75890b-229f-4a0f-8d76-64f197fd71d4", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780231, "uuid": "e006c2cc-7bad-4e51-bae8-e33840d5d132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780231, "uuid": "c7039630-85e0-4217-a409-9df4c605948f", "value": "b7f84c0bd92850a240443e20d6a50a5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eb8ee0-816c-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699801193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699801193, "uuid": "6965fa83-a7b8-47b8-9a92-1e746ba4c1ed", "comment": "Malware payload (IRATA)", "value": "ad57c0d19aa6424b5c691150d4a29a60", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699801193, "uuid": "a6fb6ed3-53de-4d3f-89de-8cc8126b47c2", "comment": "Malware payload (IRATA)", "value": "6d9e289582ac902fac5ca1ce12b9e5f24c5742d28db90d8aaf10aba71317e5ed", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699801193, "uuid": "80ce789b-61ca-48db-9451-6b02a227532c", "comment": "Malware payload (IRATA)", "value": "46d73c2d962888336978ad6139cf778f3576d852", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699801193, "uuid": "77b54867-a977-44af-b7b7-513f4f04568d", "comment": "Malware payload (IRATA)", "value": "51ed4bce2769602fa1dc0e18a29931bb6af0581367586406e70d51757f2153fe11ec6b05ac7aec47997b1e3f6c53f362", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699801193, "uuid": "823b7378-0d98-4369-9fe3-debbb03373ce", "value": "T121C52383F237BC9BC876C1323555173B625A5D198E43F24A284973ED34BF9E88B822D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699801193, "uuid": "b0849f96-20a7-4307-a354-e9a4d5c4925b", "value": "49152:UNOXS0zt9NvxSXHMB4MYD5WekNdvjRUxul+G3RNcfxdeXCal0SYz:arq9NvsXHMBqn8jRUG+GhN2D1405z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699801193, "uuid": "56007e36-4fca-448a-8da6-7edc9c525021", "value": 2736266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699801193, "uuid": "49ba9bda-1880-43a5-85d6-1b94919b5ea9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699801193, "uuid": "20b19d0a-5c64-45dc-90f9-facddc5fed22", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9508df9-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795433, "uuid": "0325ba2b-7837-4d88-814e-b3d80993c8d9", "comment": "Malware payload", "value": "19b11196e34d3dc00ca517beb51dd76f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795433, "uuid": "a76339cf-03f1-43ed-9257-87870d2e2933", "comment": "Malware payload", "value": "6eb03d59e2b0413942b6e87ecd13a725b928a1e13f93aba4505b2fa6b601c23b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795433, "uuid": "dec3d9ec-dd65-41e0-8e48-75df69d4acbc", "comment": "Malware payload", "value": "93e95968dd112ce058a6efa0016f3e3b61f8e8e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795433, "uuid": "b7350966-65a1-431e-a970-55671881fc17", "comment": "Malware payload", "value": "7fbca0a74c24bafd91793ac5d3bdf77b27cff741c8b2c2df0991cf45ec790f734486cc39cc29cada5988a4b0fdae62dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795433, "uuid": "62cca3ff-496d-4315-868a-826821dfd4ee", "value": "T18585AD92DAC200BAD2D2D63064897379DAA57F1F067C4C9F1BA45AF47B71C38EE18B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795433, "uuid": "d39a39af-895b-4fea-959c-22cdfd7f3c26", "value": "49152:4g1NlCsIEeD9OFDojH3IRbo2Pmm32m1XunlbrIB:4jABojCo2Pmm32m1XunlbrIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795433, "uuid": "d0ad7fd2-27a9-45d2-b840-ab645dd7f37a", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795433, "uuid": "85a04d08-9568-4d7d-b5b3-eab187f45c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795433, "uuid": "8a295470-1be2-4645-aa65-cbc626b3b295", "value": "SecuriteInfo.com.Trojan.Crypt.11265.8052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45abef45-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822726, "uuid": "e687d82b-e559-4b33-b512-f67e0214df16", "comment": "Malware payload", "value": "5eb0be53b7af4277f0e5c2a28f9d5123", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822726, "uuid": "e355f6f6-d8c4-4f66-b5ce-ddae43229e1a", "comment": "Malware payload", "value": "6ee8c7c24f82a7a187aaa490d94cf45696d3514d8e164d7fa0696a483deff46e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822726, "uuid": "b663a692-dde1-46f8-aab4-2062f08690c9", "comment": "Malware payload", "value": "5ed236334de5075088f7799ddba83f0030464c5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822726, "uuid": "a7fde1e6-3871-42cb-8004-3883ffeae718", "comment": "Malware payload", "value": "485c36b4bf56d2a0090f33174fa2d86c09a633058e907b3d492340644186ea228fb0ea0510cd75d69ac8145a043bf7e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822726, "uuid": "88a028d1-9af9-445d-92a0-d4144df3f0e4", "value": "T1EF436BC4E643DCB2D8171631147BAF37BA76E2E91224E746D3A8A736EC51702E017E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822726, "uuid": "7974fb19-a873-4cfe-afda-5770f2eebcd9", "value": "1536:BF14yTUx6AhcHIOROPHriIzVKSblcMUiBVFrVmwbZnG:B/4yTUxdaIOgPHrzzV95cMlrHmwbZnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822726, "uuid": "da090364-4183-4455-ac93-9dd04dde4e2e", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822726, "uuid": "9ecf7e91-94af-45db-80f0-79bfb77a44d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822726, "uuid": "732c7fa6-543d-4f3d-b796-62ed5b15bf36", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed6a50c-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822742, "uuid": "04304051-0d90-46ee-ad3b-57d030b74128", "comment": "Malware payload", "value": "4954d872c8604319bac33ebd7aa7b193", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822742, "uuid": "55b75ec2-af03-4083-b6cd-382c1c0b0e04", "comment": "Malware payload", "value": "6ee9b21d5d28f20e4b22fafac0444c49bad1f837691a06743042ac5edd0557fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822742, "uuid": "7f80c26f-8050-4d80-ae43-b067a01c6fc6", "comment": "Malware payload", "value": "a1992d8baa1a163ea4553ffa7611fa77006063a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822742, "uuid": "990a725f-0d7d-44c8-9a7b-78b732e26aa4", "comment": "Malware payload", "value": "77059619876df4a134d68af7d827a405f60af0d2a1df96791559420eb6e06392818af5c45ba76ce743053d707c043c3b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822742, "uuid": "50cc884c-e181-4306-8ca4-3ae2138fc7d7", "value": "T18493B419BB611FF7D89FCD3746AC0B02388C958622A83BB67574D428F64B24F55E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822742, "uuid": "26c20868-4919-4ff6-af89-a853ee86d7b1", "value": "1536:NUYh3y42HG6+JdsqWnywY/hn5ZHpFBw3wJwwbZnr:NUYh3P2I/wY/55eIwwbZnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822742, "uuid": "3ed8805b-654f-487d-813e-7d325725fe81", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822742, "uuid": "bdcd8e37-2f61-4df6-9e3f-9079e291b6c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822742, "uuid": "19c912b4-9c0d-4a65-b212-4f1203250f9e", "value": "skid.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9849b57-815d-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1699795111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795111, "uuid": "994582d2-87d1-4caf-bd39-57c6b6665958", "comment": "Malware payload (Loki)", "value": "cef8c16746753d8c1c5cbe10e4124032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795111, "uuid": "ee9260f7-cfd3-4285-80e8-6200542b950c", "comment": "Malware payload (Loki)", "value": "6f68df5ef38e7ef5e83d3f24c85a3ca7a1b0689d730d00b823f2d56c759f3917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795111, "uuid": "693e4d8d-9d6a-4bdd-9059-cb3b2ee432a7", "comment": "Malware payload (Loki)", "value": "80d739a9c76ce48572930abce88f0b2b077510bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795111, "uuid": "f684c535-76d3-4433-838d-80ad48cf8df1", "comment": "Malware payload (Loki)", "value": "deaa5072b7d00fdbb61bd9c09f3a177b36c52469e3daa7c1672fd3a74bb8de249dccd921532d5bae6736c1152f5fcf35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795111, "uuid": "26b7dd74-66b3-4a74-a43c-60aebe86a5bd", "value": "T189F4593C4CAC1237C674DEAB8F948065B5E5977337468D3854D316866E26E22FACC23E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795111, "uuid": "0f0b8424-4d75-4547-8fad-03165a2e5443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795111, "uuid": "a83ef13a-910b-48d9-a0dc-c9516bea8899", "value": "12288:p8k7eMujbVGf3t5tYZMEO7stJJFyFOAb9a2wXlTmsW3xGniOgHcY29e:ise18/PtYZ9+ej4FOAb9a2w1638iOwcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795111, "uuid": "7a3c9659-65ae-4b27-a6fc-0cc46ff7d549", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795111, "uuid": "d25d008a-00ad-4e6e-be7b-b9846e07b650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795111, "uuid": "13d14458-fc41-429a-b110-14ac24117667", "value": "cef8c16746753d8c1c5cbe10e4124032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b264a977-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795421, "uuid": "a1000cc6-97d0-4690-be57-786f0dcb9162", "comment": "Malware payload", "value": "247de7640dfee339cd583526f2596b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795421, "uuid": "1cce615a-f927-4a80-a2e1-65fbd514ba05", "comment": "Malware payload", "value": "6f8e9d2a53ea3b36619f6921392c91402237253fdb925a3b618e707c52eb3516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795421, "uuid": "ab97c8a3-19ca-499f-8ba0-c4a05cd214a4", "comment": "Malware payload", "value": "29748e85b2658ce6c3e8edff93863fbca83524ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795421, "uuid": "d7f535ef-314e-4617-b2dc-db39bd2f9032", "comment": "Malware payload", "value": "41149a7fada0288b2237880fcf1a4e75eb080ea25910e92bb2805a6cd8471bc510c3992df66f5904caf69961bbae77b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795421, "uuid": "d6f3e0fb-6b25-4dbd-afb0-cb01c1405054", "value": "T170652736F5415032D56FE4310A177E5D8426FED7CEE8649A2BBD6C482D30E86AE31EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795421, "uuid": "b19e0ac7-aafb-4e7f-a886-54acdbec499d", "value": "24576:1CgbV5DZ5LppAHy5avE7R8RrynYjWxvr:1CUxZ/lco6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795421, "uuid": "1e9c32db-c07e-4c90-8408-d3936182456b", "value": 1434624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795421, "uuid": "6a712cdf-f85b-47e1-bbdd-310172d92762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795421, "uuid": "81fb5d98-87b3-40cd-8740-c5bec0ffa6bc", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.6971.17669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88814f5-815e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699795431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795431, "uuid": "4c35009f-acd3-46cc-9567-9f85b4aae3e9", "comment": "Malware payload (RedLineStealer)", "value": "823b5fcdef282c5318b670008b9e6922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795431, "uuid": "817eb5c6-bb0a-436c-9173-4e5138cd357d", "comment": "Malware payload (RedLineStealer)", "value": "712f5bb403ca4ade2d3fa47b050aac51a9f573142fd8ba8bf18f5f8144214d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795431, "uuid": "f108ccb7-0c82-4fd8-b84e-658eb3bc2030", "comment": "Malware payload (RedLineStealer)", "value": "d20cd5321d8a3d423af4c6dabc0ac905796bdc6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795431, "uuid": "91a5c713-b6bd-44a9-9262-17c951989c3b", "comment": "Malware payload (RedLineStealer)", "value": "bf004bfee1193e1892a1c04f527194df12a53cc96edca2a9d82eb031229e1a8da8356ef72b9032b0f5d1d9f9546bfc8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795431, "uuid": "c72c424a-70dd-4dde-abf1-b92d6e61a895", "value": "T1C3E53303F1916379E2265B7318BE98A8423259DBE76BD86C4D6BB3C83D773514C04E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795431, "uuid": "efb0a966-abda-4fea-a6ad-848ec2b4a680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795431, "uuid": "0b17810d-a260-4fd9-8906-9e55b3ef92a1", "value": "49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795431, "uuid": "7af9a1c9-d790-4b86-90a0-b7e0c6489d82", "value": 3233792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795431, "uuid": "85b29cc0-a2bd-48c3-9455-c2efad2342f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795431, "uuid": "fc7dc0c8-b787-4b0f-ba9d-d95ff3f92bec", "value": "SecuriteInfo.com.Trojan.DownLoader46.21649.26514.25371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce9d05e-817f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699809370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809370, "uuid": "72e94fa9-33ec-4464-8a78-034ffb2167e5", "comment": "Malware payload", "value": "05152ca1613fe3191a389316ec830573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809370, "uuid": "32b3c7fc-0a4a-4840-9caf-a1dfe4d5e953", "comment": "Malware payload", "value": "71f17c84652cd8a72bf0d19d1e23f6527a3d0823f2f0b1e7cb15183803876ee7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809370, "uuid": "31aeeeb0-4264-4089-ad29-fe56c1c9b2af", "comment": "Malware payload", "value": "ab869fc2c7a61c695c6bdb4801e655e4195896f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809370, "uuid": "4208a64a-10ae-434b-b39b-eb0fd72ea710", "comment": "Malware payload", "value": "6401210aa147c7269c6ec4b63ba69417cea919187a6a0cf6bbf42ba6a3b15dbb2a64cb72cf92e5fb16976640a056b644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809370, "uuid": "1648f223-f742-4b6c-8d7a-70ced17f8d8a", "value": "T15B92080963E18721DD6D0A7A0C23A7411739EE168E23EF6F1CE8756E2DB3B514F406B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809370, "uuid": "46f890e5-571b-401c-bae9-6208b5485a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809370, "uuid": "83bb9fdb-b8d9-433a-a149-fa9bab1798c8", "value": "384:XvZc7bntvCycq78fdqMQDgv4D8rJF6vvTxepLRsAkT2baAgVJ:27bn9DI6vdpAWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699809370, "uuid": "8d752f42-f3b5-497f-82a5-abcbe99285e3", "value": 19996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699809370, "uuid": "8885fc2b-c012-4b67-97d9-0538139343f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809370, "uuid": "7d25c52d-05f6-4252-8c77-5a07264e66d5", "value": "05152ca1613fe3191a389316ec830573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c036b5d-818e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699815946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815946, "uuid": "7bde4a4d-889e-4a05-b8fa-7486ec532cb9", "comment": "Malware payload", "value": "0a8bb692f90c169a101aacc14579e834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815946, "uuid": "86d0d6ad-663e-4805-85e6-0ce7b1dfb4b2", "comment": "Malware payload", "value": "72c9c9e1eaf489bf5487c24d49590d141faa40bdce2469137d098490364b0a12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815946, "uuid": "5fca3b90-31a0-47b3-a5cf-f4c285e07257", "comment": "Malware payload", "value": "7948a3c82b5a35346ec807dfbc75ce9931300a43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815946, "uuid": "866e7b35-e0ad-4119-bbac-aa0772a4f048", "comment": "Malware payload", "value": "d4b3e257aca318cb093affaeaf8fd6258fdad901489507350b9d791a59c2f3747d5f421e60a3b9b9ee4d52035216d836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815946, "uuid": "7d08f82c-c352-40af-9d75-9ae212285c3d", "value": "T1A5963342C55C8B78DC40EC31895DCF1D587BB6366E75779B398BB8462339222ACB2393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815946, "uuid": "3e0821c5-c615-4b10-8945-a3fe283b9117", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815946, "uuid": "4af3ba18-2cbc-46e0-b16c-eee1697d4c70", "value": "196608:wcGhVO9dMEwx74OlXg7/dOa4FZCkEafF2m9i/jVfegASl1ry3X:wcGv6MhPFQoW+N2mEfegAf3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699815946, "uuid": "a2b473e1-f6bc-431e-8d13-66c1d0d3a3a3", "value": 9064506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699815946, "uuid": "8d5cceba-bc0c-4e59-bf3d-d8a62b9ebec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815946, "uuid": "0c4ac29a-f924-44b3-9ded-139e7b2a8a26", "value": "0a8bb692f90c169a101aacc14579e834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e810cc4-810b-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699759525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759525, "uuid": "eae25621-1e5f-4553-b216-9743c5a6cda9", "comment": "Malware payload (njrat)", "value": "c2142d50c3548ff44676cd9535df0c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759525, "uuid": "25b621eb-507e-4565-8875-17d982903dab", "comment": "Malware payload (njrat)", "value": "731fe5753aa8b8dcbf1878ef89045f0ee87ed1da37585cfb483378bcf89a5edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759525, "uuid": "d525f342-52c5-4189-9efb-afb41e614417", "comment": "Malware payload (njrat)", "value": "efdb3a03ee0e669b1b6444e7e27dac87a90f4055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759525, "uuid": "0910cd4a-eb30-4159-86fd-5508afd35cae", "comment": "Malware payload (njrat)", "value": "75861f680c882f7766e068fb6af76b7a52e3ba72ff4ab7a9a7c72acaf1c674547711994f6b580ae58a6caa7d344c27a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759525, "uuid": "92c5d318-a5ad-403d-bd21-984760644d92", "value": "T105E207067BE94214C2BC5AFC8CB313114772E3438132EB6F5CDC98CA5B676D44655EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759525, "uuid": "54ea34e6-89a4-4a84-a3e7-914b32d32d1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759525, "uuid": "4d8f6a13-5a6c-4586-ba33-fe83d2c7fceb", "value": "384:l0bUe5XB4e0XGOlbHdqlzkB8N/SWTPtTUFQqzFMObbfR:mT9BuVBdKDqbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699759525, "uuid": "1b5f8feb-a261-4bb5-99a9-0264f132d0ad", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699759525, "uuid": "b5a3ae5b-f353-4b44-8f91-45496e709b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759525, "uuid": "e90689b1-3d11-4bc7-977e-5a386a93b0f5", "value": "c2142d50c3548ff44676cd9535df0c1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba642e37-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795434, "uuid": "36323b79-8cbc-45dc-8440-f623070bcc0b", "comment": "Malware payload", "value": "c454fe8e2691de3d7ffed3db180ffb57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795434, "uuid": "568a0123-5e03-4a29-a1d1-62b132334e66", "comment": "Malware payload", "value": "7647574b1d788d2912ff03fc949d8be3567217c4fc04832ac02deb2777e68905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795434, "uuid": "120fb1ee-c015-4d3b-b165-3f86365d58c9", "comment": "Malware payload", "value": "9127fcf60633441cd21a628f6b5c8cc9bec1321d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795434, "uuid": "afa944c6-4cca-492f-a7fa-aa4cc2bd7102", "comment": "Malware payload", "value": "d087efb1623fa00cdba81ea6cc0c2c1bbbe44c7ccfab1b656bb17bcf0a654113b19b81fb6d4bca6b57f92a9669a89a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795434, "uuid": "de16dd79-e636-45a6-87e5-5682def06d20", "value": "T19C3633EE4A328637C4619734D92C406AEA71BF57F2F351C40ACDDD6A6EF62240729F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795434, "uuid": "bbae18af-a814-4336-83c8-12fd32a2159a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795434, "uuid": "41ca28af-19e7-4943-8ccc-68fa3734b1e2", "value": "98304:e462yEgfFhs5yNup/w2zYyieOF2DI+5tUBQiH/kdqtRAP4Z0rLS1DfJGCyH:SEgfFMNBOF2ce+Q2/fiPs0r6DBG5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795434, "uuid": "e0ca1019-6611-484f-8efb-f4def185c1cd", "value": 5117522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795434, "uuid": "8bb729b0-d52b-4c57-be92-26a4a207638a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795434, "uuid": "98cd8a25-1bb2-40c5-bff9-866f52564d8f", "value": "SecuriteInfo.com.BScope.Trojan.Downloader.5816.16079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df5f166-8136-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699777965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777965, "uuid": "3600432b-64ea-4393-896e-0145be332155", "comment": "Malware payload (Formbook)", "value": "23a06d6b63d03e13e49a85e56f9c7ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777965, "uuid": "0d1351a4-c015-4bca-978d-692ac0cfcf47", "comment": "Malware payload (Formbook)", "value": "779602a8ec3577cf114c41704c9fe2b90130da2dc331c4bc2cc5a0082ebacfd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777965, "uuid": "f2d7f110-468f-4aa1-bf37-3df0ab408c88", "comment": "Malware payload (Formbook)", "value": "3128b2e6d1edcb3cec427733996a57bfc7545b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777965, "uuid": "07a27804-0171-4a3d-a443-b47b8ab5c514", "comment": "Malware payload (Formbook)", "value": "c03e0acfe0d21f5ee9caa46dfa29b26d01a0530c3458fd743b97cc9188656b802411e5990a6945e523474034fa9340c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777965, "uuid": "75eb666b-7f22-4c59-ba73-4b2cac22392f", "value": "T14BE4AE4D92104397F1152B75DA6E7F5A02201C7C74C1EBE8F9A97B1BEEE1BA6143302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777965, "uuid": "ddd02a8a-9ead-41d0-9c0c-035218988717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777965, "uuid": "c51de8bc-0378-41cb-858f-bf1e74ad6734", "value": "12288:k82iNHxWoJBGcgKZLqoVB5hXJ3rKW5zxGgAbCEp8rf3R9yGITAqKoe/Juh255Y:H11xjXpZLB5H3r565uLyGuvRe/JuE55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777965, "uuid": "93f1fc45-417d-4e16-b3a4-3c7cbd72effd", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777965, "uuid": "362e32e7-e29a-43d9-9dcd-32e7071a05a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777965, "uuid": "6b56c826-c230-4451-86ce-a1efd1e04e4b", "value": "BB879OMOJHH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ee5972-8175-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699805032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805032, "uuid": "65ddc417-31d5-4199-8846-28ee14328b2c", "comment": "Malware payload (MarsStealer)", "value": "dc6c4b3a9db140cefda4564e0c8adda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805032, "uuid": "979ed3ff-4bb8-4417-9d7b-24fd225968a4", "comment": "Malware payload (MarsStealer)", "value": "78380c9b3b9036cb8d3fdbacd2438971115405bcb828bb9812e4abb488408590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805032, "uuid": "cbf0796e-2bc2-40a6-8d8a-06e0bb0d8566", "comment": "Malware payload (MarsStealer)", "value": "1e6476dd04e9652f9865e983a2b905cc3f8e34e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805032, "uuid": "9eb85b5a-d441-445d-b3f2-82874d60d86a", "comment": "Malware payload (MarsStealer)", "value": "c1d7183b4f82894ef3dc36a265f70aee3c1a0b8a0d57b6adb80eabbfb021d758218421eaad48fe4922387842ae3e4a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805032, "uuid": "0c8362e2-8570-4035-8ceb-d176bdb678b1", "value": "T11A343A5393E13DE5F5268B728F1FD6EC761EF6508F59BF6912188A6B04B01B2C263312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805032, "uuid": "8121b360-5656-4cf6-b6f6-1bf262cac1dc", "value": "b9f69a119dfb935d85204ae1d9e63436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805032, "uuid": "28fa1023-fc02-4741-8f28-ee0d2b42a782", "value": "3072:tiyf4PLToR3Py+dWiWiZOegeEsSldc1aOm4DSRP4X4wZ7+c:tbwPLTmPy+dWicvsSQ1a5b4X4wN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699805032, "uuid": "5e7c0b8d-9d54-4900-b72c-bd06929ee2b0", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699805032, "uuid": "18c9f810-32fb-4688-8a70-3260ecfcaba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805032, "uuid": "b7e4ed95-6ea2-4fce-9001-64218ea6e0b8", "value": "dc6c4b3a9db140cefda4564e0c8adda4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d4a9dd-8135-11ee-8907-42010a9c0042", "comment": "Malware payload (StrelaStealer)", "timestamp": 1699777848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777848, "uuid": "21e3a8ca-3b65-4c78-966b-c60dd8d6662f", "comment": "Malware payload (StrelaStealer)", "value": "fdda931653ce8bad08dd9160c32f6900", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777848, "uuid": "63e67fda-1af3-4d31-a8c2-9b9a3f5cee4d", "comment": "Malware payload (StrelaStealer)", "value": "786fc6cdfdd0dcae3e1f1641c28fa8f0474b9016a0ffd82d42f23d214f837efd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777848, "uuid": "99dfc2e4-db65-4907-898c-dfb9fc528639", "comment": "Malware payload (StrelaStealer)", "value": "784bf81746e83c49ea75fbb5978fafae3c6b3245", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777848, "uuid": "83a65137-3558-4f47-a3d1-5d5e4b74f270", "comment": "Malware payload (StrelaStealer)", "value": "ab597c33647969b74fd542e1ed2349ee8c205e74ab923f8c3ae045e9af397762668d1c7675649b3e1c439fec0e1dff76", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777848, "uuid": "92f20eef-dea0-4b33-a311-5c2f46769cb5", "value": "T14B552BF07251BFD20FB4191DB38F80B22D27FC5BF0BA5E8622962A5D95C4244D5EADB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777848, "uuid": "d689ce61-3492-4683-94af-d18ea5b405a7", "value": "12288:+JJFpH1MWiEpIzD7Wwndqw9tEbME7y3IgVjnHdE2Zv/ukqmSVelQJnrSe5JFd4OS:+HVM993s7y3Igbltd/S3sPvyBPwUbU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777848, "uuid": "e3efd54b-5c3f-452a-ac77-d31b83e91ae2", "value": 1354120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777848, "uuid": "64c53e0d-db59-4b87-93a0-16db5ed2338e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777848, "uuid": "40677d3d-4fef-4880-9467-974f633ab1ff", "value": "24493246931877.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26acae41-8161-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699796475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699796475, "uuid": "4ef01a5a-a31b-4829-8dba-141c49f9687c", "comment": "Malware payload (Formbook)", "value": "4662d7133528bf980c6b1f6a7865b0c9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699796475, "uuid": "6bdcac51-3da6-4ea4-9bad-aff200c41213", "comment": "Malware payload (Formbook)", "value": "79115213cd51631d50fdd6d76f5d5825017ff0f01e7c8a0f4d72e1c626d912dd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699796475, "uuid": "15b55441-ee53-4ab4-9baa-a481316c29d5", "comment": "Malware payload (Formbook)", "value": "76ed3f2e80b0520a4d6f38537319e8e85650d5e8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699796475, "uuid": "a112dc63-669f-4025-ae97-b9599275c44c", "comment": "Malware payload (Formbook)", "value": "cbd321c3c9d50318a3b86427e0623b6afabb28f362ae1483634ee9cb0250134205b2273634691ae1bed52ad70818c738", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699796475, "uuid": "e2178b74-7e46-42e4-86c6-fa03076fbea9", "value": "T126E433EA24696E9F3F315AD087F4C3359A63C32A2956017DE1458CF40B8C39F637A56C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699796475, "uuid": "74e26532-ed9d-4848-a4e1-3a0d60d98919", "value": "12288:2kY0iXbGG8SH0dJQ4DbqpYJpzE9d7QmcMMFe3uC8kTKC7Pzvl81UleDtxeFTc9z8:2kY0kGGh0zLiBKMIe34crzvozRxeFA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699796475, "uuid": "efecdbdc-6c92-4d26-bab4-5c681868ea73", "value": 719117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699796475, "uuid": "3f010b6f-764e-4e17-8be6-3bb4bcc7b82c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699796475, "uuid": "fbe514b9-3f15-45e1-9020-1bccd0367da9", "value": "Confirm!!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f912b229-8134-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699777501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777501, "uuid": "437ce525-900b-4989-acc5-f92096d65e8b", "comment": "Malware payload (zgRAT)", "value": "c8c92a207e2a92499a19f26f04b3d8b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777501, "uuid": "d69946e2-b42a-47fc-a36a-3f0cb4898202", "comment": "Malware payload (zgRAT)", "value": "795e333056f12db05a5c212318e3f1e3d915a8e7f88737fc34321465a6c1bfad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777501, "uuid": "b72f04b1-853d-45fb-b93e-2216befe306f", "comment": "Malware payload (zgRAT)", "value": "70192227c5ff60823cea250e0031221885454f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777501, "uuid": "d4d49bfb-98b1-4c50-93f4-238ef5c62698", "comment": "Malware payload (zgRAT)", "value": "910c9a05a2987b448f5fcf46e835b87a8d8999935a7eb93f841db7c68c042c9563c4071a3cb86273e0841ece10cb12dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777501, "uuid": "a6b58522-d7cd-4bd4-9d8e-ed5de13de3f1", "value": "T1EC65D0A92B9C42CEE57D71F5F4A1180AAEF0D06BD1ABE356C9C0B5F45A833504F036A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777501, "uuid": "1ff23cc9-b385-4a3f-84c2-4df60e935666", "value": "24576:pOgnmABB3baJRppJzaLnvKpxDeMkDdQ41bN099jjLiVKbcIAj:pOgTbaTt2vKOM8ZQjjeVKAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777501, "uuid": "95334b2e-de95-4df7-aa6f-fd072b487725", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777501, "uuid": "249e8ed8-001e-4ca0-83cc-2eb11ca469f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777501, "uuid": "1c85a771-083f-416d-a506-1e7a9359227e", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.6595.12597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa55851-8175-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699805045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805045, "uuid": "5cbd305f-1b4f-4389-beca-8c0c37fdff3f", "comment": "Malware payload", "value": "60220f10e2b880de18a478f16098134b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805045, "uuid": "de96a2ea-fce0-4a05-bf83-1857e9c54af2", "comment": "Malware payload", "value": "79c1fc5878f6c40e4468bfbd18fcaa46d61d5acf465fb4c56ebe6e70ae984bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805045, "uuid": "9c6bc081-9f69-40bb-9616-0931a1676554", "comment": "Malware payload", "value": "74daf4faef05143e00e29ba10464a14e739c98dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805045, "uuid": "cf5c2af7-4752-4df3-91ab-8cb0561f38fa", "comment": "Malware payload", "value": "dff115b9794d545525a3496816d07f070f956d65e6919ba87962e81ea0dfb6a388c7cc7dc386a8e16ff8890af70bcc6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805045, "uuid": "00f35e52-fa48-4139-905c-8ed147418a5b", "value": "T1607633126BC26134DD7F983830A198770577BDB23EB4DE9AB5D56BD806304C0933EAB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805045, "uuid": "1c6cae8e-fa6e-4994-ae31-a276d12555d8", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805045, "uuid": "de9a1176-7771-42b6-8e0a-71958e2ff916", "value": "196608:zrIWLrTNSgx+8AtpM2Y34M7ZepYU2YRkQ8OK:zrIWXTZPAfYoMteWU2YSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699805045, "uuid": "a46f094e-4391-4482-a23e-a866dfaa21bd", "value": 7236776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699805045, "uuid": "0d23e60e-cd5b-4ed7-a13d-40530429ad1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805045, "uuid": "c9076873-770d-49ce-9a69-2335c21f4e40", "value": "60220f10e2b880de18a478f16098134b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0df6fe-8135-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699777913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777913, "uuid": "6c16731a-4852-4f5e-acc3-31f475e3ef6a", "comment": "Malware payload (AgentTesla)", "value": "1b2d19fad1f79cb3e5a4dad054bbb839", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777913, "uuid": "4a449a13-2cdb-482a-85f8-cb076aa0ff4e", "comment": "Malware payload (AgentTesla)", "value": "79c6fb90545837f8ac314eaf24336831bf482b9dcc089d7002b990161002458a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777913, "uuid": "792b0141-1f5f-4a23-8d15-81e2a8aa5305", "comment": "Malware payload (AgentTesla)", "value": "914494dd5f6bc9b0ccfb34a7812d54ee60560409", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777913, "uuid": "49644492-6148-412c-884e-c0fd5463920e", "comment": "Malware payload (AgentTesla)", "value": "ca69e93c9769da2fcd36351afbb6c06a8f23b043ec177505b483a640efffe97aae39a1a657f9eeee81c2702935eb60b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777913, "uuid": "fc01dbba-4cbb-4181-ae1e-9ce8eb6a5218", "value": "T145F4F10307B40606E4DDA7F15B3158E11B3E324B9929CE58FD94B287A97CFC446CB7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777913, "uuid": "c19d00b0-9cc3-477d-a137-16392b183e23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777913, "uuid": "ec3d61f9-a331-4dfb-8452-ad4e511a4f27", "value": "12288:xCZtj1XrtQg3zwGKfez9zrLWJKoV8hgqcIpCuRNo1re3FxqbqNKRgcmBfIMDke6P:xW7XrWIwGWoLWgfeubVGROfIMwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777913, "uuid": "11d9a376-08ec-47ff-aae6-bfc740d3dfc7", "value": 768912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777913, "uuid": "207757de-a965-4f44-a8a4-75ed04af5447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777913, "uuid": "d70d2d85-91b4-45b6-b151-879da97554fd", "value": "INV_CNGMT_AT_12_11_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659938f9-813b-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699780260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780260, "uuid": "9a85963f-116f-4adb-adcc-eb6f889c61b9", "comment": "Malware payload (Glupteba)", "value": "afed3363198e47d2c8b919d1781d2ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780260, "uuid": "4e082629-7da7-43a7-84a6-e2431a262ba2", "comment": "Malware payload (Glupteba)", "value": "7a32a5a6c5026b28050ee059ea20505cb3d6d214be8b24a7458141044a173b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780260, "uuid": "34328839-71f0-4290-a637-683bbf0e2ec0", "comment": "Malware payload (Glupteba)", "value": "a234cb42409711a11da4354ea4cf378c8001dedc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780260, "uuid": "97a7e448-4f1b-41d2-a705-6fb832d61ad1", "comment": "Malware payload (Glupteba)", "value": "d79ab2658f2fde646a4732295298b931fb10148cdcbceff61990986d52bbc14f22aef64bfa82469a8a8f752bb337a38d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780260, "uuid": "8aa3e17c-ff0e-4479-8ef1-16f148099b3e", "value": "T152148C5293F82102FEF66AF09C6138BE523134532F22D73CAE4D78D56968BB095D4A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780260, "uuid": "4c692b5e-be7a-49da-a1b2-0e454333632e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780260, "uuid": "3c6aa5cc-c9a5-4850-be32-f2b15523e755", "value": "6144:ispcPcxtFCysSKULwJhAZRot3enZlZsk52:fiSnQCO3I2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780260, "uuid": "eb1442fe-6ba6-4be1-9c25-c293fcba7a6c", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780260, "uuid": "551aed71-683a-4b72-ac58-e069a47f775f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780260, "uuid": "e15aabe2-6fcc-4f86-b98a-e05e1ed16d19", "value": "afed3363198e47d2c8b919d1781d2ced.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c696935e-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795455, "uuid": "a37f74ce-49f1-4301-93fe-0fd805606bc2", "comment": "Malware payload", "value": "c7f332011880ee0a1661288f16bfddf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795455, "uuid": "41d1d419-68a7-46db-a091-711a708f0f79", "comment": "Malware payload", "value": "7b83e21ee97e5655f2601a5358302229d1ea4211a6ab50b1ec62a4c76c9c623f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795455, "uuid": "59fa688d-4f70-43a0-8e2c-87b67d113603", "comment": "Malware payload", "value": "d64c183f9009cdf469978f0e9572862250fad45e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795455, "uuid": "7686dd3f-3373-4920-ae49-96dec12f55d9", "comment": "Malware payload", "value": "142ec33f7e1afa3f8ca02eba7d4c8db1f587550726b1a7f3c2f32c841ed59ea84ce3d7430f5d42cbe7c194a25e4970ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795455, "uuid": "a5a08dca-7ace-4fb3-ac0c-1491d9964b9b", "value": "T167B50196FAC08173D1A508F1281B43CDEA26B8F1197CD96702F3675D3E322B4A53779A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795455, "uuid": "1fa55e63-8abb-47fc-8849-14ec4fb7c1f8", "value": "2c4d9154d51dff5c506e63e5a6ee71a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795455, "uuid": "4213112c-e9c5-4ba7-bdad-fc8ac4ff6411", "value": "49152:flwIX4Dkn+zLG0fdP5VG0BcEEDocKHsR1X3F+DR6/PcHSYu0:twa4D2S5VG0Ba0tHq58DGUE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795455, "uuid": "ce53f9f6-3121-468b-aeec-74be9a5be3ad", "value": 2278948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795455, "uuid": "150adf2e-917b-4174-bfe5-1e634fc9a587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795455, "uuid": "ec8bc373-b007-49e7-a919-b18a0e1b7f7a", "value": "SecuriteInfo.com.Variant.Babar.303591.441.8343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37231a5b-8139-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699779323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779323, "uuid": "682bfcfe-d7e9-4827-a569-d67110bded23", "comment": "Malware payload (LummaStealer)", "value": "2126f48656722b1eb6e5f59fe213b27a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779323, "uuid": "e3f16314-3d4c-413c-bdd0-38c12b3a320e", "comment": "Malware payload (LummaStealer)", "value": "7ef834fc890f8f801316f859915cba63a0771e89738a882bca0656fda5a74ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779323, "uuid": "56e2acb5-e361-4a23-82a1-9aba4a03137d", "comment": "Malware payload (LummaStealer)", "value": "ce1806e2df9492580fe3bc59b3b07075f3f6ce85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779323, "uuid": "7735aeb8-2fcc-4642-ade0-9cad82e8eafb", "comment": "Malware payload (LummaStealer)", "value": "882260fc2e07211589c40ee80d1a284873d4ec215a2cd88b254e8d7c6f108568d892c895bc4853d11824354dd6ee910d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779323, "uuid": "abd36f0b-dd30-48e8-9e15-a3630c57cae4", "value": "T1E755238ABEE980B3D4B5677169F6435B0735BC31AD6C82262259589F8CB3BD0353073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779323, "uuid": "6280458d-e454-4e3a-823e-de6ee630b245", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779323, "uuid": "4397ee75-9109-407d-bf9a-90c5a981172e", "value": "24576:eyduNudKvInfMntDR5aeDIskCWGNsxDfzMVbT77p1Wu/HfPKHRH14Xn+6E71wvhh:tdu0dKvjnUestzGWbI5Dp1xHfCz43+vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779323, "uuid": "5e3d162c-07e2-404e-9aa2-99c1a11a7349", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779323, "uuid": "9c87b4e8-3a6e-461b-9f86-b0d2aba4c989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779323, "uuid": "8e4cac99-b6ab-4605-aaed-f2a070cf00b8", "value": "2126f48656722b1eb6e5f59fe213b27a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8410bf37-81a4-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699825408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825408, "uuid": "dd5ba1f1-57b9-4724-8b08-3de6418eb5ac", "comment": "Malware payload (Mirai)", "value": "67a9dae843064035e4ef150b2b0936fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825408, "uuid": "46abcd5a-01e7-4fae-bac3-c83595bb6896", "comment": "Malware payload (Mirai)", "value": "7f888f5dbb75eaf00e649f9ad9783d8edae941f1cbe210dcf8078bae564b111e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825408, "uuid": "96c3f387-6e05-4439-ad60-777b6e3234f0", "comment": "Malware payload (Mirai)", "value": "e1f07b1149c729e53e6f61bc5e6355af5dae710c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699825408, "uuid": "2d67dddc-bea6-47a0-916e-53c14406c488", "comment": "Malware payload (Mirai)", "value": "c44dcad8a0f4dcf06019745b9dde732218339e5d1b2086087ac3ed214a2f2aea60887859e6c0169269490d82550036cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825408, "uuid": "702ef548-e0cb-40e1-a6a0-6e32e7d83795", "value": "T166633A02B3080D03D1A71EB02A3F1BD1B7AAD9C123F4F685695FAB96C675D334585EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825408, "uuid": "98f8da83-75d0-4c3f-8dfa-75d6d121dd83", "value": "1536:gAEqb3J7Yo42JlWCPK9ENDgO/vjfwbZnlRF:Qqbf40BK9ENDg0jfwbZnlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699825408, "uuid": "ef79b250-c7f8-4055-9bea-b538ede9a17e", "value": 66972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699825408, "uuid": "f80026d3-28b5-4468-8b9d-066f3e0075c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699825408, "uuid": "c9e10384-c9b0-4e46-a26d-04b90caeb5bd", "value": "67a9dae843064035e4ef150b2b0936fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f27c7e4-81b2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699831305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699831305, "uuid": "ea4c79c9-1041-4e02-8524-64accf0cd585", "comment": "Malware payload", "value": "5e741e65af9fc3d4765bf7cc4ba420bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699831305, "uuid": "234dd1ab-f00f-4fa9-ac3c-9cc2e97ee755", "comment": "Malware payload", "value": "8282976c399101d48a2f46771f768d37f4de4124d00f4ba8f01d63d6ef935c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699831305, "uuid": "361df386-757c-488f-911d-69f7db89398f", "comment": "Malware payload", "value": "a63c98e0e0943f70e61a109b9e6421d8d7b92b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699831305, "uuid": "af0863b0-a779-4be8-83ec-52220c4631fe", "comment": "Malware payload", "value": "dc76fe170df08fb8a3dc4c10232109835a82798f56cc684d19c5b04bb7e284658be285e7ffe6696a7cd6d71b0d111168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699831305, "uuid": "b1a23895-8e6f-429e-a33c-6afe0ead10d6", "value": "T17DC501E3B3E40472D3B75A788C4A83A4BD16BD212D14B886FBB62D5C5E3D5417F2A243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699831305, "uuid": "480b10b6-aaa9-48ae-9063-12d5042457fd", "value": "74fa4eafbabf54ed84e7ed9acb48dcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699831305, "uuid": "ce96f05b-ca05-42e4-8002-2fb32c61273b", "value": "49152:rsVjOztRwohuzcMwF5yNkr+eHlBJ/k2IDUu2+Rd:rsVjGAxcMEyNkrzpDz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699831305, "uuid": "6eadfa91-de98-45a7-9155-4513ebc8449d", "value": 2510848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699831305, "uuid": "a2380048-ea50-4893-b433-57a68409103c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699831305, "uuid": "32669657-2ccc-4fe4-bee3-8bf1fe5e5b19", "value": "Purchase order number 5500043621 from 140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0259d388-8136-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699777946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777946, "uuid": "2baef75e-f76d-42d2-b448-5ab8e3f55695", "comment": "Malware payload (Formbook)", "value": "461fe6b51571b9a5aef6175789fa6b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777946, "uuid": "2e9821d9-183f-4ffb-ab8a-b30bb16043c7", "comment": "Malware payload (Formbook)", "value": "82dc16435a574994fdc6844c28c6293c8b6753eb651ce4faa5a002ad83914123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777946, "uuid": "0438b567-3ced-4f53-83f3-f3f5223e761b", "comment": "Malware payload (Formbook)", "value": "fadf2e2b67aff5341ad78bef55fb91f2659b5383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777946, "uuid": "f102cf71-14d6-43ac-a253-04fb18528e59", "comment": "Malware payload (Formbook)", "value": "37f8c819930ec5439002a56c8691d27d934a7230b17f42c617f2491d1cb163e36214ef6083975d03d60fc8179516dcb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777946, "uuid": "567c9578-6f87-477e-b28c-44e15cf0db35", "value": "T1B6357B3C5A6C1263E0749FB1CBD99917B2E0987B3091DFB4A8D233975741B52E4A223F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777946, "uuid": "aad641eb-7774-4509-9644-c5aac7c00466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777946, "uuid": "750ae95b-d910-472e-9b30-b8aeeea884ed", "value": "24576:p5eiQEkjcTTSLWAptvxTd8VBqaPe0IWrH:pRKo3ShpXd1UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777946, "uuid": "a196536a-d787-42a6-bf0e-65d2e2432d8d", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777946, "uuid": "bad589f9-0b65-496b-b6b2-cdf6def40d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777946, "uuid": "7b520ab5-fe31-45ca-accf-3126b115761f", "value": "Receipt 91888 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffd4647-813b-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699780304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780304, "uuid": "a4a62fcf-a03d-4ff7-9db7-41e9ee9e8f39", "comment": "Malware payload (Smoke Loader)", "value": "a65827721ae0dd09dc5c8672964b2919", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780304, "uuid": "e8590f35-9c23-413b-8296-c9fba363f6fe", "comment": "Malware payload (Smoke Loader)", "value": "83a8d29698443f1eeac7b66c746d8327b7185c03ca9cd9c9f6eb0e8133bfc957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780304, "uuid": "d0ce579d-1fc6-41d9-b585-37027f865cae", "comment": "Malware payload (Smoke Loader)", "value": "f98531606ccdcbe627447f506a57cfa48d7a8a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780304, "uuid": "4694022d-7b68-4cb5-aa55-89e9b5e44e5b", "comment": "Malware payload (Smoke Loader)", "value": "692191667eaf899a6781a13da2da6d4e4769492fa94af366f3298790236ca8606755fd6473d0723b1f896a3e47ea7879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780304, "uuid": "bbe53da8-793e-4543-8323-7e5ac9514435", "value": "T120241A1352E13DE5FA268B728E1FC6EC760DF6508F5ABF69221C8A2F04B1172D163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780304, "uuid": "92d7c448-9b05-45c5-89b4-786fd563faa1", "value": "790940ca85ea46614d5b25d37dfe4c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780304, "uuid": "5d7d9702-4c70-4466-a5e9-c92554c9fc20", "value": "6144:8xE7KLtRtImXgFhfXviP7++nwshZBqU3:8v5PXgFhffiD+HslqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780304, "uuid": "916ebc2a-8305-400d-a440-f0553a8676c5", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780304, "uuid": "d1bbafd2-3553-4661-a4f4-37eb88dddbc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780304, "uuid": "18545960-eaf0-47df-bfbc-8e816f077024", "value": "a65827721ae0dd09dc5c8672964b2919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4990b528-81a3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699824880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699824880, "uuid": "baeb3d8e-f179-45a4-8e1d-3ca7889bd36d", "comment": "Malware payload", "value": "477cd89aae640482eb9a9e2ef7427c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699824880, "uuid": "37149585-6320-4878-9744-2b58c6370fc1", "comment": "Malware payload", "value": "849e62ba24f2f73f5f1cdc66dca6800777cf8b6361d3a01be7f919c766491cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699824880, "uuid": "4be403bc-389f-4f71-a61b-e3b159598253", "comment": "Malware payload", "value": "21c1562a5dde2e0df70f781b787f4c8d70f7cf42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699824880, "uuid": "df53b837-e727-43cd-842d-21677ceea943", "comment": "Malware payload", "value": "46dbca9d92528067fcf4256a6bc0bbc9149248f801b6535d4f3a8dfb5fd6d3592aea7786d97c10f98ec85d7e9ea91507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699824880, "uuid": "47adf2f8-adfc-4e3c-b7f2-8e72a39e2a94", "value": "T13A044E15E6C1A4DDDD7807F90CB5B38C1C6C6D3918214EC73FA83A89B1BA572287E64E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699824880, "uuid": "e7c71568-c9b2-40d7-9a2c-4be92b5f627b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699824880, "uuid": "828c9e24-91e3-47cc-84b4-d96c3225d550", "value": "1536:FV1CzwYBnhDFyDIYYUYUYUYUYUYUUYLYq:FHCzwaFDYYUYUYUYUYUYUUYLYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699824880, "uuid": "597f67c7-767d-426c-9cf7-937ea8168129", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699824880, "uuid": "0974a0c4-a024-4e2f-af07-bb0587b1dc71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699824880, "uuid": "460f1add-ea3a-47ab-af67-e9719a8751c8", "value": "0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060434e1-8136-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699777952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777952, "uuid": "e05c1bde-4a0e-4718-aee7-09f44d2a860a", "comment": "Malware payload (Formbook)", "value": "6dd4e63b0bfd50741efe46da5ce9f32c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777952, "uuid": "6fc6b961-279d-499e-a1e1-79bb2ecb7912", "comment": "Malware payload (Formbook)", "value": "85f953d72889a0c7dd1908d932854ce5999e6bf65feb103e611cf20e05f353fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777952, "uuid": "6b5f9a3f-03b8-4046-90d1-817b86630d53", "comment": "Malware payload (Formbook)", "value": "d752128ae6aa7e03d71b19012f0319a04fd962ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777952, "uuid": "5052b0e7-17ff-419c-8e59-5ef5d52c6c02", "comment": "Malware payload (Formbook)", "value": "ba62f5a6acc1797c2a81c7e1d8cf2cdd62855ac37a0efe34dd1cb656ca970abbcacedfa057935157039b719d65e5077d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777952, "uuid": "c79cf4ea-baf0-4bfc-a500-bdceddaa23ef", "value": "T161E4BF0DA3644297F0542B75CA7D6E190230287C75C1EBD8FDA57B1BEEE6BA6143302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777952, "uuid": "6e9fe49b-5609-45d7-83a2-8de1df0a9805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777952, "uuid": "1ade98d9-cbda-4cf8-a2e4-d2f831474d3f", "value": "12288:UApFWJp0PJIEisnfAWS9eVDFSPNlNxMfOJUKrLFAzNa4AA5GqOdiG:USFRnj5RorNxMfOWhA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777952, "uuid": "db1412ab-d3fc-4510-b074-9ec22a78aa99", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777952, "uuid": "e35852f4-6c65-42f3-9559-307f5ca3f466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777952, "uuid": "b18c93bd-2f65-43a6-ad0c-792a1cc34a69", "value": "BOK9897863546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f59364c-8182-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1699810824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699810824, "uuid": "a1e29120-276a-4afa-bbad-31686e436c1b", "comment": "Malware payload (RecordBreaker)", "value": "27f6ac34a792076fe891aaf3957f2cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699810824, "uuid": "dbcf6d5e-5e0d-4dcb-ba41-39d821db151b", "comment": "Malware payload (RecordBreaker)", "value": "864ac7b76a3f8b2364a4f840a7b51d66a03c9811cf3832940ab241767b32c8ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699810824, "uuid": "4e11cd83-aa1b-4c4d-b45a-d190438cddf5", "comment": "Malware payload (RecordBreaker)", "value": "34fe49c23fc193dff0ae15e6ff9706dec3e587ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699810824, "uuid": "ec823505-86bb-4b53-8973-c3da9287933f", "comment": "Malware payload (RecordBreaker)", "value": "42b89253eefc804555eef8a44da3fb3c3ca9e73efa16ccd3df319ef9d64eb95d6e5fdc172b7aab201fc346a9fc9a0c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699810824, "uuid": "3559b6a4-b307-48bd-a721-121dd4accf78", "value": "T145A3D6D34278A302EB94187316D3EE737A59DC3E1D25BED3AE51CA5381EE45009DA2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699810824, "uuid": "abae8fab-9e19-49b3-80f6-a434695892bb", "value": "0fcb7632c48018563e5af2f63681ece5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699810824, "uuid": "e227475b-7779-48e7-8055-b95decca2a91", "value": "3072:VANfQKMuflyKX9FBFya6mob2lRL6RJ//5O:60O9FBn6pb+URJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699810824, "uuid": "f47ace2e-94fa-4ea6-af1d-a8877d61a31e", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699810824, "uuid": "5c5e627e-d760-41c1-9cfa-9abb6a20bd65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699810824, "uuid": "b45c9779-f199-4479-8f5e-36776ed5f94c", "value": "27F6AC34A792076FE891AAF3957F2CFE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fec719-8139-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699779381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779381, "uuid": "a8d74170-b6b9-4d4f-babf-d7f27c692d74", "comment": "Malware payload", "value": "17dbb6d805d974b6d3f689cc201b1255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779381, "uuid": "69f778d1-ad73-4855-8d7f-52423e029c03", "comment": "Malware payload", "value": "865caf98fd701b3b9887b81a2ca3467cbe1c7eda5b7679fede1c7ddea3b532e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779381, "uuid": "fb0dcaac-f662-4d0f-beed-b6c4432de876", "comment": "Malware payload", "value": "097b9a2a25f00f9c9cde4736c6008d7025212d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779381, "uuid": "766a2f08-c24d-42ec-8d28-6e885358d635", "comment": "Malware payload", "value": "9dd8246aa855214c00ff89f3635868c029ee95dbd8cfc1e79106ad2b8cd5fe30b90f87e220d7ed4d8eab67f73f047a9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779381, "uuid": "1edee6a4-141c-4686-8fae-4e973ac16eef", "value": "T1E756DF23B390643FD4771A368C378794693BB9602E2A9E672FB41D0C4F357816C2B75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779381, "uuid": "c58ee107-d62b-41b3-a1a4-86f02227eba2", "value": "5dd97cbcee7e1541acc0671bdec5c473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779381, "uuid": "2eb880ca-932e-4fb9-be79-cb6c2d156f99", "value": "98304:YUWOgS2Up3TpSsaQldxy6Qn3g64UFkcSJNsPGw7Wb/DibBZNNP2QS:t3VkExPTpUC+Gwqb/DiNzNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779381, "uuid": "cc50f570-504c-4f60-809e-0ff005648807", "value": 6274936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779381, "uuid": "3d2b3915-9995-4819-a608-215ade46c83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779381, "uuid": "b34fd190-ab23-49e1-aad1-f4237bdefba3", "value": "17dbb6d805d974b6d3f689cc201b1255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6fc134-8100-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1699754847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699754847, "uuid": "6d0f2843-4cb7-48ac-9ba2-18af21a7da0b", "comment": "Malware payload (AsyncRAT)", "value": "a79872d39f5825629cac340e09b28f1a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699754847, "uuid": "72503252-2f4a-4efc-8f1c-f8fd4a60321a", "comment": "Malware payload (AsyncRAT)", "value": "869a8a2daa890b414c51af99be794e78d6bd3c60d1450b017e78d421428587c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699754847, "uuid": "0e288cdb-a957-48b6-b285-26477b1314ff", "comment": "Malware payload (AsyncRAT)", "value": "15abd6b104e8eaf6af18cce3fec85efd5f5c133e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699754847, "uuid": "b093f180-689b-42d4-8e47-6baf645d82d0", "comment": "Malware payload (AsyncRAT)", "value": "af13b01d800a0f39d58a49c41a4b8ed8bd50559f9761dde7c174a50420359286b030667ff0de3fa9bd0befaa40d90f57", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699754847, "uuid": "87b0f5f4-a2fa-4241-b084-9bec87bf7117", "value": "T15F236D403798C136F2BD8BB5ADF2A1418679D6576A03C69D2CC814EE1F13BC59603AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699754847, "uuid": "93102fe3-c8de-4f3e-84d6-0e62646ddb1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699754847, "uuid": "7c8a8779-3c55-42cf-9728-602dace9d351", "value": "768:596mxUTILWCaS+DipSxLyjilE8Yb6gev8x0rvvEgK/JXZVc6KN:596AKWpSopzbtPx07nkJXZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699754847, "uuid": "d623c20b-3e69-444a-9121-820f5818261c", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699754847, "uuid": "2ebd4713-dacb-490e-9726-26f8fdd24a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699754847, "uuid": "204f51be-270d-4124-b8f6-ca01510d47f9", "value": "bRxV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efd9908-8136-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1699778128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778128, "uuid": "9ebbbe68-621e-4333-8724-3990c5943803", "comment": "Malware payload (RecordBreaker)", "value": "d14f1561428b57751cfaf8de7bc72207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778128, "uuid": "c5100227-4e0b-4280-8943-3c4411a6dc6d", "comment": "Malware payload (RecordBreaker)", "value": "8a3ac9065cc4ff0a1e141dfff727f9f504a280c6a9b9834634a4c343f35fb8de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778128, "uuid": "5ae52805-ca72-46ca-bea9-4e3c64e8063c", "comment": "Malware payload (RecordBreaker)", "value": "6c49c4147ca1bcb6075895e854ae1fddfa3031d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699778128, "uuid": "73a913ad-00f4-45e6-b63b-34f22db3834b", "comment": "Malware payload (RecordBreaker)", "value": "8aee7248a541a5f6714b92fdde7b3873e3245f2e1cbda90bcae2cc387332355b91ba3813931fbedf5568690948f1a8a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699778128, "uuid": "775d705b-280e-4783-b671-4e580bbb272c", "value": "T159F5F121B401C072E5F200B5A6BC6F76593CAD25072814EFA3D82D7E6E345D27B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699778128, "uuid": "4851209c-3cb6-47e5-9a59-f105e63baf33", "value": "7c097090fb6d89eb735e5178b71d08fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699778128, "uuid": "d7a9104f-8f2e-4b90-8cff-767ff8c7bdb5", "value": "98304:e6PEV+Ym145U2VxdBt0gHMOlDjoxHsc2JS9mihr+DywoS0yBBx9pjD:XPrYpntLHzCWmTyf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699778128, "uuid": "dab89dd3-adc6-4fbe-90cb-22ae4d85f8d2", "value": 3521344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699778128, "uuid": "c9ae05c3-9734-4a6c-a8e0-e50ec6ca0f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699778128, "uuid": "bfb405de-c478-4525-9970-638784a02773", "value": "D14F1561428B57751CFAF8DE7BC72207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130915c4-8120-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699768525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768525, "uuid": "06242b85-0781-42a7-995b-0bb46c800835", "comment": "Malware payload (Stealc)", "value": "5b11984d808a08373fafde3b252dbdf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768525, "uuid": "b8e71981-560b-4eeb-bb29-cfa78d3faf22", "comment": "Malware payload (Stealc)", "value": "8c5a38887768a98da1ba757c359a2f24b137ef9b78c7b5ba8383d999582d1b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768525, "uuid": "61e1c4cc-9ed9-414d-99f8-9c94f16d4433", "comment": "Malware payload (Stealc)", "value": "0b925d0a2f2c06bf3cb56ea4b0faf905d88659b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768525, "uuid": "2e4af95a-b177-4b5e-93a8-a2f670c28fd4", "comment": "Malware payload (Stealc)", "value": "3d5a0eba66f2433d9afa90adb410075d81f74291e7c376b4bc254ec53c43a9f1a90133ee2915f121a25339771594b657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768525, "uuid": "b719b60c-659c-4c78-bed1-94cbbbe31ffa", "value": "T155D6F1663FEB9917BAF950168281B65F89A3309BC373701706160DDD28B73689D07FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768525, "uuid": "4e8912f5-576a-491f-a922-256998403e45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768525, "uuid": "31401b7e-63ea-4e25-9479-b9624579a203", "value": "196608:u5Pub+LsCo02yq3V/TEzmabNLddsEFjd9F9Hk5Ydje1I9f4qWdKzRgll4:YmbNC8rGbw5AQI9f4jKzRgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699768525, "uuid": "f4e9fea9-340a-446c-b1fd-5642d1c4a9ac", "value": 13202432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699768525, "uuid": "37523802-a33d-4de1-8c26-c66c490cb656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768525, "uuid": "a4ed2ba2-b230-4d4c-b813-fba8a9b0795d", "value": "5b11984d808a08373fafde3b252dbdf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ea947b-8149-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699786226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699786226, "uuid": "a647c9b0-14c4-4120-837f-3b39a511a713", "comment": "Malware payload (LummaStealer)", "value": "760f6563960baadb925639e368e8898b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699786226, "uuid": "de624649-6d99-42ca-97f8-4283e0d7ecfd", "comment": "Malware payload (LummaStealer)", "value": "8e2b1213dc5d4895355bfb61be049d454f5b06fad8807f9744a719492796415c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699786226, "uuid": "222df87e-d1c7-4929-bac0-5a6c0744c651", "comment": "Malware payload (LummaStealer)", "value": "badae5c4902d3b3698ff03d007083d3be68bc3c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699786226, "uuid": "722f1245-2df4-4831-9cfc-cb5b0b1da365", "comment": "Malware payload (LummaStealer)", "value": "a493f40d2d66fa2f9ee8af93a423dee4ae39698df44b5f599f17f2819ff7bddc778c124ed6f14e1178688dc38d244406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699786226, "uuid": "df069da9-0e09-425a-a090-72427ba71751", "value": "T11A6523D228D844F3E8F6237164FE0357033CBD75AEAC832B6695426EDDA1960A432737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699786226, "uuid": "44e75bab-f569-4382-b780-bf44238846c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699786226, "uuid": "27c2a41b-47e7-4555-b0ca-abd2001e648e", "value": "24576:CyGPL9lvEmpuFCLUVPeedIsI6jGdp3Dbto4EgS2DCilymyYJgo71cWGANBI:pApuFCL8meOzUGvm4EgS2Bypggo71cWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699786226, "uuid": "e5a5e2c9-6879-4e47-9ef1-a1e2782d942c", "value": 1456640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699786226, "uuid": "8b78d7c7-84cd-4dcc-9fa6-9830762ba276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699786226, "uuid": "397707c0-ef05-4e42-a536-dc66bfe1f4f3", "value": "760f6563960baadb925639e368e8898b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd420ae1-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795439, "uuid": "96bbc885-0cd2-4fa7-802c-cf9fa21409dc", "comment": "Malware payload", "value": "3cb9efe410a2ae4089859816ecf563c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795439, "uuid": "8426fc07-38d4-474a-9a1e-f6ac67f9a7ef", "comment": "Malware payload", "value": "8e578257277fb1423a49a1e0572b7f8eeaf5e1312c68209364b4273bc0c3c9f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795439, "uuid": "b9c4f60f-37f8-4451-98a8-6e0509c5fd4d", "comment": "Malware payload", "value": "23c6eec3f1f064d4bde8342c7489af2c770ce743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795439, "uuid": "828af219-0385-4b1a-bf6e-8e7d4fe944ee", "comment": "Malware payload", "value": "4de72042cca43d35eb64588490a879891522654c209887ad4ea43660268cd01963d781c03d1fd79dee921a109291b843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795439, "uuid": "c94fff88-8066-42e7-a6ff-8aa4c1fe5d12", "value": "T141A5CF27F112C465C18B17F146A31339D9F8A7727F74CAFB27D8CE29BB32112591A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795439, "uuid": "309bed09-4690-4f4c-8afc-49335b2e8110", "value": "24576:DYW3Fm75rdcG3OHmmH5IPbKSPVE5WVKuGc6jE0wprct:DY6SrgHjQKS+WVKuGc6jEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795439, "uuid": "dfd67073-bee7-4457-8d72-a8fe904377a6", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795439, "uuid": "0ce938b7-6950-4a93-b091-310113e9e1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795439, "uuid": "c92787c1-6169-490f-a26c-8cd8f7bef189", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.14285.30295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f443282-818e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699815924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815924, "uuid": "d91a2e24-6426-4df9-bcbe-c4f313e09319", "comment": "Malware payload (AgentTesla)", "value": "0ef8a6bde013af599af743b3a27eda42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815924, "uuid": "ccf3dd6c-aa78-4873-88ab-ea3f2d8ca998", "comment": "Malware payload (AgentTesla)", "value": "914f0873c7288cf81e90fd402a837a1f8e18df8709f887d4fbdde4414d072dfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815924, "uuid": "d218d463-e0ec-4b41-bb9c-f0cb695bdeb8", "comment": "Malware payload (AgentTesla)", "value": "7182790e93d83fbd835321fc0d874b2583ea67af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699815924, "uuid": "11e3f075-9d3c-46c6-a2d7-3c8ade622eaa", "comment": "Malware payload (AgentTesla)", "value": "3aae77517c8c6414e814bb8d769968a9b2e434fd87c8a243ef13f088da687510641a21fdab2fde3456643160eb261110", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815924, "uuid": "8b82af8a-0cb8-4422-acfb-c39d209c138d", "value": "T1CA056A56B9B554A1EA04C73AC5E28C0483A3EDC456F3961A68FD72E90B7337E4F43782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815924, "uuid": "735599af-dc0b-4111-b11f-5b9c87f80b36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815924, "uuid": "efc26a69-41e5-4cd6-9fa4-f36e58fce980", "value": "6144:HgdnkuTTvxtpnfxK9r6YQHx5SI6yNMMPkFDwsn8isq6bNOVQlZMYNBkG7sDjw:8nZTTxf4rFQD/6DM8Ms16bNMQHMsn2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699815924, "uuid": "2eb3eb6e-02bf-4387-87f3-86d501e4d369", "value": 851216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699815924, "uuid": "09c0bb55-2e02-4a1c-87ea-4b6873f78220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699815924, "uuid": "77919bc1-a1b7-452b-b99e-b26ef0c35cac", "value": "0ef8a6bde013af599af743b3a27eda42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3726000c-817d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699808529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808529, "uuid": "aa373d8b-e70a-4e7e-a3a9-e3c5a58d9641", "comment": "Malware payload", "value": "5fea22f442e7fd34a54008e363446d13", "object_relation": "md5", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Rentdrv2", "colour": "#084BD5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808529, "uuid": "e18b85ea-5844-4ed5-9811-786d719953be", "comment": "Malware payload", "value": "9165d4f3036919a96b86d24b64d75d692802c7513f2b3054b20be40c212240a5", "object_relation": "sha256", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Rentdrv2", "colour": "#084BD5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808529, "uuid": "b7febc0a-7a98-41bc-b19e-12057550b696", "comment": "Malware payload", "value": "67d17ca90880b448d5c3b40f69cec04d3649f170", "object_relation": "sha1", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Rentdrv2", "colour": "#084BD5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808529, "uuid": "716fe5a4-882c-427d-ad95-21e532b387e9", "comment": "Malware payload", "value": "439f5f88361b6a2e03bb8094c89f147747a4dfe9ecaf0be33fe68f3f487f9d6ef60f251a096c89d32b456f20f6d477de", "object_relation": "sha3-384", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Rentdrv2", "colour": "#084BD5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808529, "uuid": "1762297c-27f8-4165-b899-1860cb20f238", "value": "T16FE26B52665C10E1D5DFC036C3B2CE63BEB13289236167DF05A4E92A1F677C5A339329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808529, "uuid": "24d2b53d-0b7a-4906-b007-df70d25ae917", "value": "1fb8e85267a70537d661f9df2fc215ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808529, "uuid": "dfcd75a1-0cce-4d4b-8421-50e78eb60765", "value": "384:oQQFlifjYsLztg272Kw0HWL3XLI02kUW6TXr0I2juriMh3ay50ZSxR9zusrhwC:H8i7YsHW2aKwCWDlurd3h50Zi9zuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808529, "uuid": "e465d430-4645-493d-b52c-f3f94018a6c0", "value": 32328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808529, "uuid": "09664d4b-acea-45e4-9ba0-6b47a55c2f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808529, "uuid": "715d83f4-dd0f-4b43-8596-9278be54c03d", "value": "a.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9cf52a-8196-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699819547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819547, "uuid": "c0c6f247-6686-4e15-bce3-fdc83b90e4ac", "comment": "Malware payload (Mirai)", "value": "f4d09ac0b6a35fdc8c92b3172b521492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819547, "uuid": "13a613c4-fd02-42dc-9997-9b1afda1015f", "comment": "Malware payload (Mirai)", "value": "945bb3047d158e315f5202d3eb7ad6507adda08b0ed94d77ab256c0d1d7f88a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819547, "uuid": "042112c3-8347-4300-9b42-5c6c1ee25c05", "comment": "Malware payload (Mirai)", "value": "5782a9c5ae98932fb756d9a893c3e2b9c820d86c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819547, "uuid": "8ab3a4b1-d4c3-4bdd-9514-ae286a73b22f", "comment": "Malware payload (Mirai)", "value": "5053fcdd3ba254e816215bb049d6f2d56e35268ab17fe1b233a7816f697a96a5e828ece98e460cffd90bbfd5d1db7e2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819547, "uuid": "474d9dec-653b-42b7-88b9-774704fc878a", "value": "T155C37C73D8256F68D165C170B0709F792F539A9182472FBA68B6C2BA4083DCDF605BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819547, "uuid": "6dac0402-da72-4f5a-a246-58842a05be55", "value": "1536:JaNuPLp2LA5YyPKP95gVCmKGsONRId9ys/+3y/W3USNNpOPDyl1db0:JT92QYfgV4Gcd9ysWC/WESNOPDqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699819547, "uuid": "ab1945af-db5a-4a7f-ba2f-d0b36366dbe1", "value": 125216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699819547, "uuid": "4303ddba-8948-4344-9fb1-4f1a94c96ef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819547, "uuid": "46fe8b97-9586-4155-941d-e4c229c7b8ac", "value": "f4d09ac0b6a35fdc8c92b3172b521492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2dd432a-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795449, "uuid": "4cdb3ad9-0a93-492d-a565-dba4cd0612d0", "comment": "Malware payload", "value": "18cb7a1e5387fb454ca903a0c68e9de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795449, "uuid": "074874de-0ecc-42d5-abef-39f078ec245e", "comment": "Malware payload", "value": "9661ed586dbe16987ab1823f92cd854ea32b1817f04a95656917bf3977c1de79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795449, "uuid": "ca6fd01b-9334-4696-8124-2262176ee55d", "comment": "Malware payload", "value": "ddfe675ee53ce36eafb2dbd429bf7ec892e1cfc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795449, "uuid": "2f6ad03b-217e-41ee-8c96-49611f4bc76a", "comment": "Malware payload", "value": "669b9cbd67399bc7cfc11874ed9c3a60e8205944704dcc08de444a91e98ae2cc4d66578608da4026ce95888e3638af6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795449, "uuid": "5b6f39d1-a544-4b05-ae37-b67675e68951", "value": "T1B705AE45FDE3D1D6C711A2B00EEFA7366A7789634F319BCBC318DE199E221A0563B121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795449, "uuid": "bebbfd7d-a0bb-4f40-8602-b686a134c4f2", "value": "12288:h1tPUzDM5Eph5105KwhvNq1bP0qKksKUkNl:OY5yhqNq1b0qmkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795449, "uuid": "c72975a3-3a19-4e38-b52e-b9c75e29daf7", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795449, "uuid": "74d69917-5f31-44a4-90c4-14adc3b53a2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795449, "uuid": "b724abf2-4ed7-4383-9991-76768e4503ad", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.27439.30754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c18e4f1-812f-11ee-8907-42010a9c0042", "comment": "Malware payload (404Keylogger)", "timestamp": 1699774982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774982, "uuid": "59fdc1c4-30fd-4eb3-946b-f4a9d190f9f2", "comment": "Malware payload (404Keylogger)", "value": "b28fed6e73d8203eeebe48b75835f1a6", "object_relation": "md5", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774982, "uuid": "c49b4eca-e4e0-48c3-b08a-0788d64b3d83", "comment": "Malware payload (404Keylogger)", "value": "9797593a4d2f9d01dbb48e57bf0aa5bb970b6ad988f5f8df872ea6f29ece00df", "object_relation": "sha256", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774982, "uuid": "ce2f1549-25fd-4d96-a95c-30e24e5994d0", "comment": "Malware payload (404Keylogger)", "value": "45b15d54281ebd0a946fa905dd85c563a221ec90", "object_relation": "sha1", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774982, "uuid": "f63eb8ee-fcdc-43a8-a8b4-91cf2b967e09", "comment": "Malware payload (404Keylogger)", "value": "07b87383897e35952319e8374a5ca4358e396b94739b6953da28f56b465dce8e04c4da1f8ab3c4daef4c3d5f2b83191b", "object_relation": "sha3-384", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774982, "uuid": "d39bb96b-7327-4dab-980f-0084f1f96282", "value": "T117B40131727F0B32E54D87F8C8A3592813FA2E6B1008EB4DCEC578EB6752B508554E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774982, "uuid": "aa12f175-8712-4c71-944b-78a4a553dd0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774982, "uuid": "9ad0b563-6595-4c72-9492-68576a21f643", "value": "12288:11DKzKH/PPM+WC/cj4KmuMT5FqQTkRmGCnmLS0beG3:vDKQ1q9mLu6mT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774982, "uuid": "060ecf27-6418-47b4-ba03-4a3760be0029", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774982, "uuid": "1e438308-189a-4c7a-bec5-13a027d8d1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774982, "uuid": "57947a57-927b-4a94-8d06-4c599dd1a72a", "value": "b28fed6e73d8203eeebe48b75835f1a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1864fb9a-812f-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699774976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774976, "uuid": "907e5fea-e8e4-4a01-9b02-64e7d2d8fe7b", "comment": "Malware payload (SnakeKeylogger)", "value": "b5fbcda9d5577a1348fd66393e834c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774976, "uuid": "5b34b617-2f08-4cb9-8f81-c7a109bea19d", "comment": "Malware payload (SnakeKeylogger)", "value": "98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774976, "uuid": "1437e205-5b98-49bb-ab49-24fad013ed21", "comment": "Malware payload (SnakeKeylogger)", "value": "de3a6bbabc63574238cdc3f78058fa752da31da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774976, "uuid": "44e4cd81-638d-4951-982b-9d67baac5412", "comment": "Malware payload (SnakeKeylogger)", "value": "750e85cadd2b9c81b199dfa9f21ddd5722da316c2be9c4e4d3ee0169c7f61a31320bd77f8316132384495d274879bd07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774976, "uuid": "a2666675-25b0-4fb5-a9e6-8b7684a6653b", "value": "T13B7412DD072DAB3DD1B721F707DD9C844BAD72F0115ADBEAA85A71C35EB1388AC80981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774976, "uuid": "26cfeb42-5eab-4c8e-8687-f0622835d585", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774976, "uuid": "f4373852-bbc4-44dc-a812-0ab7ee3f94ad", "value": "6144:JEasJm3yZ1bHuuywQ7sUeFb2KnZFsTxvULZYE2Odtyqd72fBQD:JEyHutZFG0YrOiqoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774976, "uuid": "aca0da6e-5770-47c6-8a8c-5ac55133a6bc", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774976, "uuid": "a6e78f0e-0a1e-450a-bc72-84a507ba05f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774976, "uuid": "9a23d487-3247-4d78-8ae0-b1e02182ab71", "value": "b5fbcda9d5577a1348fd66393e834c38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adb8e85-80f7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699751036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699751036, "uuid": "f8a12479-0e09-4fab-8c4f-f52767bcca31", "comment": "Malware payload (Mirai)", "value": "48d367b07cb9cc816e1187beba4490b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699751036, "uuid": "f813d8e3-e1b9-4370-b790-50774c8840c1", "comment": "Malware payload (Mirai)", "value": "99125c4b807fa0d3250b6b1552ffaae9a32f1edbc05f8281f9afb6822d27dafe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699751036, "uuid": "27843ed2-0795-4e98-bfc0-38b2e003a5ae", "comment": "Malware payload (Mirai)", "value": "66513edb495fb26487ce63012588f156078acf00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699751036, "uuid": "8a91a294-73ee-4e6b-872e-27b5c89c655a", "comment": "Malware payload (Mirai)", "value": "9cf5e852d56f5a21beb36970a0f78cc7e48dda537a6538b669922a7dd5c4a2ad4155abbfec9ea03a5792226a336a63a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699751036, "uuid": "7a8f3db4-c754-4f17-97c9-04f828988830", "value": "T1ED434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699751036, "uuid": "a87b1946-589c-4514-8709-e8e9397353d5", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcTDj5gk9vWnTI4eBH+4sToQLDKFv:Yn/EsW5qhSh6am0lWnU4GH+dNLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699751036, "uuid": "cc8fa552-92f1-42a0-9e4c-6885f2bb1a91", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699751036, "uuid": "c8b40c8d-2aba-4097-8d7e-f57616f4d559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699751036, "uuid": "0c3a58fe-e285-4ca7-9da1-350fdfd79d1a", "value": "48d367b07cb9cc816e1187beba4490b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1ae11c-813b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699780168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780168, "uuid": "3a0c870d-29b7-4dc3-881e-c3a8b9b50cdf", "comment": "Malware payload", "value": "386d0142f49b84591e5d8d4930b8a6de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780168, "uuid": "cbf35a3b-4b57-4ed2-897c-d04aa382ef8e", "comment": "Malware payload", "value": "9a2bb3b91c9ebf238eaeba5f872dda5b39c51877d30df0c357ff710aa718cdaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780168, "uuid": "c44622b5-e0aa-45b9-b90e-07198a7e572f", "comment": "Malware payload", "value": "e6bba91d27362516866df85df4c742739ff15448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780168, "uuid": "8865e022-28b5-4659-beef-3bb512283100", "comment": "Malware payload", "value": "02cefa45b3f7ce5d961186b344bcffcf7938327a8ebacd05bd88b1ef6d14e36cf31432748e0b286caf2432a59233dc56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780168, "uuid": "3864d80b-22f4-4a20-9291-28269db57ae3", "value": "T11826D700D601561ADDBB24F54BAD313EB14C9FE0131864D782C86AFADBBA6F13E3519B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780168, "uuid": "f326294f-2202-4c09-87f7-568e84fce125", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4xqU9uBB7fQbA6qbC6p:rzC+CqfG2VcruFG2KAyVEDLvTQtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780168, "uuid": "c1010cba-37c5-42ad-beae-fa8ea3570328", "value": 4628202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780168, "uuid": "95fd25f8-8ab0-48ef-bd53-d8022b775acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780168, "uuid": "12533bfd-5e8b-43aa-9cd9-91afca049d0a", "value": "386d0142f49b84591e5d8d4930b8a6de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4452ccac-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822724, "uuid": "5667e498-0b76-45af-af6b-124e2057bc24", "comment": "Malware payload", "value": "8da942eeafb8cace9116e9dc80c530ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822724, "uuid": "2a7fff65-81bb-4271-be7e-bbb498d92180", "comment": "Malware payload", "value": "9ac7b0c47fd583162cfa062722020b27a76a32b3a7967062d4aceda9373264f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822724, "uuid": "7c57fba4-9b14-4647-adea-bfe5c27fe172", "comment": "Malware payload", "value": "57e4df20f55b5c689f77a9e72ce3645dd11b1f80", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822724, "uuid": "e9f198d6-2791-4309-b137-a178b95e00e6", "comment": "Malware payload", "value": "79089ead25ab070653573e6e8fafd022ab13f31c2ca4d87508ce2a69146e962f9728111657683689b8db89197c89543b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822724, "uuid": "57c5f5c2-efda-4ba4-a706-d543a07ca4a9", "value": "T19B83095AB9814F12C5C612BAFE1E018D371357F8E3DFB2239D206F20B78792B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822724, "uuid": "3b059d11-39e0-4b8f-b156-10a96f7d6206", "value": "1536:bFnIZUXHKgW6i/2QK1e0GzsriW8pZcahlo04IFiwGSWo5Hy8r85dYoewbZnJZ:6UXKbC1WAiZrcaPGVo5Hy8r8jBewbZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822724, "uuid": "749bb252-0b7b-4c0e-aef9-0827571454d3", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822724, "uuid": "9352f0c7-6052-4ca6-9102-ebbbc13d8deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822724, "uuid": "18dcb114-6992-4a2e-bd68-a6df566f0109", "value": "skid.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0ca631-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795441, "uuid": "49893fbd-d08c-42d1-b0d0-6f9a38a8ceac", "comment": "Malware payload", "value": "a26ac3e5832ce26889017db05b402305", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795441, "uuid": "08ea9923-119c-44d9-ac65-e2700563bb2e", "comment": "Malware payload", "value": "9d74abfe70c82e261071e579aceb4c19942857a06987b777bb8917d81633eef7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795441, "uuid": "245695bf-dc5f-4ebc-9f34-280fc3a7b825", "comment": "Malware payload", "value": "188b7922078ff8478377decbb8f2caaf7a60bc7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795441, "uuid": "01c0959c-05b7-42e2-9305-d3d4905a8a95", "comment": "Malware payload", "value": "6805968aec162518bf3463b4db3c2973dc30e0f0b6d80ec4b10ffbfe81a0e93418c5f67d98b32e7e4392872eeec905e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795441, "uuid": "16978c24-7249-4fba-9ad0-fa0b26d033a2", "value": "T1D775D0D1F60053B3E1A649F1442742CCDB7A1DE52D3AD9A712E2734F39322A8BE33599", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795441, "uuid": "e3a47627-ca48-469e-bdd8-a54327d8cf9e", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795441, "uuid": "0359a4a5-1077-4c04-a5fd-d8f7b18b374f", "value": "24576:VbRs0vMjHv6HTaZ3XWeV0zGy45uv/UQFS:VNfMf3XXV0zGJ5YMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795441, "uuid": "4cb509df-f6bd-482c-aa5a-77b0f60c8a3d", "value": 1692005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795441, "uuid": "050bfcb0-f2c4-4b47-9e17-676836d404d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795441, "uuid": "26c27018-0883-42f4-af43-9da0b1eb28af", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.28583.14570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f762c79-811f-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699768224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768224, "uuid": "d0f056e4-b9dd-430a-af3e-21bf4539a682", "comment": "Malware payload (Stealc)", "value": "faab9c35332ec36796b429ac8d8f5195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768224, "uuid": "7d582c3e-7668-427b-8286-e8e0ee3d11a1", "comment": "Malware payload (Stealc)", "value": "9d8ca0ed84c5b3a858c2230000f28d9326ceeefc8a8a603e9af3c6c1bc65ba67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768224, "uuid": "9d2b9bf3-c2ea-43af-9d61-cd3209cecbb4", "comment": "Malware payload (Stealc)", "value": "815d4d5a6dda901ce6f9f20793f2b506f7c01a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699768224, "uuid": "140826aa-5f11-40af-9c5b-91d3671b866f", "comment": "Malware payload (Stealc)", "value": "dc78dded00fab74763ecd95801a74c01265aeb2d3c2395f03066be8d2d66bf8f25ba635ba142c50198e679582aba216f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768224, "uuid": "de23ca86-a6fc-4a4d-8544-13ce045a5ff2", "value": "T1ACD6F1663FEB9917BAF950168281B65F89A3309BC373701706160DDD28B73689D07FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768224, "uuid": "81fe4b01-aa24-4653-9d3e-bb7bd262b1ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768224, "uuid": "23d5c33e-d983-4e54-93f3-b1f541dce0e1", "value": "196608:PmabNLddsEFjd9F9b5Pub+LsCo02yq3V/TERk5Ydje1I9f4qWdKzRgll4:UGb5mbNC8d5AQI9f4jKzRgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699768224, "uuid": "5c2e43d0-e43c-41b2-a3e2-22831a8ba3f3", "value": 13202432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699768224, "uuid": "0ebb2bf4-96bd-4a53-9f87-38997b5da91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699768224, "uuid": "ad40870a-acd1-48ee-af91-c1ad2e782658", "value": "faab9c35332ec36796b429ac8d8f5195.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f43f674-813a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699779712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779712, "uuid": "c0772c01-afdd-4d59-a514-2771fe42b2f6", "comment": "Malware payload", "value": "87ef2a3f42a8981e5f60301dc3824f1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779712, "uuid": "54b9db90-238a-4e3f-bc4a-312c2b0b490e", "comment": "Malware payload", "value": "9e8582b31c290ab014ce30182f098b7250a3584778c901886acaa48333bb9450", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779712, "uuid": "5a78a06a-7784-4dcd-ad5f-d3c0eacfa54d", "comment": "Malware payload", "value": "2ae2ef4177cacfe223c635b52fefc373309e1700", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779712, "uuid": "d2288d7b-a7ca-45ac-b717-f22e89815962", "comment": "Malware payload", "value": "5787db1b965ca4c286727073d15125b9075a320c47b29746fa19cdf16cf2cc7a28e7f3cda986ad2a9b2c4b897567a18e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779712, "uuid": "e5f93d19-ff2e-4d7b-96fa-9b99c8b8643c", "value": "T13A65F161B3C0C532F5632A799C5B47A47D3A7E503634D89A7BE42D4CEF352813A382A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779712, "uuid": "ef72f5de-bce6-4d04-98ab-b37e7574c6c4", "value": "c05def3ef72f9f03fa668bbf604b6a6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779712, "uuid": "508166dd-70cf-4505-870e-108d450d42fd", "value": "24576:AkpFmglGSppo3HXTLZv+zUbRy/Xe/d/5BlEwEX7apXKWszPEF2g39:AkuA54XZv1y/Xmd/5BiBX7ap6zPi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779712, "uuid": "3b62e0f5-12f0-45b0-8bf1-9446ad389723", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779712, "uuid": "3ebbf5d9-a3bc-413f-9180-a3c37d5387f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779712, "uuid": "4f5ea0bc-2f96-4072-91db-7238d68b8014", "value": "87ef2a3f42a8981e5f60301dc3824f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d69a9ef-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774260, "uuid": "9e8a1b38-cda8-48b7-b960-0bab16854f24", "comment": "Malware payload (Mirai)", "value": "8afe38df6adaec45121dbe8f2ace07d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774260, "uuid": "8e1d1913-d431-484a-8ced-b7cb6559d8d5", "comment": "Malware payload (Mirai)", "value": "9ee8614601bdb9050d34971e11543e3678342d111e8099a481822595ede10f1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774260, "uuid": "524c217d-5583-4293-827c-b327e34ad072", "comment": "Malware payload (Mirai)", "value": "e16db7a6881a1517c5a5931dc20e948c0c7daad1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774260, "uuid": "bcb1327f-3bc7-49aa-bd3a-46b26a725e50", "comment": "Malware payload (Mirai)", "value": "2a1c51b74e45689bd768f79b358217886171c41e12bb98a9f37d85ad8a6c5f3f91872b4b50a3864203bf9a11618353ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774260, "uuid": "7ce13587-ecab-4de7-9e83-d34a03255745", "value": "T13753971E2E119FBCFB9C873547B74E21968C339626E2C645E15CEA012E7034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774260, "uuid": "fcb88f65-e66c-4800-aed6-b4b3d0e594c5", "value": "768:ruVBQl7KPLz+X/rZTnsrZThdUrcOZUehcjxH/IOVJlbplhy7dA+V/z7JcbiB0QR7:QQRKPLz+XdnMwrcOUjpbDI7pZ9RaW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774260, "uuid": "d261780b-cc32-4d01-850c-c0b73b276069", "value": 63364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774260, "uuid": "1d27a79b-4321-44db-a654-48707a76e67c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774260, "uuid": "dfb5cf23-f3ae-4916-97c2-fbe91a52c30d", "value": "8afe38df6adaec45121dbe8f2ace07d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39039235-8165-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699798224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699798224, "uuid": "47d6550e-4323-4db4-bece-2f425e768b21", "comment": "Malware payload (njrat)", "value": "fffc2c71cd0c13f32c78ad90d65ea913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699798224, "uuid": "5e51636a-894c-42fd-af27-d2aae5f49751", "comment": "Malware payload (njrat)", "value": "9f0cb564a338eae1cfe8bb2af269cf3dcb0c3d595e88396d59d127d36bc566da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699798224, "uuid": "661f8155-27d4-438e-8360-eb2ce27f2144", "comment": "Malware payload (njrat)", "value": "25254c4a816ec0fb2cdc329a1145065b4016e85c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699798224, "uuid": "cea2b0f7-67b9-4696-92b0-0909e3d18101", "comment": "Malware payload (njrat)", "value": "27e2673870a0cc0b3d97fa2735610899fd3f2e244dd7b1d64cb8bdfc9f10d6872f3640a5862501b3de6e2a3eb9d5f92f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699798224, "uuid": "d242a954-efdc-44cc-984a-4361d2f81527", "value": "T1EE934B487B958A55D2BD2E7804F256518730F50B6D03F72E4CD120EAA7B3EC44E42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699798224, "uuid": "959d135c-63b0-46b3-9bb3-41e3514ef7f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699798224, "uuid": "4b93ff46-89b5-4db3-aa10-8b04514671d8", "value": "1536:zsGmooN36tEQviFw1ccs4BnvbKfLteF3nLrB9z3nmYaF9bOS9vM:zsGmooN36tEQviFCXVBn2fWl9znaF9be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699798224, "uuid": "52e9436d-de39-4331-9c3c-263409b9d936", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699798224, "uuid": "95264424-8284-4498-915b-305d00819e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699798224, "uuid": "62ed07a3-75d6-45b7-87ca-a8ffe6b92999", "value": "FFFC2C71CD0C13F32C78AD90D65EA913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c46f0e2-8139-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699779331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779331, "uuid": "9854a2fc-87d0-460a-ba51-70a3f3ff084c", "comment": "Malware payload", "value": "23f6e822ddf04b403a78e099ba637a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779331, "uuid": "9306fa2a-757c-4a96-85a1-98aa6ce594e8", "comment": "Malware payload", "value": "a3cee29d5f03b31d2ccbfc6ff4219508bd7da7e732cd18c62f53cd6cb1d8f944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779331, "uuid": "31d71fac-3b16-4a10-b7ac-effe691af173", "comment": "Malware payload", "value": "ec87cb87d48b1d78835b01037be7eec98d364689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779331, "uuid": "afd77c72-0d4f-4dd2-814d-7461543e0c09", "comment": "Malware payload", "value": "5ec2c939289e0ab52d07716b073771b28f822312e3495a76e3e3539bf7f39bdbe67b4265ee7b449c863f2adf6a7a5de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779331, "uuid": "61d4c50c-b85a-40fb-8e06-680910237528", "value": "T1852633524F1E6174C359DAF4AACCB8B2EF941938F40811BFF0E660EA5E8B1D84711797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779331, "uuid": "5998349b-4e79-42ca-9ad2-31f06a8ad8ee", "value": "98304:dFFdOt4Q1BHjepTusYn99LJP19B10ICNtu+MKuU7wiVfy5Y7:bFk1xjIShj19s9NtuwuU7wsaK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779331, "uuid": "b4442535-49a6-4429-aac1-421dbc410d48", "value": 4798290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779331, "uuid": "549a9652-3c71-4327-8358-3a2719adcb06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779331, "uuid": "7e779773-1109-4e03-883b-383e03fc1ebf", "value": "23f6e822ddf04b403a78e099ba637a26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0053810b-815e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699795122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795122, "uuid": "df3fade1-1b3a-45e1-9bb9-169fd969b794", "comment": "Malware payload (AgentTesla)", "value": "81cff55cf05ee13525c01a80e7bc3b1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795122, "uuid": "14c0b76d-ea62-4b70-b973-799da1caac43", "comment": "Malware payload (AgentTesla)", "value": "a417da4eec41ccce59772248286ee9bfed2d781aec33db52829fac3d5beddc97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795122, "uuid": "616d5c9b-f0b9-46c2-8d0d-e6044213c4fe", "comment": "Malware payload (AgentTesla)", "value": "9782f59bc31752dd04c5db94330b10b8a381f56a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795122, "uuid": "dd285184-c969-4c68-b58b-acd653f10aab", "comment": "Malware payload (AgentTesla)", "value": "59b63b96a396403e8497a598617c5516785b082d8e5a492fae09331218b5524ac13e4c3469866c52ebff3218cbf46e9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795122, "uuid": "9887dd8f-d4df-41ff-ae47-c5dba48a7dea", "value": "T141158B3C4CAC123BC574DEAB8B848026F5E5977333558D3968D316866E16E22F9CC27E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795122, "uuid": "7ebc7079-afd1-41d4-be8a-94790557faa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795122, "uuid": "ab2719ed-5655-4e94-876c-23ddfc07316c", "value": "12288:CSGj6vmmsR1zmikXFfNlmNyl6BgP2OzMJK11JKgNHajfUiOSRt:Y3msRxykNylVlCKlKgNHFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795122, "uuid": "c2eaf38f-59f5-46b4-92ac-a7f8bb84831f", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795122, "uuid": "7e153e98-a7f9-4821-9f07-af786f66cafd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795122, "uuid": "1af82bd6-d066-4b3a-950a-6a4b849fed1a", "value": "81cff55cf05ee13525c01a80e7bc3b1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033f054f-8151-11ee-8907-42010a9c0042", "comment": "Malware payload (Babuk)", "timestamp": 1699789544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789544, "uuid": "af0be6c0-529f-4f0d-a9ba-b235562b10f8", "comment": "Malware payload (Babuk)", "value": "214d097d63c0aa20ae2a833518c583a1", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789544, "uuid": "f5a01e65-2669-453a-abce-abf1437a46ce", "comment": "Malware payload (Babuk)", "value": "a72cd6dcf20df1725db00b53e95a35cc02490a974845b2f0e45db94d85eb69ff", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789544, "uuid": "3add010a-f289-494a-b239-01916cd412c1", "comment": "Malware payload (Babuk)", "value": "80469c357a3d80da20d3d6053370ee011663c7c0", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699789544, "uuid": "43f5b42f-2d19-42cc-ab84-b4bf2e8e34d3", "comment": "Malware payload (Babuk)", "value": "1797a13bb3d4574ec26013a7c30645f37fc598ca2e0bcee5d419c4ad43d3e35365833a13f4b1dedda6955a7527016deb", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789544, "uuid": "e2849080-0c3a-4e1c-92ba-18a15b6ed433", "value": "T145263B8228DF0D9ADDC13BB8A1C3632A677CBE61CF6B4F27A60841355D532C57D2AB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789544, "uuid": "22cfd264-3b7a-47c3-8cbc-0336637ad6bf", "value": "25c710ff0d95f3d950545372a5adf52a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789544, "uuid": "00eb7aba-5e2f-498d-83f1-b95cfb95dd7e", "value": "98304:nAxfEfPkvm2ysI39biVhWo0tOUHu345hsMXWrGCTFY:nQfBisDhWo0tOUHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699789544, "uuid": "31421b48-7692-4567-8974-e35ce75af8c5", "value": 4779717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699789544, "uuid": "2e322b26-b5aa-419e-aae5-2197ce6a65e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699789544, "uuid": "8bc6200d-5d4e-4b83-b7ac-74b37396fd52", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e986a3b-8121-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699769162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769162, "uuid": "a22de650-b1f0-46e2-9739-6de4b414258d", "comment": "Malware payload (Stealc)", "value": "59acf621592e107afb57255f3d42290c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769162, "uuid": "8afb6733-de14-4830-8044-bdf5895f5b5b", "comment": "Malware payload (Stealc)", "value": "a8fcef9a9b81e5db11f0ed6444943f8540d3875cdb8b1c0862abcebcf648e5ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769162, "uuid": "6f392425-7202-476b-9834-eb1ec70d4241", "comment": "Malware payload (Stealc)", "value": "0d00dd78c8caae275a16da5a0099a8d82370ba09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769162, "uuid": "4ce3114b-9546-4345-a13c-c6e5643561b2", "comment": "Malware payload (Stealc)", "value": "87594c207e90284ef06fa066a1bc5f2694ee700cf5d185f6a0ccfbd0832c6ebbcb2044c47e80527e35fe84703ba99a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769162, "uuid": "5c3a50ed-7ab0-493d-9c13-9bbd139e999c", "value": "T110D6F1663FEB9917BAF950168281B65F89A3309BC373701706160DDD28B73689D07FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769162, "uuid": "ea7effe2-e8d6-434b-88aa-842e075603a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769162, "uuid": "5f39a5ae-cc5a-49e3-b308-28e14fb100d7", "value": "196608:B5Pub+LsCo02yq3V/TETmabNLddsEFjd9F9Zk5Ydje1I9f4qWdKzRgll4:LmbNC87Gbi5AQI9f4jKzRgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699769162, "uuid": "67cf869d-a3fa-4184-9568-98d7ebde41c1", "value": 13202432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699769162, "uuid": "df978e7d-fd0d-4089-a284-9d0c3653a8fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769162, "uuid": "b61b3ec4-b67c-4504-bbc7-4fc1ce718e58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1769d8f6-817d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699808475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808475, "uuid": "f5a1d1cf-da28-4bbe-873c-5484e67e1118", "comment": "Malware payload", "value": "8f9b77145385c9d0f7d75942790ffc4e", "object_relation": "md5", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808475, "uuid": "9d10c9fe-18fa-497e-bb20-bd7bda4eed09", "comment": "Malware payload", "value": "abfde7c29a4a703daa2b8ad2637819147de3a890fdd12da8279de51a3cc0d96d", "object_relation": "sha256", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808475, "uuid": "dc10836d-5951-4145-aa25-ea15839d69bd", "comment": "Malware payload", "value": "a2d52a998c4343aa565e703372c0bd5ea325c12c", "object_relation": "sha1", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699808475, "uuid": "5c409cfb-5dad-48ef-b759-6a7200e81c81", "comment": "Malware payload", "value": "5eba26ecd952c043c5ece4cb59f5a290576cde34ed9b6e7da3003c274f1f85d4979030096f69de6f49a74e3694224fb7", "object_relation": "sha3-384", "Tag": [ { "name": "Agonizing Serpens", "colour": "#D30BC6", "exportable": true, "hide_tag": false }, { "name": "aspx", "colour": "#BF2CE2", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808475, "uuid": "d386bb01-1034-4c58-acaa-25ef88d73ecd", "value": "T16C4439D22D956D8D0B462422EDED85D07BBD07B6B39820F2D84E859015F0C3A89FB9F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808475, "uuid": "2419aaf5-bba4-44e7-9421-e5de7c0983e0", "value": "6144:abRWIR7RBSvGHdf7zowfhy0p0ZyRbRNCQClKiRnF4cRc3noeKEt2PUjxcZYimE2j:xMurOcRc3noez2PUjiZYLkZ7uRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699808475, "uuid": "4721f571-7b55-4a2c-b73d-3d658b77a844", "value": 272635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699808475, "uuid": "0735f48a-571d-4062-880e-c769967e0f48", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699808475, "uuid": "d804eece-3c87-42c3-818a-ba62f6ce78a1", "value": "functions.aspx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5acd560-812c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699773925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "512ee5cc-c92c-4965-b2f3-6d368143a6d8", "comment": "Malware payload (LummaStealer)", "value": "831e521e13169f4622145e75b53c2ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "98b4499e-c3f5-412e-970e-40d8548e875b", "comment": "Malware payload (LummaStealer)", "value": "ac7c5843a1ed152a67e3c5dbbf856c93474b8711ffbaa6c232e9524f45187750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "b4af7856-7b15-4520-aed1-7b957ff0e43c", "comment": "Malware payload (LummaStealer)", "value": "80e56a6218d3c2f6b9fbed3e3ecd3889ef217daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "6c23e7a7-a803-44fd-a0a3-ee814e638f72", "comment": "Malware payload (LummaStealer)", "value": "c0a891c7f6a979d36031312f822f32974c9ded4979a59e5cc8aed08f63949dbb3ccaba54067ac4428d96958a64056952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773925, "uuid": "3a44f56b-50b7-4deb-92bb-c9301ddc965b", "value": "T1FC65235269FD4837ED759B3944F505830B36BE02BD3CA25B770B980B9DA3680E872376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773925, "uuid": "d8aef614-9adc-496e-85aa-0472627f85bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773925, "uuid": "22977188-aceb-43dd-9081-42ba160895a0", "value": "24576:pyUqcZoJIuyhrrVeeIsLeHGaexDMETOtKFYtMpP/A3Ar/d8XFF/Z3iAaaUIR7+MP:cUBZoJIdhVedkmG/IEy6YtaP/I2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699773925, "uuid": "db9d21a4-ea02-43a4-be75-8901e0a41f98", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699773925, "uuid": "1fc4b4e5-847e-4400-8cf7-ff098b3b9a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773925, "uuid": "3ddfd759-41b1-4e0e-974b-f133e5e64556", "value": "831e521e13169f4622145e75b53c2ac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20869a4a-813e-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699781432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699781432, "uuid": "11ff9f3e-1b36-4f2c-be02-729c2184a52f", "comment": "Malware payload (LummaStealer)", "value": "d8c87ea3e6de6099c9917efb8f2485df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699781432, "uuid": "600df338-5d11-4c15-9bac-abefe766f4d1", "comment": "Malware payload (LummaStealer)", "value": "acd61fac3ce6b535dfa80708de6a0f266d6cd204457ea84afb8195b89523a884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699781432, "uuid": "383fa08e-907e-45cd-b2ea-f4087310ac72", "comment": "Malware payload (LummaStealer)", "value": "b94ca6dc315d7d36d8fb2c45b49e7f57bca3deb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699781432, "uuid": "416b775f-8a14-4006-90bf-a7799375743c", "comment": "Malware payload (LummaStealer)", "value": "3141a342365c3dc1e45270a2fe9e2e3fb606593b9d64369fea19983ab4d4093c018b537af76f84e7d07f6a70afc9f0eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699781432, "uuid": "42e9a86a-ca6e-4b7c-b996-1c810ef2c72d", "value": "T13FB4BE25B9C1C0F1D823283241E4E3765E78B931C93699CBFBD45C78DA76690972A33E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699781432, "uuid": "2391dd35-27d3-45fa-87d2-c27130cbc399", "value": "fe19db756f24c081423487eb889c7074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699781432, "uuid": "228371aa-64b5-4d62-9491-7b0cb52392a0", "value": "6144:oVmZLFB1XHLeEvq3JOLhiBT1/ZCU1szuO2zGsCdtizgcUSZV3IuWM6vK6m8FjjCl:osZRBv85cpzuKtizgcFtWMYK6mi+OPmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699781432, "uuid": "c322676f-ec86-4372-a93d-fcd70a967402", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699781432, "uuid": "464fe07a-ede4-469a-a311-7a1e61a4ae2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699781432, "uuid": "db41d155-4925-46b2-9305-df8a5f4cf2eb", "value": "D8C87EA3E6DE6099C9917EFB8F2485DF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa7c077-8175-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699805026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805026, "uuid": "20534704-27eb-46e3-a185-9002fdd8795d", "comment": "Malware payload (zgRAT)", "value": "6274ee7c346dede5e1c350da912f7784", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805026, "uuid": "087117f5-14e7-4502-bdc7-3edaa767e3ac", "comment": "Malware payload (zgRAT)", "value": "ad7af6aca0ba3d2fe9adb3f391800420800c0f6aa00db064fc1292232a6d881e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805026, "uuid": "cbd08d4c-c15e-4412-b904-5e4bd396273d", "comment": "Malware payload (zgRAT)", "value": "eefadc4b8a8a720aa27d42b0dad8a1912c9fdb62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699805026, "uuid": "3ce84e8c-54b4-4679-9d3a-2da32a054ed7", "comment": "Malware payload (zgRAT)", "value": "7226774c5080f55e69916e76bf8252fa427e97deb674ee3557b3874971f42ed266450c6012d29546f99dd412928b5e86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805026, "uuid": "2df1c836-e87a-478e-b3a4-9537695a2b7f", "value": "T1A2A5F153A798D327D6BE0B7EB1910509A7B0C14A7247A76B2580B3F4BCC73246D8E17E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805026, "uuid": "45cfda7b-510b-49ee-8747-594cde914b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805026, "uuid": "dfa5a78d-c654-46de-9983-dba58f4e1df3", "value": "49152:cOhe+/SQh2fG22rrvNb/0Efm6kAyr7sA4WQbNyqRB7:grfqrrvNblfSAyr7b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699805026, "uuid": "95490faf-3470-45fc-abe4-a577c4b5f167", "value": 2264064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699805026, "uuid": "1bc8958b-ad0f-48ba-82ac-9fa39f861dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699805026, "uuid": "008e0fc6-316b-4f9f-8ad8-7b794145b14d", "value": "6274ee7c346dede5e1c350da912f7784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b71da80-8195-11ee-8907-42010a9c0042", "comment": "Malware payload (CobaltStrike)", "timestamp": 1699818924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818924, "uuid": "d0cac1a8-3aba-4d1d-b2a0-d2713abaadd4", "comment": "Malware payload (CobaltStrike)", "value": "1eeb21f5bc76671767fdfe7202356af0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818924, "uuid": "4a649c9e-9d19-42ab-aa8e-e8908f32a33d", "comment": "Malware payload (CobaltStrike)", "value": "afb7e8b63558574f48a385216b42264509a6fccec2e2c005cb8c0b06e44d5fc7", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818924, "uuid": "12d0bb7b-7ccb-49ad-9574-f0822be59fe7", "comment": "Malware payload (CobaltStrike)", "value": "60b8b46ac35435b82c4cb289251c2faa3005c964", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699818924, "uuid": "cdec55d4-a072-42f1-acfa-3cae948182ca", "comment": "Malware payload (CobaltStrike)", "value": "9e5ecd04bf826d96ae4578cb36388efa3045ddfdc7814caf94bdf62f860096596cbef026f5b103181454ae357ae733d9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818924, "uuid": "0aa88b70-b461-4c1e-874b-6991b2b2fac6", "value": "T12092DA3FE71368E9C106D57845FB3733DCB139B385E6A72E2724D2B42E105A46EAE610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818924, "uuid": "cbb3fd89-62e5-47e1-bda7-14b77330cd51", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818924, "uuid": "3f59fea4-3181-4379-a545-93bc740c9fb3", "value": "192:RV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2rSDHC0hWF8qa1Dojjgi:jqaCF31cix+Dc4zjsS0FF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699818924, "uuid": "5c412efe-3c8e-4683-8078-7ecfd4ccb46b", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699818924, "uuid": "527776ca-9685-47f6-a25a-eb873bdd2235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699818924, "uuid": "5b8b8ff0-fb40-4279-80b7-6f6ee9d5e247", "value": "1eeb21f5bc76671767fdfe7202356af0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35802e9-815d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699794993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794993, "uuid": "364c830e-d1f3-4f39-9971-e02375390204", "comment": "Malware payload", "value": "b3c1715274bfa2e96e5d9f5b565f73cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794993, "uuid": "3fe64c2d-5958-4c66-b04c-b83db456e98b", "comment": "Malware payload", "value": "b3f31d727fb8e0b68a98b70cdb8756d003bbaa9f74aed96d456cb28a4e1d4cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794993, "uuid": "d2636d15-bce0-4e85-83cd-b97fd193684e", "comment": "Malware payload", "value": "9078eb8ab8c68de90d14b8e6f42bcfe81ec6c0c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794993, "uuid": "4ed13f78-77dd-40dd-bcff-fc6f8cd2a689", "comment": "Malware payload", "value": "cdbbb29e818bbc3e6a855d573d52037218a07951927d2a0ac0ae98ae663232bcac777b0a3950721944e9a4ede92744a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794993, "uuid": "b5a62d19-d108-4d18-a940-8a71fe01781b", "value": "T1FFC601662FE79917BAF9501A8281B25F8993309BC373701706150DED29BB3689D07FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794993, "uuid": "99f2eaf7-a021-4eac-ae1f-e4fb4ca38188", "value": "196608:PmabNLddsEFjd9F9b5Pub+LsCo02yq3V/TERk5Ydje1I9f4qWdKzRgll4A:UGb5mbNC8d5AQI9f4jKzRglP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699794993, "uuid": "80feaaa7-65d6-4682-852f-1659b316dc24", "value": 12600234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699794993, "uuid": "265a6d4c-5ca7-4f97-9cac-bd9599f839a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794993, "uuid": "a94e5559-8eab-47a5-9bb5-3e010caf3155", "value": "b3c1715274bfa2e96e5d9f5b565f73cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d27921-8135-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699777916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777916, "uuid": "8b10f558-5b45-4a05-81ca-b3bff9f964a6", "comment": "Malware payload (Formbook)", "value": "beba97ed5d81e99211d8f7a88ade91e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777916, "uuid": "7011d285-d67c-4f3a-9e37-47f438db3062", "comment": "Malware payload (Formbook)", "value": "b46aa459568e452fd54cfc23308ec8f18affb47fa20a5813ac307ae05562a099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777916, "uuid": "d65b41f6-4352-4508-a937-35ff57b12e9c", "comment": "Malware payload (Formbook)", "value": "0e0ca4b513f1f400b1ec8f0ca8a8d6023654b9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777916, "uuid": "f8e655e9-e541-4d35-8731-efd002f4ef58", "comment": "Malware payload (Formbook)", "value": "30e5ede79b19381ff1c8cf5d197e273004cc521bc8d0163d504da79ba638213d9c96fdcd2e3bd17e9522b10f9a9f6ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777916, "uuid": "69b33ebc-f1df-48f4-a583-2a274846afd4", "value": "T147156B3C4D580227D034DFB6CB589925B1E0973B3381DFB864D336476E52A62E8EE12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777916, "uuid": "e7684ed5-8dbd-4cd3-b87d-6b92ee47a891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777916, "uuid": "720956c9-7cfc-4453-92b3-f2f4e5a54f87", "value": "12288:F0X23rJmt7c4Pmx9WKFs6coo5RTOuj4nWdrI7wUchUBlAAO6yKWXZRcglN:FcMoQ1F6PnTanWd+xyULAwyKw+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777916, "uuid": "82b82346-d3cf-48e0-859e-6e379d4cb15c", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777916, "uuid": "71481329-628b-487b-a666-af2a9df5137a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777916, "uuid": "08e7f004-1e2a-46f0-9319-40a55bf94388", "value": "Confirm!!!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb1edf9-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795442, "uuid": "c19edbec-c945-487d-8dfe-6213409e7f1c", "comment": "Malware payload", "value": "2f60eab19db43c6a3a0fc98ca784a6a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795442, "uuid": "19e05400-12b7-4f1c-899f-384bc10ceac0", "comment": "Malware payload", "value": "b4bf3e5d5e85ff314abf8acc1f3150bed6e9d9da7814a1166a9ecfd858e8fd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795442, "uuid": "5b99573e-0f9f-435f-b8c6-93d3ee29e9ab", "comment": "Malware payload", "value": "dd08f36dd5e5acb3ec1ee8dbfa3d5d045d53c176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795442, "uuid": "9b89ded6-699b-4d0d-8ed6-ec597be9e298", "comment": "Malware payload", "value": "12d89f43960cf33b6ff624c833f9c0ba879a8a8019992f6ccd3dc1592595a8d7c692cedd1e303eace6017a5929edf240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795442, "uuid": "a78f192e-a6c1-43ae-978c-dc1d3a44445b", "value": "T169B239866B94052BE4E80130E672412B5E37F2B3779013E7E7906D7A0AD82C4CD79BDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795442, "uuid": "8e7888fc-c123-40ea-b6f4-d64500c903ad", "value": "43fb8184229f053b2b9a573a33981d5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795442, "uuid": "37bb0f9b-8378-4748-b4cc-2e9a105e68fd", "value": "384:4FpfaO/YWKc/C4Bjkg6PjPYfMdXUguggL2R6lSjLZGwqeZ255gIYK5wv:4XfaOQWKQC4pkvPjPYUR8lSjgXFgowv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795442, "uuid": "a86bbde4-7b79-4dd9-af2b-dab72e28cac0", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795442, "uuid": "1f6a8cb0-f1e8-42fd-a89d-81840640b09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795442, "uuid": "591f2369-5183-4217-8394-29085d843f5d", "value": "SecuriteInfo.com.Adware.Downware.13308.9871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1ed8df-8136-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699777964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777964, "uuid": "7200e200-adeb-40f8-aad9-d7ad9008db2f", "comment": "Malware payload (Formbook)", "value": "3a6c0fa45d2d5bb19b7ed077d5e39ca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777964, "uuid": "afd979f5-10ad-48ef-93f2-beaef392e31e", "comment": "Malware payload (Formbook)", "value": "b7b13f7292e1c908ad3d37dcc096ae01582efa6f1d91893a78bd0f84b283b148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777964, "uuid": "01d3ed9a-f118-4c50-a9e2-5474c02c6356", "comment": "Malware payload (Formbook)", "value": "cbb92366da4cd5ac8e20c12468c31272d03ed980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777964, "uuid": "9dc5a869-df31-4ba0-b864-4f17c3012563", "comment": "Malware payload (Formbook)", "value": "c18546aeb96911178f0619c4496b95c9357a802afc446ac9a2f6146005c010121721bbc948ec97e2d9a028a76650cf86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777964, "uuid": "53cc1f7a-e2ce-4ed5-8897-bfac51045012", "value": "T1BAD4CF4D572043A7F0082B75C66D7F1902201D7C75D2EBD8BAA5776BEEE1BA6243302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777964, "uuid": "1d9e14f0-17d4-4fcc-a8c0-6f1e48ef66f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777964, "uuid": "7eed6330-601e-4b1a-8094-68817e7e223b", "value": "12288:MOZ0Z/cgebk4TAUZEUGlx7hxZZfkpmS2kMm5WYZSV5fVsbR:j0ZFebklUlAKlEVtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777964, "uuid": "68ebf7ee-59fc-447e-8bb1-4d2ca6eab132", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777964, "uuid": "627c27ef-d63e-44a9-b9e0-8b5fc89b892a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777964, "uuid": "48ecbdf7-1f4d-45a1-b805-4eb5627dcac9", "value": "Confirmal Recepto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a904af-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795420, "uuid": "d6e58856-03f7-4b32-a052-619bb5613577", "comment": "Malware payload", "value": "dc8c2c5d397e7e966ba359f5c5618766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795420, "uuid": "d2cf6acc-2b2b-4c0c-b76f-e2dbf75ec288", "comment": "Malware payload", "value": "b89f5446656a69ecc7fb12d7d8f1ff6b5d0679b43d810dfdaad00e807783a471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795420, "uuid": "063c92d4-a82f-4e00-a7df-37559c43eda4", "comment": "Malware payload", "value": "2d5cf2942e9d5bcd5dd5e14189ce6124aa7acedd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795420, "uuid": "1241d0d5-f7a6-4778-a86f-213c8057e4b9", "comment": "Malware payload", "value": "b77f09345199540296f7e800d5989d085b5f3928028607ead4678766a605f353ce7b618353a4be1119d0e26c5bf918c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795420, "uuid": "5eb6919a-9c9a-4979-855a-dff2d2fbe535", "value": "T1ED457E53F6D104D6F6061171187703397BB86A830AA1FFE31256DEA99EB23B5AD33270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795420, "uuid": "c548dcab-975a-4b3f-8dc0-1e0b988940ea", "value": "6144:YQDVsWNAxnblJZG0v2XnKHGMc7G1lGoVC/QC//Uc8h8+tcakU0/za8fmkCatA6K8:YQ5sWqbzZxm9Q1lGoIiZltnk1e8f/de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795420, "uuid": "d4cb6d6f-b97e-4b17-9bac-42caa34c90f6", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795420, "uuid": "6966f76e-256f-407a-ab77-f6dcebaa488c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795420, "uuid": "bccd3de7-2583-4bc9-8e2b-c8d911788fa8", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15EXSUN.3657.29370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56d65be-815d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795077, "uuid": "dff78351-2d7d-4245-b30e-2296bc368457", "comment": "Malware payload", "value": "58696257ed6ba1e12890fe0511715384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795077, "uuid": "e4942d89-94cd-4438-ae30-1f7ea73bb248", "comment": "Malware payload", "value": "ba5c2fdd986bceda30daf8e5f32a9d01532882d51693739169620f371dbde0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795077, "uuid": "40051f88-0b2a-4de3-834d-2706d4592247", "comment": "Malware payload", "value": "fc0e9918bb8f07864f57305aab03827ccdca2bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795077, "uuid": "d2db70cb-71d6-4cbd-a8a9-7b266a242f66", "comment": "Malware payload", "value": "5e84121eff116e9c526f4b12b6b97cff43ec9fe386cfc1e99ddaf5766a58d5ad3cf7bfb38f7d686198aa1e5439293e01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795077, "uuid": "a9856d34-b373-4baf-a582-3d353efd8570", "value": "T156F38C1292A46239F5F64EB4492CD3905733B496293EEE7CCD8C73C06E35B8696D072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795077, "uuid": "8906cd7a-06ee-4ad5-a3b7-633117d91265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795077, "uuid": "8021384d-c2a6-45b7-9759-defe2880173b", "value": "3072:w/nOJ2EyhSM3WfhopOFAxX1LFbvm87enbCbjVAJDHTneGHFzkGBm0hUg:sOPUSMoh9FAxFxT7enbCH2lYGA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795077, "uuid": "4a457f1e-0d71-41f5-88f2-2d77ba85f5a6", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795077, "uuid": "c2db0ff7-6755-4499-8bf4-8c1d58bbca31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795077, "uuid": "9634233c-d3e4-4757-a667-9e82a7ed516f", "value": "58696257ed6ba1e12890fe0511715384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f473ab7a-815d-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699795102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795102, "uuid": "104a93ef-0f0c-4653-aba6-11c25f04c54d", "comment": "Malware payload (LummaStealer)", "value": "ac306b384e51e4e70c374d6cfaf43bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795102, "uuid": "7e129620-de8f-4ac8-b773-124982f2af09", "comment": "Malware payload (LummaStealer)", "value": "bb32ea7d56902a74dc94787ab68593ef8eef937157e9cdd50eac8fcf2f36dac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795102, "uuid": "a0af0a11-5600-4cea-801a-4969e233d831", "comment": "Malware payload (LummaStealer)", "value": "e39453aeb15b662ff2e946b7fe72dd0e69a7a73a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795102, "uuid": "b1178bad-8b1e-4e1d-876d-0052670b7428", "comment": "Malware payload (LummaStealer)", "value": "27f6bf6e941b89e2cb111051dc051b7a343491a0fb9f4edbf9388442c89d857079f7ac7fb89afd38e90d3840658a490f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795102, "uuid": "3a1e4fb2-638b-44dd-b9ea-988773fa6b5f", "value": "T11C552397AAFD00B3F5B517B164FF02431B3ABDA11D7C472AB394191B8CA0E946874B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795102, "uuid": "2f3dd764-5974-44e9-93ae-c04720e35451", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795102, "uuid": "7d9f8b8d-e456-4c2b-8f2b-2bc2f4d6d149", "value": "24576:Dye30QZcF5h3/M0QZ3eae9IshCMGGCdD8bDdN+TKf0EhxTYnOKjVgQ9FDfEUpeRb:We3gTrQ9neu4JGbaz3YO099FDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795102, "uuid": "1053bb2b-9428-429f-86ba-df1a27270401", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795102, "uuid": "c6205a50-c496-41cb-9789-ef49ec1973ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795102, "uuid": "96071e58-872f-4dcd-b563-ff9171e99d49", "value": "ac306b384e51e4e70c374d6cfaf43bb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8603f99-8134-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699777500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777500, "uuid": "95c7392a-20bd-4429-af25-5b27b4f3117e", "comment": "Malware payload (Formbook)", "value": "63f2ae7b89ae6bfad8ee75885b92ab2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777500, "uuid": "7f41884b-99c7-4c79-8c8e-faad67f62659", "comment": "Malware payload (Formbook)", "value": "bb8548a744cd648172b769babfe7fb42aec25bc35e812f491af41d31c4c92d13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777500, "uuid": "6b9a4b6f-eb56-4a9e-947b-eac8860f99eb", "comment": "Malware payload (Formbook)", "value": "4761dc770d4e7259137bf74d52285bf5f46d068a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699777500, "uuid": "3a4605ef-5c24-4399-aad0-9d6abe5537a3", "comment": "Malware payload (Formbook)", "value": "01b8631fd3108bb113a4c88ac61103af9f5c37e563907b87b1054fbda7ee556bd2ecae5e4630f74c865e234193711269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777500, "uuid": "d11e871b-e51a-4490-a83e-378a0eaee0a8", "value": "T10B156B3D4D580223D170DFB6CB589925B1E08B7B3341DFB864D336476E52A62E8EE12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777500, "uuid": "ae7c3db7-d042-47da-a489-b21040e4d008", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777500, "uuid": "368d3630-4de0-4e20-9755-d65cc6f68aa7", "value": "12288:3QZPC78Xxgjmqdd3ryMQD3EtX7rPK5Juy2fA/Ft795l0umvv:3QK8Xqj3B5Xa0st55lBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699777500, "uuid": "0fe523a6-f244-436e-add3-065adccf9513", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699777500, "uuid": "ba0ec2c5-c135-4653-b2ce-a991315a3dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699777500, "uuid": "50f90610-cdbe-49c6-b818-aaf075c34eb4", "value": "SecuriteInfo.com.Trojan.Inject4.59820.16548.30960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c42110-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774274, "uuid": "c1b78854-1e50-4040-8e4d-246a109cdd29", "comment": "Malware payload (Mirai)", "value": "5e719b6d52902b8e7687c1ddfa502dbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774274, "uuid": "da0ee862-06fb-4495-a44c-c60370d8e6b7", "comment": "Malware payload (Mirai)", "value": "bee761ab881052378a0d446be76be2daa6cf8c374a4924afc7de711000af53fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774274, "uuid": "05e12de2-954d-4007-b914-f329ce55c9c0", "comment": "Malware payload (Mirai)", "value": "e50d7b6c278e708be16629153f2678157892f4d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774274, "uuid": "6ee0d72d-2ddb-4c91-8f7b-e6f7618ddf3e", "comment": "Malware payload (Mirai)", "value": "aba448448a2299fb22ab4deecea5585a61057ec856814d8df7986e9bbbb0b0ee166ef9cb98adefe3c688d023586ee03c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774274, "uuid": "1f441f7c-9bea-4960-9322-f8a7a98775eb", "value": "T1E3131B42312C0E5BC6A25AB4253F17E083FFE9A024F4B589691F9B5A4A75E3710C2FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774274, "uuid": "27f9ebc5-6f4c-4ce3-805a-38622e7f35df", "value": "768:sYUvo6gTJ1GshCgR/O34NRs5KRJ0IGwblmHEJVM8RbwXJA0Zq60S:0jgl1GuDlO+cKQIfmHVZA0g6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774274, "uuid": "a287d4ce-9a7e-43e7-989c-1c2a278fa9fb", "value": 45012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774274, "uuid": "fab70a1a-15db-4629-8d4d-cd63ff5caf01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774274, "uuid": "516cf766-15dd-43b9-8a90-9d46445078df", "value": "5e719b6d52902b8e7687c1ddfa502dbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67375f73-817e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699809039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809039, "uuid": "a8bb73ff-f679-4529-ad2e-4f41f419b5b2", "comment": "Malware payload (AgentTesla)", "value": "a07e00e18a92dd85359f28b80b1fdc51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809039, "uuid": "5b6df747-7922-43c0-b866-130aea10df4a", "comment": "Malware payload (AgentTesla)", "value": "bf4c355a1f548f965d0e0fa911a872f387356287d6b5faf51a82cd9fb8814d97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809039, "uuid": "73b25065-6d39-4e95-ad7d-9c5b5faf5e63", "comment": "Malware payload (AgentTesla)", "value": "b3a9daae8fda436952cb57494d445b0660fb301a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699809039, "uuid": "d5a5f901-8089-4b16-8bc1-eedf929b5f1d", "comment": "Malware payload (AgentTesla)", "value": "033bdecede526d99446dd7a5782a536c209faa56b9d947f738028f8b7f5d68ddf276dfd5ca8736149ad09eacca0f573d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809039, "uuid": "63cf8963-c4b5-4f64-83f8-6aab6e3c69b7", "value": "T1F5D4221162AD3F1BD1BC8BF85033692923F0556F9426FB6C9CDEB1C868297805562F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809039, "uuid": "92fd8389-00dd-4bee-b5a5-a69644cd0387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809039, "uuid": "60339c05-b646-4cf7-9e5e-bac3415ecf3c", "value": "12288:WbR34CJwaL6n1Y5Ck4gSSMqGvHoIE/w+ZA3Q3r+vHgN:Wt3VJhun1YUY4I1/wZ1vAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699809039, "uuid": "216c715e-1b48-44ec-847a-b2d55bdbd55c", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699809039, "uuid": "8b63af20-350f-4499-a906-43e075b1e72f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699809039, "uuid": "73376a5a-38de-42b4-b579-38655d2f55ba", "value": "a07e00e18a92dd85359f28b80b1fdc51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb1dda2-80fc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699753106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699753106, "uuid": "a534bfc6-0b0e-4c9e-a3f4-1401c65ac844", "comment": "Malware payload", "value": "d08dc4e8cb08cd86fcba0e6bc26f726d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699753106, "uuid": "efb4ae7c-791c-41b4-96e6-a6f97fda4d5f", "comment": "Malware payload", "value": "bf4f3cff1af3069991edc7b2071f3a0e9d8309049e017a6747f7b2ca45ba3eb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699753106, "uuid": "cf7ee18c-3e45-46b2-a4df-5b01fada13b8", "comment": "Malware payload", "value": "f63318e37b6fb72d93377ce0eb8317fdc105f41b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699753106, "uuid": "838a461c-ffe8-4652-ab10-37ff89e28d71", "comment": "Malware payload", "value": "b73473ab17b7b6b33ed3c7193e3a8c65aad97330f329e0c0cbf72e628efdc4d713e76242e89891b08015d6ade9fae215", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699753106, "uuid": "be8f2546-cfa5-4ce3-95bb-0e2939e4bae5", "value": "T14B01C9D40ACEB940C45033FA390ADA3DD15A805B7B23F545BF86C082FC12858C9BCE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699753106, "uuid": "a5667447-5640-43be-9344-731adca4aa09", "value": "12:JALZVvDzyLRjLsvYidyEUUAMIjL4xe5OV6LALTLULjZVcQZvAJLGHMfVj5Ogs:JAva9whnB2kbPLUBVceAFGHSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699753106, "uuid": "9f48e412-1e06-40b2-a643-4aa5a8c66204", "value": 817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699753106, "uuid": "fb6c5664-1c49-407b-855d-dea6f787400d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699753106, "uuid": "f3a6d4c2-cfde-4275-9374-f825ff102d43", "value": "virusgozi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8a9d82-815e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699795146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795146, "uuid": "8bb5ecec-0802-416b-b139-13f27a7cf5ab", "comment": "Malware payload (RedLineStealer)", "value": "896200690a2a6ace88febc8b4ecb59f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795146, "uuid": "43da0f2d-1b1d-45da-a83f-315f1566a04a", "comment": "Malware payload (RedLineStealer)", "value": "c05591f745cbabd44158ae3823bb58f230c0d8acb2210502d626e1724265d0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795146, "uuid": "2dd48776-51ac-48f7-a760-94e0f9174eda", "comment": "Malware payload (RedLineStealer)", "value": "d3eb645567d656612bf76cd42a510bbd5fa8196b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795146, "uuid": "8f1f39f1-9683-4ae0-ab69-b5c062c93df5", "comment": "Malware payload (RedLineStealer)", "value": "af973158eac7975cb50df5882baa9dc9de900eb9113825c7cccaf73234cc0b5fbb7bb3cb402046974f7f10eece246207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795146, "uuid": "36fcdaf1-8628-4391-b32f-f5a91ae5b232", "value": "T10F84F116E2E59432E8B517B05CF617C30A35BCE19A78436B3787AD4E4CB25D4A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795146, "uuid": "30fbc2c7-abf9-4461-a237-8d46b8dc0f47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795146, "uuid": "93946cdb-1145-4494-b98a-2836eb56a6e0", "value": "6144:K3y+bnr+Vp0yN90QEEsrTqIhsgUGsz7ceTP7qvH84+IgRq9EoDCKff5KJSP9jF2y:NMrxy90zlhlUJzXiU4+LqlewP2LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795146, "uuid": "60e6d89f-c7ba-45ab-8e24-03649a238628", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795146, "uuid": "d942f865-abb8-4bd3-9c75-634ed32207b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795146, "uuid": "22d44c52-0e45-43e7-8b91-708842c2d67e", "value": "896200690a2a6ace88febc8b4ecb59f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc51d27-8139-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699779334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779334, "uuid": "491d6ecc-a749-40bf-9087-6684780426fe", "comment": "Malware payload", "value": "249f774d138fdbd9e34ccc5593650a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779334, "uuid": "38a2506a-fa86-48cd-b4ad-5d4d12b9a0af", "comment": "Malware payload", "value": "c31a0f4b84829b6553b6ff42159e207f0f1a16da06d7aa560dbb74e4b0018ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779334, "uuid": "8ff17d00-c341-4430-a0f8-b5b692720a5c", "comment": "Malware payload", "value": "aede46e3c468ebbc68f7d09610f5c704c9457ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779334, "uuid": "58f4c16a-19c7-4328-931a-487bd5ae7aa1", "comment": "Malware payload", "value": "16e04fccc0d9f5f15540f7271e817a8864c1876fb8dd764a31cfbc801e8e1a5d53f959d691323603da800fb5cd0366ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779334, "uuid": "be84438b-7b43-4cbf-8f11-0850e1d228c0", "value": "T12826334DC7D273B5C9849CBCA84F01173741C3D91BC4A26309E64A9D3AF698FBE50AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779334, "uuid": "c98b092e-7ff8-4334-9cff-9b142ebdd048", "value": "98304:2jTTsHU+DTwl9zOHz7t1Q5RRlWY9HJ3CChZfYQm7:ITqU4TIqY5BZdwn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779334, "uuid": "59a316b3-da5f-49a8-bf3d-9ca650f91d7a", "value": 4512564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779334, "uuid": "27deb951-60af-4230-a497-49543cfcf6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779334, "uuid": "30b62d59-72e0-4f24-ae03-77c4de7f5461", "value": "249f774d138fdbd9e34ccc5593650a03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51a09c2-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795426, "uuid": "8835ba63-0a2e-4069-b9cc-7a0fa6c389d4", "comment": "Malware payload", "value": "323d0cf6f709432d7202156daa5ca244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795426, "uuid": "a08ba131-2cc4-4ed1-bcb9-9d854d1e8a2d", "comment": "Malware payload", "value": "c6f3ec922496581f04b0be42efe0f3255e4689fa858320c59363bac065de7bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795426, "uuid": "da2b83fd-d156-4b0d-bc21-9ffee8eb6ced", "comment": "Malware payload", "value": "b71b0fbf2fc08957f4c8225b6033a00351025d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795426, "uuid": "7ed0455b-1f80-4240-8557-3913d367018a", "comment": "Malware payload", "value": "64436703bcb45d00114d79dc90632ceb1838aeeee5e2f5157310b6c4aa0359bc530f29baa7bc7f01507d4d2588c37197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795426, "uuid": "d0cb7780-87bc-492f-8eec-b6f53faff159", "value": "T1DFC3A23E29FCA233D164C2F68FC58666F448E43630212D36A2C357699766D8379D227F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795426, "uuid": "419d6b28-cff0-4989-8be1-5eafdac883b3", "value": "d0bb774318611cc1bc5bdb72c022cf16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795426, "uuid": "4163d94a-ed28-4125-8f63-120e8d9cb6d2", "value": "1536:3yiap9Dlv0a/diiFN8U54u8OVlCTQ/Cw5aGrTQaNGUUGFAlv3HOM4zEbCE:3aLv0a/ciFNxFRi6PrTQNVGFAlv+MBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795426, "uuid": "cc99be69-1d56-425b-a242-bb7699ed3b27", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795426, "uuid": "b624ebdc-0dbe-4921-a5a3-44bf4c111181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795426, "uuid": "0c94b7e6-677a-472a-a783-3a26f8d05fc6", "value": "SecuriteInfo.com.Trojan.DownLoader8.49793.13590.23866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa96195-81a6-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699826474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826474, "uuid": "2d8711bc-caf8-45a0-ac06-b4a5b22cf00d", "comment": "Malware payload (Smoke Loader)", "value": "0863f1acb0e033b7741624aa61210150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826474, "uuid": "d1f3e7e9-c29b-4cc2-8c82-bd73df596f57", "comment": "Malware payload (Smoke Loader)", "value": "c8790db260cf26290bbafcd3d17d3e33e6bc3e5fa65bbc248a9e03cde96d8f8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826474, "uuid": "d162f331-1de6-427d-8975-24d1c159e38f", "comment": "Malware payload (Smoke Loader)", "value": "ac88ab6b96965764209df4ef26cd2faf1eda28bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699826474, "uuid": "c27eeea8-16bf-4faa-91ff-d81fff91d8c7", "comment": "Malware payload (Smoke Loader)", "value": "c19db4cd5864a1ae20e348df71120a0ecc0c65a22c469c80617cef3b041ec037715f2b2ceda5f63ab38ee2486416bb68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826474, "uuid": "83cdb484-d958-4bca-825e-4637ee07e9c5", "value": "T1F6D6013DE794F415EDF6FA164A153306D8A6F69F46D2B80C95EA0A462E38730F3B02D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826474, "uuid": "1f1621ce-d9eb-43d2-bbed-82ff6a0c0436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826474, "uuid": "e8579cf5-661e-430c-9d81-ead68b89ef64", "value": "196608:U/vONTsU8yqPFkC5B+ooBgPb48oms+6WcEVYO1hHhQHoOpAHVrSQrHWYMV:Hxd8xkNFmL6sVlhHuHoO6HQQrBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699826474, "uuid": "a2f67f65-586f-4642-afee-b04721e877cf", "value": 13244928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699826474, "uuid": "8039e8b5-fd96-45ad-a941-32df29a8bac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699826474, "uuid": "a140f556-9f54-4d79-b114-eea3a4aa655c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2976f80-819f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699823446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699823446, "uuid": "b0e5c91a-89f3-4990-8090-9964628d52cf", "comment": "Malware payload", "value": "4ac65625d4a6a8d8a2c7ef4b3eeab378", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699823446, "uuid": "a395404e-83b8-45d9-81c4-38cfba359d8a", "comment": "Malware payload", "value": "c9786b77ff3cdc7eaa38c930f2281bef1d872a089509d13c0b56952bfe75e51a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699823446, "uuid": "4f7be38d-1859-4b4e-9ac2-4e4f05385563", "comment": "Malware payload", "value": "94257cd48e727baec573773d8a6022740001c158", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699823446, "uuid": "378bae69-0db8-4aca-9866-ed79773c8252", "comment": "Malware payload", "value": "7de0c5e8d0f92bc280150b3e61db49cb63c9df94d447cc651c1709a2696420583ed6c287db98f450cacc39742cc0527a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699823446, "uuid": "3f57a7cf-f351-4233-8249-b90ecaf4146d", "value": "T10A65330D71CF7725C26C4DB614554452A3B3D0EB6B03FDE90E28BBBE0923AD93A4A746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699823446, "uuid": "efcf433d-ce1f-4931-b0a2-fcd042ead36b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699823446, "uuid": "11bd80cf-ab87-4734-9393-110b87050377", "value": "24576:kbwK6MU9gayTXMPi4IX2lIjKHvVL9YhauVaC1QrZDX9GOy1Ak2:xZfmagX0ZIX26jQshauVP1YhoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699823446, "uuid": "d9e1ca0c-872d-4c92-8270-7404884debd2", "value": 1454592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699823446, "uuid": "edd3aa72-0390-4671-8e21-3b3d4931ecb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699823446, "uuid": "cf4983f8-dd64-44b1-bf53-3a7b52e152a3", "value": "outrev.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ed2e28-815d-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699795100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795100, "uuid": "194bff6d-f93a-4443-b642-68b825680e3b", "comment": "Malware payload (MarsStealer)", "value": "79862d1e71e51ca677b035f3be29c062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795100, "uuid": "79ec1a2d-dc91-4863-920d-167611246b2a", "comment": "Malware payload (MarsStealer)", "value": "c9ea3ac3016093a34f864a52b854e01d655be9f1848fc6de098c79a3d560fc19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795100, "uuid": "a6e14bb9-e6ae-462a-b4b6-04c2b961eb8d", "comment": "Malware payload (MarsStealer)", "value": "15f2769a04073121821f9221a051c155f11ac8cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795100, "uuid": "2984e4bf-8a2c-4fcb-bec3-1e7233127d4b", "comment": "Malware payload (MarsStealer)", "value": "591ac04c2a5337ed0fb24b8d015bfbbe33cd9b394913519932aeaf28baab19dfe5c61a7a7350b6b1fc607b0f323e1acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795100, "uuid": "ece0fbb8-e63f-4446-b136-5e64f3e3137e", "value": "T1DC343B4383E13DE5F9268B729E1EC6EC770EF6509F5ABF6912188A2F04B1172D163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795100, "uuid": "e6c51029-2b0d-4d95-9b63-03f85ad06dbe", "value": "b9f69a119dfb935d85204ae1d9e63436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795100, "uuid": "5a35322c-3a89-460a-b0c0-eba75fd00f2a", "value": "3072:WiyROOL6CncmaKNyg+HkRaehoWAF75V1hGycABjfiSRP9qr03M:Wb0OL6o1+HkJoFFP1hGycABjfJ9ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795100, "uuid": "31c6c29b-38a4-4dcf-94e6-9ce2622be248", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795100, "uuid": "3d84121c-dbb1-466a-8e87-438500093ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795100, "uuid": "b0321250-ce77-4353-95a0-d75be38a72f0", "value": "79862d1e71e51ca677b035f3be29c062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5be9cae-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795453, "uuid": "ec971e6d-6d05-4409-a3ab-9fa229197101", "comment": "Malware payload", "value": "1349466a4823bc11a9982bbd6be032de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795453, "uuid": "1c224fc0-3950-458c-912d-199db410c436", "comment": "Malware payload", "value": "ca7beb1d3a300f65850f9db7b19d6b75718fdbd99d1588f678603143519a9a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795453, "uuid": "3275d44c-4c8b-4a89-8146-ca262a4a7ae9", "comment": "Malware payload", "value": "4476e15a7fa8922cbb9f3f8ea67014307cb5f12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795453, "uuid": "da9766d6-b194-4bcf-acab-2305ac0de734", "comment": "Malware payload", "value": "bb2a4902ff8e115fa41eba143078b0a066549e548250e9c381ab77e3696a54d4bbe337edd15c7a11e06d202fb1928222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795453, "uuid": "6264803a-37e0-44fa-857a-5c3fc953bf7a", "value": "T154C328527FD64432C51DA236089AAB66A126BB792F041BE3825C1E5F497D3C34C33EDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795453, "uuid": "0604f92d-7683-4bd1-83ab-054923d390c7", "value": "8779b776c1a864692d232a3b415d98b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795453, "uuid": "98b4b96e-a9ee-465d-9145-5483501b56d2", "value": "1536:MYDSOPzA96CHctrE8Y2oIIaYOuNXMFCvJgZP1aN/grAEgO:M7OPz2H8rE0IaYOOXEPgN/FEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795453, "uuid": "47a61717-9151-4513-bd3c-1be6f9131654", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795453, "uuid": "8d4cab8a-a343-400c-ab9f-2caea85f8006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795453, "uuid": "dfa40eed-afef-4d95-9e08-00cb9b83c25f", "value": "SecuriteInfo.com.BScope.Backdoor.Agent.20029.11058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea81721-813b-11ee-8907-42010a9c0042", "comment": "Malware payload (PrivateLoader)", "timestamp": 1699780221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780221, "uuid": "d5085f15-9e0c-4fb4-9399-5fb72a70f019", "comment": "Malware payload (PrivateLoader)", "value": "2336ddbcfa5e610159ee26e52448824f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780221, "uuid": "1c3d62d2-8136-45ec-980c-a1c722ef3c39", "comment": "Malware payload (PrivateLoader)", "value": "cc54075055057cc8c0de185f7fea71146bb0a8424d3dbd18ca1219c29ff706bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780221, "uuid": "d919a884-6d48-466e-98b4-70b431d29d2b", "comment": "Malware payload (PrivateLoader)", "value": "cd309589f6866ce718461315aedcab94506dfe0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780221, "uuid": "7a02c294-2196-4635-ac2e-dd0af24a54a2", "comment": "Malware payload (PrivateLoader)", "value": "c92b26c515864240fa9eff9771c0b96f021b5ccf5e1f9429580765e28a9ad10dc0746534f8b391e860a720f0312df413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780221, "uuid": "bb6bfe7f-d505-4606-86c1-43fe37b75827", "value": "T14BE38D9D82BB1285D4FF5AB85C2321E1C27234196A39EF48AC8470B569FCBA1C5C573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780221, "uuid": "71c165f6-abdb-4a0a-a409-f740f64ba76c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780221, "uuid": "6de8985c-8e3a-4901-b5a4-44b19dd135a1", "value": "3072:Q40WZo912dr5L6H4GHkpC6ryUob1IDa5mmXzvhGkyLFTRRRRRRRRRnMRRRRRRRRy:Q40H9cd16H4GHkJrzo/5pz5eTRRRRRRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780221, "uuid": "fd9633df-10c1-48f4-a549-c0e9a53878d5", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780221, "uuid": "831ce553-1e00-4fba-8ce5-5b1703db42e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780221, "uuid": "0c77a8c2-fe06-4124-97d7-fa1cc346f71b", "value": "2336ddbcfa5e610159ee26e52448824f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c510fa05-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795452, "uuid": "4d07bce1-17e9-4a60-bf6c-d26d6d8172c2", "comment": "Malware payload", "value": "a005f7d90516ce17d55c1f813a6a1f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795452, "uuid": "5218f8fa-2e02-4da4-94a6-ee9a40918a75", "comment": "Malware payload", "value": "cd5bc51508f01f816121b5f67fa53f2f7aa2d55b182850709bbfb82370ea9e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795452, "uuid": "8bfe2bb4-752b-4994-b8f4-1d42f9e89cb0", "comment": "Malware payload", "value": "b1b4af652d204f2e30d7712310e81cb1a9a94506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795452, "uuid": "d9ab5d47-0603-4cc2-8cc5-652c5e07064c", "comment": "Malware payload", "value": "91859efb61f503e82d53518557957c16ccc849ae960c3a94dfb6d4ac43d5c0fae8b67d243ddd887a5cf95645ef2dc117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795452, "uuid": "98bce345-7db3-4d1d-9af7-35d4c361419b", "value": "T140F46C3B7625834EC52D91338A6646F8637F4D007F50CBDA8AE5AF986494989FE31C33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795452, "uuid": "446243ab-cfda-4430-a823-e354da4e6393", "value": "12288:PJPHkZ2AIUY3yEZzxjUDhObu/WGqcBzfoUF1KV:PNkZJ9AzidO68czfF1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795452, "uuid": "40b48aa1-5d78-4033-8814-07ee9a229e44", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795452, "uuid": "dcd442bf-a657-4969-a782-15d4b991a183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795452, "uuid": "5eabbbc4-1491-4913-a634-3df68933f190", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.15811.6158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60b6fd3-812c-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699773925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "f48d4b02-10f5-46f5-84d2-72854ae845ec", "comment": "Malware payload (Mirai)", "value": "c4934cd2eb7c76db148d8ed5783c0b36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "f3a28657-d2ba-44ae-a941-ebcabc7cb806", "comment": "Malware payload (Mirai)", "value": "cd965b6361d3c0eace931c2dbbded03e98518472dc6e48bc2d9794f2d2bcf6af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "85d34f0e-9e26-47dd-89ab-bfa55def36ed", "comment": "Malware payload (Mirai)", "value": "b46af71492eb744d90e289882455c371f785cdfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773925, "uuid": "53f33ceb-cd7c-4fc3-89a2-bd5c6d5ac20c", "comment": "Malware payload (Mirai)", "value": "c4b90fa4a9f4f67fec28e510761b374fe50b8d8795614bfc0d52fa54147c87b9081f33cfda6ea4f2fe9507420bca485a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773925, "uuid": "771d0fd7-9e67-4979-aec4-608ef8a83450", "value": "T162134BC8A943EDF5EC1102B02136EB36BB77F43B212DE997C75BD523A892601D50729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773925, "uuid": "5dc3820c-e93b-4d1b-ae9e-220567e11dad", "value": "768:Wn6rgUc06KEpQhnqCgKrkIh+z6mbZ4JI3/W0H8mE3MCFQxmjXUIvucjV+f5E8fVe:Wn6rgUD6KEpQhnqhKrkIh+zpbZ4JI3/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699773925, "uuid": "03b259f0-08b2-4ec3-bc5c-c6c22d311fed", "value": 42588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699773925, "uuid": "f727527a-bd02-44a3-a067-695af4cc9411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773925, "uuid": "ab60d3fa-f185-4033-ab93-d5651d7effae", "value": "c4934cd2eb7c76db148d8ed5783c0b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1312cb-8126-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699771171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699771171, "uuid": "29bd7772-2e4c-4f46-9059-fa68b9b1bfc7", "comment": "Malware payload (Mirai)", "value": "b004bfddc700f3042aca825fa86ba4b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699771171, "uuid": "c8c66146-dc30-4f5f-b00d-bddb9142df24", "comment": "Malware payload (Mirai)", "value": "d2995417ec262a3c934eaf3f65e464cc6aa63d42a9b21a94566defd394b036c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699771171, "uuid": "f09abe24-d36c-404c-83b2-ebdf4c2e1515", "comment": "Malware payload (Mirai)", "value": "cdaf7021983cd3ee9ed75ccd18da8752be6fb2c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699771171, "uuid": "58555869-700b-4788-915c-097131fb7bdc", "comment": "Malware payload (Mirai)", "value": "5ff515e32ec6d795fcf9d07758bb4fe376b5614500286e293447480ac359fce9736efceac343c505b73123a56193f08e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699771171, "uuid": "a459e4fa-2156-4466-a0a9-ceea3989b2f9", "value": "T16F134BC8A943EDF5EC1102B02136EB36BB77F43B212DE997C75BD523A892601D50729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699771171, "uuid": "475cb86e-658f-4831-a92a-1c9d9d2ce518", "value": "768:Wn6rgUc06KEpQhnqCgKrkIh+z6mbZ4JI3/W0H8mE3MCFQxrGXUIvu8jV+f5E8fVm:Wn6rgUD6KEpQhnqhKrkIh+zpbZ4JI3/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699771171, "uuid": "5adb99e9-84a4-425d-bc67-4753a61c1bc1", "value": 42588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699771171, "uuid": "72125a4c-f1ec-4e81-8f9d-8290c4162dbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699771171, "uuid": "1b810d53-55bf-443b-b1c5-a3d79571c1ad", "value": "b004bfddc700f3042aca825fa86ba4b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4417ee-8121-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699769128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769128, "uuid": "90b9860a-1d9d-453a-95be-8e5555a3d71f", "comment": "Malware payload (njrat)", "value": "c591eee89f2e2e2e00d7dd6107b4dd84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769128, "uuid": "5289857f-c275-4ade-8736-334059b56624", "comment": "Malware payload (njrat)", "value": "d2bfa8fd4ce8a3827a93482a8df8c31ae17e9e9d2dab1cd1962451ad20b7ef43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769128, "uuid": "529ed7e9-c26f-4ede-a711-3a6b89008969", "comment": "Malware payload (njrat)", "value": "a852d81897ccdee0fb7f51adb5fc56202af9c090", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699769128, "uuid": "92a9ffa5-cca7-4038-af06-67a3ea14ce73", "comment": "Malware payload (njrat)", "value": "55fc029d61d4fdb278022a6cc58579293d165770b006794386f19d0fbad1adeb1c7a70f9825d65dda611d329c8576037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769128, "uuid": "91a9a6e6-1971-46da-a90f-8ab85459b04e", "value": "T1A693E74937E150A9E2FE8AF3A971B2404FBAF0471742934D49E168761A33AD84F44DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769128, "uuid": "b0abf9e7-8acb-4f37-8aba-e4b312d54132", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769128, "uuid": "6998d86f-c582-451d-bcf9-74d7d416d239", "value": "1536:rYTbkWWWipj69MME0n2ZXkZEkqVR1rp8v:ETnqj69MICaJqVRP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699769128, "uuid": "fc78bc9b-4d36-4137-be42-378ac7d7bd24", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699769128, "uuid": "4e441073-51a0-4f4e-beb5-75be47c671e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699769128, "uuid": "b5db10b5-74d9-4474-9ec8-f823a241f5aa", "value": "c591eee89f2e2e2e00d7dd6107b4dd84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6c8cd5-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795443, "uuid": "106848f6-b8ba-4790-b112-ece2ae89f937", "comment": "Malware payload", "value": "1b3674b2601c27634c87e51f70e56e3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795443, "uuid": "e6c0a46d-65d7-4559-b274-9f0dd4e19438", "comment": "Malware payload", "value": "d3707554760805993728fe39932f8acc6b6a20ea0d7d24e28b3eb61a0bdee903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795443, "uuid": "e764c89f-91de-419f-adc2-f53017c91e35", "comment": "Malware payload", "value": "10623a1f25e5161ac97df3828a43d06e45ac58a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795443, "uuid": "6e1365f7-7780-4aa4-98f5-d40a8806a20c", "comment": "Malware payload", "value": "3a4a940fd786e3646541c814ee10cbae0cdbe148009b957caa7eeb3a68977815ee71e28823cfb98ad24b37faa101990e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795443, "uuid": "d0cfdcf4-42f1-433b-bac0-7fdc0f71136e", "value": "T111457C0AFA428494C54F20701663133F7F7592873E35DEEF1769EE799E22EA1AE36110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795443, "uuid": "da2094e8-014a-40c3-92b8-5a5f6f11f80a", "value": "12288:VZKuKcAZKjjrTaOvCTlllIwykx4Hv+zrp5jwZ3dWWBhXMoc2LFZFVv:VPAOTamwlI7kx4Hv+zrp+W4hXM3MFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795443, "uuid": "9a4ed053-6c2a-4963-a8d7-75dea9d657ab", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795443, "uuid": "9b73e6d2-0c5a-4ebd-9330-3c81ddd27fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795443, "uuid": "435a6701-4d69-49a5-bcba-965cea596e96", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15EXSUN.2237.22705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a76cb89-813b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699780161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780161, "uuid": "e4e79c99-2ed7-4574-80da-f2a5a2403926", "comment": "Malware payload", "value": "790982b6175d2517e5ddc87abd392cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780161, "uuid": "fc9def37-faf2-4ae1-b290-9af314bc0fc6", "comment": "Malware payload", "value": "d703f795c038ce338efab06334e6ae94beb15b88832cb6d0aa3bb447309ba904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780161, "uuid": "ccb9ea2d-8374-4293-94e9-ad65db42816d", "comment": "Malware payload", "value": "8fda7ef37df6c90449cb33ccb8a3434f6a19df02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780161, "uuid": "b377dc86-110a-4844-b8bf-5c901af00654", "comment": "Malware payload", "value": "3e70ae8dfad6f9cc012978c6c39cb1c8091153b66c4233c6aa55b0ea55726e642c284595e478a9224559ee4513c997a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780161, "uuid": "a93cb524-4f4e-42f8-ac01-ca7f490308d7", "value": "T1651623A1A24818E1C0CB36714831D56BD311EDEFAAE4DC95A5E8E7BA1F721CC5B0DB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780161, "uuid": "84bedd3a-99bb-418f-a0d6-78984a64240e", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780161, "uuid": "e356772b-17ea-42fb-88fa-d266459dfcbf", "value": "98304:KdL9xWLs1Esvx3VRy2XOwnqoQyVHXoblgL74+7e:2zwM5S2X9qM3oqLU+7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780161, "uuid": "9ae94053-f24a-48f1-994e-d2ca0cbd2e24", "value": 4178766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780161, "uuid": "58cca9aa-72d4-4090-b2e7-c06a858b2863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780161, "uuid": "8f4f87f5-2681-462e-a497-71b1f35b8f55", "value": "790982b6175d2517e5ddc87abd392cbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcc3c81-814d-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699788031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788031, "uuid": "d373be7d-57ad-4d85-b80c-507611256fee", "comment": "Malware payload (njrat)", "value": "e8b57e5c21ad51fb41005974e0350124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788031, "uuid": "06db3c54-1816-4aef-8a29-e1d54488daf2", "comment": "Malware payload (njrat)", "value": "d94d9dbce42d7b6c0c5ef63e67f591d13229f3c4f6da24a9e9fb9a8d817aa598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788031, "uuid": "c4bd611f-8eba-4c98-a892-0942fb9e1340", "comment": "Malware payload (njrat)", "value": "dfb51d4f6a1de576f17da95fa927b22ab543318e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699788031, "uuid": "d8f95420-801b-4079-b471-ca706923babe", "comment": "Malware payload (njrat)", "value": "cda81837eab57fba438489a61cc672917c3706296e90c2de8f1a621b092e7fbeccfc14128010d2292f98b84372e472f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788031, "uuid": "2c830f7a-5b25-4f16-a420-48dae010d503", "value": "T11D33CF9127F99F25E7BA7376C903544003F1C611B663C356ACC684EE8D437AABA127E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788031, "uuid": "9c93ec9c-7a03-4294-a4d3-ea75402c5b6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788031, "uuid": "d81c07db-c1e5-45f8-b02e-f8b5255ad9db", "value": "1536:NZhWnPxQZTb5JumJ1o4SQPwaYb1OKJYuCDF:NZhWnsaQ5YBnYu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699788031, "uuid": "9c6d8653-8c4e-4286-a0df-6ba5597b4079", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699788031, "uuid": "39acaf15-6444-416f-9e1c-f38f79a9d0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699788031, "uuid": "c305d0c1-4ab8-41b2-88d7-cbbe5f1d42ee", "value": "E8B57E5C21AD51FB41005974E0350124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4e2259-8148-11ee-8907-42010a9c0042", "comment": "Malware payload (AxBanker)", "timestamp": 1699785802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785802, "uuid": "630e8aef-f822-4ffc-95f3-08235f9bb080", "comment": "Malware payload (AxBanker)", "value": "41d884e8656613c5e77142d03d9df849", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axbanker", "colour": "#9DB984", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785802, "uuid": "81419abe-7f80-4a21-b5cf-2ab947671ba4", "comment": "Malware payload (AxBanker)", "value": "db5cf075c37d89667e1d08080bf69e5000ee74e5c266d6376ed1923f745dc119", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axbanker", "colour": "#9DB984", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785802, "uuid": "70134321-805e-46f5-b5fd-e1b97279d58c", "comment": "Malware payload (AxBanker)", "value": "5841b601fc0f23bbf0f1bc8e30e0b27c578b47b4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axbanker", "colour": "#9DB984", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785802, "uuid": "14e6397c-0e12-401c-9612-e0e5a60ec11a", "comment": "Malware payload (AxBanker)", "value": "53076441f16f45ee6dd85d3b835fe336f1a1f1d278409abbfc365436514a6e57d2b9c68647b6f354e24571d31ade974a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axbanker", "colour": "#9DB984", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785802, "uuid": "da000c5b-6383-418e-aa6d-51ed7a137095", "value": "T12B6601D7F798A92FC437907285AE12B5514B4C028E83AF476D58370C68BB9D46F8AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785802, "uuid": "ab8d00da-8390-44e9-97c6-afd5b4eed0fd", "value": "98304:IoNr9ekgLCrOERPMoailxD49QEIM+2mPsPX1xMiUfoopULOXfmMUKx09wgpioryP:IoewRPNHcQE4sP7SoopnSoorG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699785802, "uuid": "83beb8e7-03bc-4db8-84dd-fe5f164a84a3", "value": 6524646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699785802, "uuid": "a14dc50d-6d00-4f84-b0ed-9c187a21ee59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785802, "uuid": "9bf5d127-4071-480e-a253-4f29df75d601", "value": "41d884e8656613c5e77142d03d9df849.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8deb52d9-815d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699794930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794930, "uuid": "ce07047c-8663-4612-9a9b-365cb0bc6801", "comment": "Malware payload", "value": "47fe3ae792d61cdb11eae6e53d0afe09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794930, "uuid": "24ee510e-3566-4a4c-bb9e-290708f35885", "comment": "Malware payload", "value": "dd64a4d551760457e3cc0e8403a5774357c89d6f8b52693993eff24d461d478e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794930, "uuid": "15ed4675-2ad2-42a4-91f6-ac7ce9ee1efc", "comment": "Malware payload", "value": "a725ae375f139fe283bcfbd2e079e430155a11bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699794930, "uuid": "b22cc3a9-7795-4a55-9fa4-40be791c8041", "comment": "Malware payload", "value": "dce3d38a9bdbdafac5a7735886a89c135b24208a905c207e5963e59634c42c07f7e462664338ab7f3a4a3ccdfe6e2da7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794930, "uuid": "4e52d09e-383d-49c7-9949-830759b29c3b", "value": "T18E35338641D27A6BD3FD8E3ABB99853EB7490CE6C8428CF563144C96D2FDFC101489E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794930, "uuid": "6e049795-03b0-4ad2-9418-4dbae4c57922", "value": "1826bb01ffcd0ff05a4c804282e96f83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794930, "uuid": "64f65b78-a518-4102-ab46-6bea3f5b29db", "value": "24576:jyFrm1bQq/e4P5mzI46ZK8ONUN7hvfP6iULh7RlHBTG4c0Lf9Qzt4P:eFrmKyoN6iisPlHBBf9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699794930, "uuid": "128a6d79-252a-44bb-8ff1-0a524fb38e1a", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699794930, "uuid": "5da07927-9094-4e4c-a143-b1fdb2e09d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699794930, "uuid": "8c35e781-a3e5-4358-a9af-e648945b3796", "value": "47fe3ae792d61cdb11eae6e53d0afe09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4441190f-8139-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699779345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779345, "uuid": "f9d38950-8064-433f-8f3d-e190ca5bf24d", "comment": "Malware payload", "value": "bd5c943fa2a0ab17e09657b9f90f78bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779345, "uuid": "d4414660-f201-47fd-9451-759be5449f6b", "comment": "Malware payload", "value": "e0aea9e2b59b0a18cf21f8e834eadef94b9290423b7520f97cd92d6048ab2300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779345, "uuid": "c2351fab-889c-4aa3-991f-007dabeddb81", "comment": "Malware payload", "value": "b0dae69cf069c26ede6064df1d3780c44b7e7b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699779345, "uuid": "b98e7c74-3858-46c2-8d86-92649b09d3b6", "comment": "Malware payload", "value": "c7eba0ff2fba6a12d3ce625d33172b6d6fa8be972229577f42083a9fc8f11c5182f4b2a2ec61ba8f9f7064fb85759922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779345, "uuid": "8aae0fc3-fed0-4114-8723-e8620c5233d8", "value": "T1D6A63303762701DAE8E98C72591B7CB176F613D10315ACBEA8F68CE51D959ACFB02C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779345, "uuid": "ad9bc87a-7508-4377-84f3-8726e8858813", "value": "196608:7Z2203czkB24qBHfvLVlahXDZ3clsiCnlE5dPmCYeuAG6B9ovrVveuytBcBw:SjBWhfvShXDZ3PYRm5euP6B9KrVmqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699779345, "uuid": "1f61e438-dfce-48ff-b8e5-ec44d9664d12", "value": 9772941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699779345, "uuid": "f3063615-c267-4923-9750-c73f2254bfd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699779345, "uuid": "cb8f7a47-410d-49cb-ab65-ff4bb9dbdd10", "value": "bd5c943fa2a0ab17e09657b9f90f78bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4484508-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795451, "uuid": "82112375-b3b1-4034-a510-0543240c3857", "comment": "Malware payload", "value": "aefd1f003dac01f8b30983f827b87ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795451, "uuid": "07ba3b41-5eab-4c93-a774-561ba3d3650e", "comment": "Malware payload", "value": "e3de56743984f479773ffddf63214d7e202421ee8f23f05e9bb76aad2c77e20a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795451, "uuid": "79a595b3-8f91-476f-af0a-1fea718d451d", "comment": "Malware payload", "value": "2726e838a098d74fd1d78b6fb9b2a0ef7a40c85a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795451, "uuid": "e14d6f47-dffd-4d7b-824a-299405ee32e4", "comment": "Malware payload", "value": "b44de134abd41af12d6d7c2b5f6c3e9059614f392d97335df87c50b52d5306986697bb0643a829d3671dbef4d6561201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795451, "uuid": "1370aa33-f748-482c-95f1-d94a8c845b0a", "value": "T19A44D62263E47B56F6668BB05D760650883BBC314970D90FA6C61E4D3AB3E43EB35327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795451, "uuid": "9abe70c8-9e51-476d-8c9e-f7fac414b3e8", "value": "5946fd983925428aae7317d5d4322237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795451, "uuid": "d6bf6350-f6e0-43cc-a7e7-2a3aed2a480f", "value": "6144:LsAMamfDqaBv6xdnG6+hdbHSHqFJJe4XZN/:L41H+NG6+h537T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795451, "uuid": "ef358bb4-433e-47ab-9919-18e4f0140ce5", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795451, "uuid": "a09b3c82-c3f0-410c-a5de-79275ca75579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795451, "uuid": "1e89e4a2-a11e-4ce0-9ec7-e1fede64fffc", "value": "SecuriteInfo.com.Trojan.Tiggre.31342.14176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac60d99-8196-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699819541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819541, "uuid": "5e91ab34-6d1b-4e6a-b965-0d943b7e8124", "comment": "Malware payload (Mirai)", "value": "b0a9f8363886bc4c5db3bfb577e7735f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819541, "uuid": "660a0014-8cb8-45e8-8454-b4045189768e", "comment": "Malware payload (Mirai)", "value": "e5e3680d4da72aa4b9957c897fabde6ed88ab8c18d0e6deee98ca670210d3474", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819541, "uuid": "9d84eeb8-0b63-4cfe-b3ea-7a60e4dee51b", "comment": "Malware payload (Mirai)", "value": "d4c7e3833393af4865c6c7e381d48b8f5a520c55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699819541, "uuid": "805e3b96-37ea-4e98-a047-82eb3278a515", "comment": "Malware payload (Mirai)", "value": "38757d606060b0bcd3b952baab0de7ddf5372fbfff607e0fff2373046191b8338701a3a3920df580ef6dda079c4933b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819541, "uuid": "966c3945-17bf-436a-a5c8-e66f7db46d6a", "value": "T1A6D33A06B30C0B47D2632EB43E3F67D193EF9A8121E8FA40655FAB8A9171D325545ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819541, "uuid": "d511b989-e2e9-4c29-b70e-68fb11f94f0c", "value": "1536:5Q8MuyoqJ9DfWVtKS9DxpbvTHNhMBZT/gKenMHgvAuIEFY0FwhfqM6DkaRDyl1d9:6CU4/9DxV7HUTgXnMFuEaRDqwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699819541, "uuid": "62dfbbef-a974-426d-b19a-e275ba7804fe", "value": 140636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699819541, "uuid": "19ceb9d4-30cc-4712-bed8-ebd91367bf7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699819541, "uuid": "379e4a79-242b-494c-b088-29c5c95a7995", "value": "b0a9f8363886bc4c5db3bfb577e7735f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc6b89b-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795437, "uuid": "519667fd-f3c6-4493-8ce6-17e3d6d34ed6", "comment": "Malware payload", "value": "ff16604005899445fcf63ed3015cca4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795437, "uuid": "e23b651b-f832-47ad-a472-94887ed86451", "comment": "Malware payload", "value": "e638aa804875b3c94602ae32a44f0ccd679c2d533410d09451ae85c636c01dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795437, "uuid": "95e22698-d107-46f1-9d2c-53daa12d92df", "comment": "Malware payload", "value": "468ac8c64e051932c567439211879602efc4a5f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795437, "uuid": "9f8c5a88-7f63-495d-bb22-df11d501e1be", "comment": "Malware payload", "value": "4cf086fbaf015dd62adc15e327efa080110b1f7bc2fe773cb4371426dcf23928c8e4c3d90efb7a4a032cd0de92115a13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795437, "uuid": "f9419b4f-73b0-40cc-82c3-69754bcb1c9d", "value": "T108F2BE1739A34D7FFEB7A0F05B8D35DDAD8EE044022468FA15833B593756E8134E2A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795437, "uuid": "3a5b8b2c-77d8-4cd1-9605-de8462daeb55", "value": "192:A7bVAHTsHQxQ408w0b6qcOlT+OZnEFvgnyUnRUdLC6UrH6gGTNU6BSR71cwDC1:hH7ttKqcOlTXlEFo9RILCvUfBDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795437, "uuid": "e7b5aeac-632c-4a1e-9d15-5b90c9c0d68c", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795437, "uuid": "5ea2fc9a-aa12-4a73-ae0b-080c0c1f0b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795437, "uuid": "37a3fb52-4279-4633-a6f6-434c9281a1fa", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.20500.18648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce20740-815e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699795143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795143, "uuid": "04af902b-dbdc-4816-b551-955728e53208", "comment": "Malware payload (Smoke Loader)", "value": "c18de0aeb52fbba1c310106177aa4fd3", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795143, "uuid": "271ffc0d-0750-4510-8ca8-b43333f3c5c4", "comment": "Malware payload (Smoke Loader)", "value": "e669dd52d97cc96b42efb1661dfeb898b6277a0484d25b8e86b492acf41c8f7d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795143, "uuid": "aa6de2bc-94ad-4f5a-a0ca-123a0178a733", "comment": "Malware payload (Smoke Loader)", "value": "039dd8eb01565b7e68772be5b2391fbc89a9f13a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795143, "uuid": "b4e8bc65-9b1c-47fa-a8b9-c7b5b302d039", "comment": "Malware payload (Smoke Loader)", "value": "af00d0aae43daa6360f2d5c2a6b42f02c1babb50f24cc93ba512fb0ec340126651f3dabd0f5dc2e89a8a4f9023db106b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795143, "uuid": "860fabdb-7d9c-4bc0-8c19-d81407a92621", "value": "T164244B4392E13DD5F9268B329F5ED6EC770DF6508F59BF6922188A2F04B01B2D263316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795143, "uuid": "17ebb37f-d60f-4558-aa6f-ecf4227909be", "value": "b9f69a119dfb935d85204ae1d9e63436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795143, "uuid": "40099a13-d3a6-4b06-92ed-fa247b5a147f", "value": "3072:ziyyzvLrAlqRSVMJieaquP1+L2a7LapnN1SRP3Lyo03cS:zbyzvLrAlq9ieeYiay9Ni3+4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795143, "uuid": "27bee699-47bc-469b-a1ec-ad716f157ac4", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795143, "uuid": "ad559892-8157-47e4-99c6-05e42f12cc63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795143, "uuid": "20b81b46-517e-48c0-840a-517c1ac424ad", "value": "c18de0aeb52fbba1c310106177aa4fd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819618fe-8147-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699785461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785461, "uuid": "0f051b9d-dbe6-433c-b800-bde515338018", "comment": "Malware payload (MarsStealer)", "value": "90dd1720cb5f0a539358d8895d3fd27a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785461, "uuid": "03ff076c-2108-4c61-8c68-fbcbc53b0058", "comment": "Malware payload (MarsStealer)", "value": "e69a88b0f9ec61f4acf22f9a3d96f60eb3a04db58a74eb4315700ac465de9e01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785461, "uuid": "4791392f-7e92-4bd5-900c-93083404e770", "comment": "Malware payload (MarsStealer)", "value": "c1375d0b31adc36f91feb45df705c7e662c95d7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785461, "uuid": "d28a11bf-afdb-4af0-8f22-9db605db2e12", "comment": "Malware payload (MarsStealer)", "value": "d717b5f1717ba24103ce2d57037fe2dac8237c7d87c2626b2c1564e0773aac9b02f5103426ec4c02937945af06ba0706", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785461, "uuid": "7d2d89d9-b689-4b4a-a290-2820e70f1ef9", "value": "T14FE33900E613843DE5B201FE669D3FA9D89879220305C0C7E3E16F9D66E11E6ED74A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785461, "uuid": "6b8c4962-0554-4e83-bd2e-fcf48cdb8c39", "value": "bfbdb436476f8fcaaef94d931ea729c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785461, "uuid": "d09c08fd-3cf1-48f6-9d6c-df2cf8ab996e", "value": "3072:6F6GZCIbIXZhMUXjB4xowmDKQ9x4Ua9JKFuo:6F8RZ+Ro5HHSKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699785461, "uuid": "fe9220a6-bfe0-468a-95a0-0ae2ad68c21d", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699785461, "uuid": "ae3cc34e-66f2-4414-8553-d1d4229fd991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785461, "uuid": "46251a96-b90f-4f9f-b9bc-edfc4f5292bc", "value": "90dd1720cb5f0a539358d8895d3fd27a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9081bdd-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795459, "uuid": "77b3f4f3-67d0-43cd-824e-c942c977920f", "comment": "Malware payload", "value": "756e0124484ae8c6e53de982c86fbbd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795459, "uuid": "7a139af7-427b-40cd-8b3b-3f69280250fc", "comment": "Malware payload", "value": "e71ee053a990d368b28749a32173c712d694e10f36935b870650f0fdfd88a49f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795459, "uuid": "72cc24de-a18a-4a6d-be86-d6914c6441c2", "comment": "Malware payload", "value": "0e956643e7c251081298cdb2105fb6d6796d9457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795459, "uuid": "7f315955-4a09-43d8-83d0-0bfa9309e33b", "comment": "Malware payload", "value": "3e76e75d3fbaf8145249a3f46956c2e14f7b9ee1650399b996cb312a03215003da4e66e8fce295a35652ae5551436ade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795459, "uuid": "c38a5c4c-c032-4cb7-a33d-db2f6ef977ed", "value": "T1C755BEA2B6D20491D341393108E7A33A6E727B450F29CBE39258EE1EFD73291593B3D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795459, "uuid": "fbdd8445-7a1a-4aff-8e9a-ebdaf97e7561", "value": "24576:u0+HH6+0NP9uTmRTJVoD0s2SNwZmHvG3bg:u0+PLmPkn2SdHvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795459, "uuid": "2d78d61d-e1f8-4347-9b2d-b1ce5c04cb9e", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795459, "uuid": "2f26c0e9-96c5-41f9-9e49-ff5e5180ee0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795459, "uuid": "a39c1c0c-d262-4a76-9aef-84305eb7ef3b", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.13892.7534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3616ee-8178-11ee-8907-42010a9c0042", "comment": "Malware payload (StrelaStealer)", "timestamp": 1699806338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699806338, "uuid": "246dff3e-86f0-40cd-b541-d9dbcdc72ec7", "comment": "Malware payload (StrelaStealer)", "value": "426e5432490b51f9ce47ef73461da902", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699806338, "uuid": "8582f43f-71a3-4754-b0f8-e40ff218aba6", "comment": "Malware payload (StrelaStealer)", "value": "e896bbf849048589fe0b467dfef4e2803e46bcec51f6b91a5c402452653e581c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699806338, "uuid": "c5c42f19-c383-4123-a2cd-f4cd8b73c55c", "comment": "Malware payload (StrelaStealer)", "value": "c00b81f75376fe06534e3edd970c1da12a5f53b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699806338, "uuid": "95e9569c-0787-4f43-b7d7-97313d5b3550", "comment": "Malware payload (StrelaStealer)", "value": "46e0fde0892e0d2b03afc0a9b9242897d3ca01dcbebfbaff6c5b2c0cc3e26520b62c5f4197847e0ff12b9f0fa5369a0c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699806338, "uuid": "3aa864ed-b3e6-4932-bae5-1cb82aedd09e", "value": "T147554CF0B3617FE60F78195CB38F40B22C29B857F57D5E86235A2A4DD588248D9EAC70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699806338, "uuid": "ece94d83-d6eb-4d6a-96fe-fb56e2e724a4", "value": "12288:OpgX7mD2xSfbnWhPXcFaXySa0OUKS17e8tSBBHGIceTUOI4xTIUG8JzsIO9fuHVn:Oy/9wOfv5Zcy4GdAPx5RUbUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699806338, "uuid": "9c5695ae-f17b-417c-9b33-272943d98d92", "value": 1385665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699806338, "uuid": "79bc8f2b-d4c0-4ba1-9cd3-a92ef2893c3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699806338, "uuid": "6cd5f2a5-f6ac-4125-a090-a03f37c2b905", "value": "316801558730488.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b689d08e-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795428, "uuid": "854945f1-6d51-4ac7-b4a0-184cef0171b6", "comment": "Malware payload", "value": "ea346eade6343dcf2b0a37e8fa7ec9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795428, "uuid": "971ad080-008e-4b36-8209-07960dfef818", "comment": "Malware payload", "value": "eb82b4b001e592deffb88726166de76f643e3d10ecc1ffbfa1ab289aa2fbe90b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795428, "uuid": "23de6511-6063-433b-9ab2-fb89ad96d7c0", "comment": "Malware payload", "value": "a599668eab63cc886014204dd38021785c2675d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795428, "uuid": "12143312-d914-45b3-8fb1-93ec0bd082a8", "comment": "Malware payload", "value": "d6aca1500c67345bea445152b04278acb4faa1c100343e352572a8d4a454bc4489076861ec4375b7265c80c397f00339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795428, "uuid": "57ab4fb4-2b83-4be5-9729-657963bae7f4", "value": "T1CE357C1732915033E6B279314B2B42AD8926FE161D78386A6BF59C487D35643FA32FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795428, "uuid": "ce29c6cc-2f2b-420d-a3c3-b992094170fa", "value": "24576:ofdWTzFpXnVH1BS958zRP/e4tIUkeNM5vbuJDGfSw:mdyFp3DBG58p6jBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795428, "uuid": "6fa9a307-24c5-4aad-9a53-418902d52c2e", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795428, "uuid": "30804da5-e39b-4023-b1d3-2417f9114c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795428, "uuid": "98a6a82e-2b6f-46a2-a096-c0464c96d454", "value": "SecuriteInfo.com.BackDoor.Pigeon1.7957.12564.1651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a88c16a-8106-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1699757424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699757424, "uuid": "b7df0229-506d-4088-a5df-a2c410a5a148", "comment": "Malware payload (DCRat)", "value": "c1945d16a2675428b1d7140ab94559f2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699757424, "uuid": "868ec1a6-c256-4e6d-b95a-ae001f9fc491", "comment": "Malware payload (DCRat)", "value": "ed19a4518355ea8203b8d6bb6e1dcf2487add69929cf0272c8027a3186fbf777", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699757424, "uuid": "3390dbbe-d07b-4594-b0cc-933582fe7784", "comment": "Malware payload (DCRat)", "value": "65c476046bd46288d94704a3b4598f8ced8a319d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699757424, "uuid": "c3c69631-e19f-4ff7-8550-fe0412221a58", "comment": "Malware payload (DCRat)", "value": "fead355640b47fd338649dd99198d6ca7a674f759635b3c3ff51beeaa104057d564a3e268fd48b27093085cc70671222", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699757424, "uuid": "6e837ec5-222d-42c7-bbd5-90886e62068e", "value": "T14B05F6027E44CE12F0591233D2EF454887B4A8516AA6E32B7DFA377E15523A77C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699757424, "uuid": "2ea00aa8-74ec-49fe-b0c7-068811a7dc7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699757424, "uuid": "bdbb7965-d973-43f4-989d-ba3c695eb1a5", "value": "12288:D7BwjnJZua8N6y7YYm4lCwfXA6dLfTiYfW4NaDZQg8f5KXsL:Xcnvuaq7YT4pfXviYfBpVc8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699757424, "uuid": "d37ad540-57c8-433c-af3e-dfff5cc3ec60", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699757424, "uuid": "0298488e-121c-4208-9305-f9849d591588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699757424, "uuid": "d94a3987-c298-4dd4-a793-96da4ca719af", "value": "c1945d16a2675428b1d7140ab94559f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b75fb7b-813b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699780270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780270, "uuid": "ade6b04a-567a-48a9-83d9-c28edebd9dcc", "comment": "Malware payload", "value": "c2d8aeda241f1f2fc563d47fe72f5a09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780270, "uuid": "23d79736-77d5-463d-9e11-82f60228e0c8", "comment": "Malware payload", "value": "ed62ae860ca54ea089ff6fd4a602e5c6a55b606e332edad77c59c4e88a931284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780270, "uuid": "c763c093-4de6-483e-b4f6-c4aff321d847", "comment": "Malware payload", "value": "bbaec88cdf13874c2901976ff55c4d80ea755aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780270, "uuid": "2e88d137-c791-4d84-b433-057f6a70b216", "comment": "Malware payload", "value": "314c72a0d1124b92d929f375c982d54fde462c2eb03c83da01b3b89cc8391b45a83048d7d2b275c88e5c25c870559313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780270, "uuid": "4b101ffb-8a31-4ad9-9d89-60a0792062d0", "value": "T1E366334422900EE9FDB3943EE482AA45EA7578B95750DAC74FF0C6621F3B6B04E3B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780270, "uuid": "de66b771-285a-4227-b0bb-5bededa481e1", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780270, "uuid": "f1163a82-7478-4b1a-a6b6-cf781710bf9e", "value": "196608:tsdays9cA4YYR0XD50mr2puHUHNTdL2Vmd6+D+/:pTqYYqXDKmr2pu0tTdL2Vmd6mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780270, "uuid": "97eddfc7-d67d-4d61-b79c-99ed0a6e4064", "value": 6492654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780270, "uuid": "582fbb52-f74a-44b8-84a6-8f3cb7e386d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780270, "uuid": "1b59a7c5-cf1c-4776-a6c1-a8b8fad68ba3", "value": "c2d8aeda241f1f2fc563d47fe72f5a09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f775e9-819e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699822747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822747, "uuid": "77ea34d3-3669-4e08-b0f0-4b03a5ec7d26", "comment": "Malware payload", "value": "0dc067148c9b209bb354778e70d94c38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822747, "uuid": "53f3ea00-d3a9-4da2-933f-bcd9255dd12b", "comment": "Malware payload", "value": "eeef3e88290df49c7a82c2354ce6ff6aff80ca3750131f01853f5fc53bc72094", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822747, "uuid": "6d21a302-0415-43b1-a28f-8b3d8b46753a", "comment": "Malware payload", "value": "ae31696517a7bf04d86bf15361fb571e52f7ebb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699822747, "uuid": "87d0484b-6d44-4b19-a76d-67aa1f5e4931", "comment": "Malware payload", "value": "5edf3c71aa938a82fa4653b285ef8eccee53673117d02b16a0f817feeea0db2f7538671a2830566c4920d9d085247cbe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822747, "uuid": "031737a3-022d-447b-9805-955ca2587e84", "value": "T15183B40A7E218FADF79D823547F74E21B75823C527E1D285E1ACE9015EA024E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822747, "uuid": "cf62053e-31ec-42d2-8bcb-1a8c2d27fd47", "value": "1536:/hXo87Kjc2OGaryi47egsO/78benUHOwbZnL4r:/hXow4c2OGaV47egsO/78PHOwbZnLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699822747, "uuid": "338f2b5e-9c15-4a07-aeec-a93070adbc53", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699822747, "uuid": "3e034914-bacb-49bf-baca-d5c6ed4dd837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699822747, "uuid": "168cc8fb-ea93-44e4-a6c0-8b81e4c1b636", "value": "skid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ac0013-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795430, "uuid": "233ded7c-e668-4612-adfc-637303e68637", "comment": "Malware payload", "value": "b8d6f363c155a620558ace8e49b1a1b2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795430, "uuid": "58975a86-b1fc-4740-9b40-0ae475c02433", "comment": "Malware payload", "value": "f0423faebec6bb5d75968328792c40a2667df397d60e4b1675ba9ca00e47f393", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795430, "uuid": "dd23fd95-6dc9-4a7f-9ed7-f9d55cfc51a2", "comment": "Malware payload", "value": "d42623c8245a3d1567eaad22170316bed0934d38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795430, "uuid": "cb4d9793-0aff-4459-b80d-4a603b1bd433", "comment": "Malware payload", "value": "5efe75e314cb05fbc4cc5204c83487955767087e6542d553fc05df6595335fa754a5d9427b09f267b0f1eedc74830900", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795430, "uuid": "0c51f80a-3035-4214-bb5c-41baba78ce01", "value": "T1D6562399D1413233E1BF5DF3162B82CCD7250EE2867CB46942E672D225305BFF11BA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795430, "uuid": "d9c19464-477b-4859-bef5-f060fdebe105", "value": "6eda519ace6fb530d1f7f0dfef24e789", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795430, "uuid": "99ee62b1-92be-481d-9772-049ce7ed0a70", "value": "98304:RJVozOsYvXxr+yC3FhBCILQ7PiWQrn4+XpQi2Ctrast+3qkOtuaqG:7mzOsYvBSyyhBTLQ7PxQr4+ZQqvqqkOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795430, "uuid": "de9ac72e-d0a8-49c9-85a7-c8aba19a0f18", "value": 6282672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795430, "uuid": "f0798758-3c3e-4ddb-a474-ef106cf53115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795430, "uuid": "9621e603-2403-4c43-a725-364af1777d06", "value": "SecuriteInfo.com.TrojanDropper.Binder.26521.8276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13e8a20-818e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699816008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816008, "uuid": "d791e0d8-98f8-40dc-a7a8-1fec63e9c94d", "comment": "Malware payload (Smoke Loader)", "value": "fa951d632a6b1c8efb577fc5b43a64b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816008, "uuid": "8bb9c243-c102-422b-bf0d-87d2d9a32b22", "comment": "Malware payload (Smoke Loader)", "value": "f20a33cd4857d8363fc423ca3ce74f43d5a22f4abc3993a0c1b8b31db6771b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816008, "uuid": "bad67fb8-8b6e-4838-98d5-f7621f5d5bbc", "comment": "Malware payload (Smoke Loader)", "value": "588a6c6dcb784a87c8c3782d4e91f50793eedf9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699816008, "uuid": "69da49bf-a4ba-4e4c-8c52-5b4cc06f87d0", "comment": "Malware payload (Smoke Loader)", "value": "0ae73016f5aa83c52a4fd481af322f8cc8920f05d60c4fb7a16eaaba0a865c567d6ae06308836e699b16c81495810072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816008, "uuid": "8972970d-9636-4501-ae59-e338866438d6", "value": "T1A76523A27DE44073D5F91730CCF7069B06367CF1AE7C422A72899D970CB26AAB934365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816008, "uuid": "546cc854-2d14-4a18-9dcb-d34f6c003475", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816008, "uuid": "affa724f-8d97-4c64-963f-e82549516d01", "value": "24576:8yPOzyS5WantLziGntWerIsjXUG1mTDtlaSgeje9seOmJPQiGqakesi6z:rlZ8tLWGnUekgEGc+SzC4Hqak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699816008, "uuid": "c8c18537-4151-44ad-8b22-97c0ef05b89e", "value": 1459712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699816008, "uuid": "c10295b5-3491-4aed-a16b-e8d800e26709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699816008, "uuid": "4b4e5935-5948-46be-ab9d-52f3281aedda", "value": "fa951d632a6b1c8efb577fc5b43a64b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0863314-8118-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699765380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765380, "uuid": "7cbb3097-5a52-4df0-bc98-3f5fdedf5187", "comment": "Malware payload (LummaStealer)", "value": "0233842bfaad8911785b5ca30aa7e2b3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765380, "uuid": "3ea85f68-c655-439e-9d3d-47547b4274fc", "comment": "Malware payload (LummaStealer)", "value": "f2b14eda7119d93b5731cc063392bd8e1f6d985b5373fe33af69dddf30af4ef3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765380, "uuid": "d5719fe7-b84e-415d-9967-9cec0527b8ef", "comment": "Malware payload (LummaStealer)", "value": "d94607208a2710e2b87c7e006afab4eb91acecf7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699765380, "uuid": "1ffe6b99-1283-4889-b72f-a070f66d2020", "comment": "Malware payload (LummaStealer)", "value": "69822bac0f56c87d8783c8669346f74190e51f832e6fbcc04492311b20738d7a4f5e03607f59c14a666469ffd9844388", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765380, "uuid": "17e77226-58b5-49b3-b7ed-c5af0fbba994", "value": "T101F65A87B89111E8C1AED33089665252BB707C851B3137E73A64FEB82F32BD85E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765380, "uuid": "fb371ecb-5d35-49ec-806b-5997b340c286", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765380, "uuid": "0b59fbb6-a736-47fd-ae36-9fcc59abf15e", "value": "49152:nUk35li1hrb/TwvO90d7HjmAFd4A64nsfJ+PxMkmBZfqFwiQpEmERRzfz1iG7x4F:/i1sDmBZSeSrRRZ+BLzYhTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699765380, "uuid": "77e5d08f-1cd5-48c0-80fb-fa51c0b583e9", "value": 16390657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699765380, "uuid": "e8b1df02-9608-439f-8a3e-a3fafa9a2cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699765380, "uuid": "63db50f6-0e1a-44dc-a266-8cdd45b31793", "value": "0233842bfaad8911785b5ca30aa7e2b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395148ba-8191-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699817122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699817122, "uuid": "9f100dff-1079-49c2-8262-c9bde20b356a", "comment": "Malware payload (LummaStealer)", "value": "041223b1226d7009e411fc4d8513c199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699817122, "uuid": "358b8cde-2072-4019-b65c-17a6b0bbdca7", "comment": "Malware payload (LummaStealer)", "value": "f4925519bb00f9664484adad210ba2884c1ddaee649d76d91e01f8bb172676d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699817122, "uuid": "6544733a-2422-4027-ac50-033c71d826a7", "comment": "Malware payload (LummaStealer)", "value": "dd75eaef05534e2ce9994fe0ab86fb1d114d4336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699817122, "uuid": "425b5829-19af-4c8f-8c52-e226f70fcfbf", "comment": "Malware payload (LummaStealer)", "value": "a454df1d2ca0e5f19bfec4890589679d386593ecabdbab1a3c12c9ace87e08278e1ca3ec95f98c588010b254d31f2cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699817122, "uuid": "3253a06c-8a35-4545-b583-69537d113954", "value": "T1D2D4CFEF2910BF25DA6B843E6CCDCBC5C6985D424267C43F34EA03101A736E9BE965C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699817122, "uuid": "3d83e272-e725-4bd5-984c-5d07d766a296", "value": "393b2c69ce1638f7160243590a1d4f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699817122, "uuid": "13a5f2f9-761c-42ab-88df-a8037dfb7d61", "value": "12288:zAYwSbwWUcNmD9wfeeruPmeIR3IRY0HuNgP/mU989LV2uRGqY3:zpwSPUcYDanSNIR3IRYIGUkNe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699817122, "uuid": "d5860978-590c-4daa-adf3-fc00f9f6a8a9", "value": 606624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699817122, "uuid": "482fb947-6937-44a6-b79a-77d0fa61f4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699817122, "uuid": "1fe07dd3-d23f-4c36-aa16-a17c895dd627", "value": "041223b1226d7009e411fc4d8513c199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d28f06-812f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699775004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775004, "uuid": "34d3fff5-f1be-420d-9f7e-e0d3f23a47d0", "comment": "Malware payload (Formbook)", "value": "3d12dbca1a4952deb5ac59df6fb0ee2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775004, "uuid": "2c776830-cb7d-4a52-b2d7-953100f62744", "comment": "Malware payload (Formbook)", "value": "f50e3ae7811af883e0f89737855c3d92cd1588efb521fe5808a170c220c1c647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775004, "uuid": "bce97807-1d6b-44eb-b2ad-6fc6f1663421", "comment": "Malware payload (Formbook)", "value": "8f7ffe21b9473d3f618db091ebf45998bbe6d79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699775004, "uuid": "015bc9c2-50ee-456a-9e70-8adb5a1b663c", "comment": "Malware payload (Formbook)", "value": "3654d9053e4fae5c3362987a04083b388fbbc0058f84afd42c732b244c19b33c35220bf4144e3605b402a66353d98e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775004, "uuid": "bac2af86-f150-4a7f-acdd-5b0026634b87", "value": "T10815487A12974607D8293175C8C3D2F32AFB9D207061D1C79AD76F6FBC450BBA61228B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775004, "uuid": "69e1510c-4b7e-4ef4-a377-54b1313cccb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775004, "uuid": "b5e6e5bb-aeca-41d6-ae7e-c98a67e10a19", "value": "12288:7is/DQHfUqPrvL35WLjuKgWlN1dbLTRjc5FkfdTcfOE:7qnrlWvuKg4VH4kfBcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699775004, "uuid": "ccb6cfce-c636-4ffe-a2f1-c8b6cce04325", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699775004, "uuid": "add8a7ab-f10e-4bc6-809a-a0f5514e6ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699775004, "uuid": "3e252679-4040-4e4a-83ee-91a65d1a71d4", "value": "3d12dbca1a4952deb5ac59df6fb0ee2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c62fbac-8108-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1699758447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699758447, "uuid": "fb73dd8a-c694-497e-ba08-d116e46177f7", "comment": "Malware payload (AsyncRAT)", "value": "e820ecd0f41ba78a100a243ea7bc64af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699758447, "uuid": "c14cf0d6-e3db-4421-bee6-f13071723344", "comment": "Malware payload (AsyncRAT)", "value": "f5a0c3bda27e711eb7ed0a8b67f7d6e8e668ea5b6f1c90d0ee3270c02dc345cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699758447, "uuid": "b9ac3718-6521-4968-a01a-4889ad104eb0", "comment": "Malware payload (AsyncRAT)", "value": "b012032f04c18921ced9bb237c84dd943bc78c95", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699758447, "uuid": "f0c9ff53-b92a-4c4e-8ad6-2f90daa6003d", "comment": "Malware payload (AsyncRAT)", "value": "8aa17754ac0525a8d92874a39f2aec40fcd3492de4199f34f2e67538a394d2fec7528574b82ea88df1fe7af39f8e019a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699758447, "uuid": "1acee146-9b8a-4744-8a81-dd43493d13c9", "value": "T16A236D403798C136E6FD4BB5A9F3A2418679D6276903CA9D2CC814AE1F13FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699758447, "uuid": "83c22d80-bee4-49ef-b508-c2d3bdbbd3f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699758447, "uuid": "b03a7c5c-8648-45be-a466-e4acbed3a71e", "value": "768:596mxUTILWCaS+DipSxLyjilE8YbFgejat/CwvEgK/JXZVc6KN:596AKWpSopzbCEaFCwnkJXZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699758447, "uuid": "d13462f6-e9ca-4927-a518-a5592831f1ff", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699758447, "uuid": "6229be08-c3e5-4cad-992e-2fffd9c4eb68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699758447, "uuid": "f0fd8b9f-0f3f-4e48-a29b-ff3a7de7e61b", "value": "bRxR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b0cc75-812c-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699773792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773792, "uuid": "84de1ffa-e5d1-4e48-8d23-3d6d8af67c13", "comment": "Malware payload (zgRAT)", "value": "41c3a1be867a689a3c4c2e95e2c40023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773792, "uuid": "0fabf036-dfd3-4145-9f2f-c1255b66ff0a", "comment": "Malware payload (zgRAT)", "value": "f943cf382d0c97c65b9ab3402d85118ee810127b648eb9fcc07c3f3404b281ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773792, "uuid": "3ba9ed65-086f-4ffa-9041-e2481e80e194", "comment": "Malware payload (zgRAT)", "value": "131a528848ea080ae60bb89d0780bfadf69a1420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699773792, "uuid": "6ab0cd37-ea4c-44b7-b4e1-60ec583c9ff0", "comment": "Malware payload (zgRAT)", "value": "3a9e7923f466ceb0f6d10fbabf96ee68e7355accdc5c91b26a479e33b7df3a72ced52a285224a75887fa362506bdea3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773792, "uuid": "06c7ed7b-b004-475c-b8cd-7956febafb89", "value": "T1BB65E0A8179C875ED67E62F5F1951806F6B4C047D1F7EB8AEDD0A5F06E833908A030A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773792, "uuid": "2212dec4-3d30-4b43-b6ba-956150e91d7c", "value": "24576:GJ4y0qCUCJAqsKDON5XpGA7xGcTU1/dhF+dNdVzQz+2PU1zbM160ScVbcIAt:GJ4Uqsx9pGA7xGUkjF+dPV8+PzgjScVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699773792, "uuid": "d0a02b90-9d77-4abb-ba43-c4e3e8ab1dd3", "value": 1459712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699773792, "uuid": "742209bc-e1e1-46e8-8c8b-b3ea1ff6bb09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699773792, "uuid": "491e6b96-170d-40fd-b596-59495cf45c10", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.15898.116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a8e433-812d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699774239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774239, "uuid": "9732e41a-b494-470a-a5c3-0f640a3345f8", "comment": "Malware payload (Mirai)", "value": "352966f5832faa10a0ef9c90df7a9cab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774239, "uuid": "709a3d4c-2560-4109-b1d3-56dab04747c6", "comment": "Malware payload (Mirai)", "value": "f9e571e989dee87698fa9fd147b7f23d2c7624666d31f3353e224de78fc283ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774239, "uuid": "fc856164-7444-4817-948c-ab32f67bc3e7", "comment": "Malware payload (Mirai)", "value": "1b0a237111cbb03d07634555823e530d66c3d264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699774239, "uuid": "61166b33-aa7c-4a9b-aec7-6d51426e5bf0", "comment": "Malware payload (Mirai)", "value": "ef4a0a7146337d839e9c75efdf8af54c842fd293259a1913db4f08a226619c988bcb2d18969f43365d84e2e558464771", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774239, "uuid": "c6209203-7bdf-4acb-baa5-44b4253aec06", "value": "T13323F8417881AA13C6E4237BF96E01CE332563A8E1DF72179D222F54778A82F0D7B756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774239, "uuid": "66e6a1fa-553c-4435-8562-fff2bbd612af", "value": "768:nqB4zwfbRhgoc+FiE+Rfi6q5CqoWTelBF6EVNQ96jviqwVoVMscG37eSiI7AfylB:FzubRml40WT+BFnNQ96jviw3LeW5Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699774239, "uuid": "14c56ee5-601b-4905-8bed-17d50ed30ae9", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699774239, "uuid": "db336828-7ce4-4d3a-ac53-5204279886b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699774239, "uuid": "fb60e2fa-6d55-40d2-be03-d3b28ba737b8", "value": "352966f5832faa10a0ef9c90df7a9cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7195a9-813b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699780196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780196, "uuid": "917ff160-f632-4131-9112-eb9000ef49b2", "comment": "Malware payload", "value": "b09ca91598eb9cf782337d36e11b7a07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780196, "uuid": "264f771e-6bdc-425a-96c7-35394b2a8a55", "comment": "Malware payload", "value": "fb48f9bcce7361f9b4119666851750e1b5527f755a8aa60bb8054feb429cc73b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780196, "uuid": "46a0eb08-44d3-49ce-ba79-2ec72ea936d7", "comment": "Malware payload", "value": "9fc8fe239e37a3abdff6f0ccc65161a23e07480a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699780196, "uuid": "86fd437a-bed9-408b-8f20-53394da7f258", "comment": "Malware payload", "value": "9a8a6002623f46ba125d60ad73285fe5c762e272ee8c0075c427d870abcf31c0b8e7f5d1770b65567fdb8d33b3126d10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780196, "uuid": "f0db6015-aec0-45a0-8aeb-dd0484e557a3", "value": "T1BDF5AE2A3EF35DAAC41152B8843A1C398A7D55377D02C5B62C52389EC675B3BD00B7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780196, "uuid": "ad809f67-73f0-4776-971e-e2a20567e097", "value": "49152:sOXy4LU/okY0LJV/n3haIzDSCwohcthM3tycrUvmBe33NLWWkP2sB5EE:sOyqLkY0txXcmtJkNLf8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699780196, "uuid": "3b183be4-d8b4-4651-9ebe-da7ed395c78f", "value": 3336302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699780196, "uuid": "2e8539f8-efe5-4897-a667-aa1e03520b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699780196, "uuid": "2c914bb3-c3c5-4355-9a5b-9ba68f3e224e", "value": "b09ca91598eb9cf782337d36e11b7a07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0efd31f-815e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699795419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795419, "uuid": "34d286f9-242c-4197-9a16-3dad7582ad6d", "comment": "Malware payload", "value": "72a0b32492da29c09de94b30d4666a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795419, "uuid": "272bce56-0521-483b-8ccd-a4a29e6a1b24", "comment": "Malware payload", "value": "fb64f14ee4dc8b8c5348211ccd545c52736fe12509ca62d567f60753679d93a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795419, "uuid": "44d4210d-0975-4dfc-9f6e-660967764a1a", "comment": "Malware payload", "value": "ae852561e30e42d2357273fc5995a42726438dec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699795419, "uuid": "619917c9-644b-4a3c-960f-f1e165b916e4", "comment": "Malware payload", "value": "542e2c1428175c146e4039ad646b5b8b45ab11ca47bc0cd6b548a1da7b7bb8107b879817a10bd09608c5ae72106eeb78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795419, "uuid": "970920c5-b192-4ad3-a157-eb18529cfcd3", "value": "T1D384C86D75F8D432C04849322CF197B9D963F8214D538A4FA698BB5E2D3F3D16D220BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795419, "uuid": "a8715a3c-d2a8-41c3-888e-25f33cbf360e", "value": "edf46b6a9aceeebc55eb9cb33ed4d508", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795419, "uuid": "48d9d270-9725-45ac-9b1a-848ab2f7216d", "value": "3072:wAMbXIVuWJGt7UoOtjCL72miltvX6E0z4J:wbbY4FkRvLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699795419, "uuid": "2f88513c-bd9b-45fc-aac8-c28ab4dbc351", "value": 377778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699795419, "uuid": "11b6a339-dec2-4948-a75b-2b17d3a12dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699795419, "uuid": "5436fb0c-5b37-45e1-82ca-2f18f0fbdebc", "value": "SecuriteInfo.com.Variant.Babar.405080.12394.15843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec594c28-8146-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699785210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785210, "uuid": "217af1a1-5ee0-4e2d-8d86-4f8c82b39579", "comment": "Malware payload", "value": "a9b940ffc4f17d98e450bbbb821782ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785210, "uuid": "5a74e7a7-8058-49ec-a629-16d94c327ec8", "comment": "Malware payload", "value": "fbc7cfe8a0e5524cda68dc93c9ff0003bdfa0ca55207504e6493d4657a925d02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785210, "uuid": "ad3690cd-dad7-429b-ad9b-34858bae401f", "comment": "Malware payload", "value": "87c70b8a300f84265178c164914e04e6076d6ab1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699785210, "uuid": "5db4db3d-3c66-4f02-8180-4f4bdd30ac0b", "comment": "Malware payload", "value": "ed13bab4cb2b8e9a48de50bbeba7a4d17fa104f26445e40c3b2ead3dbacbc9a68835cabe19d4a33487626a004a5d7ff4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785210, "uuid": "787ead69-76a3-4230-9ec2-e328e74be942", "value": "T1AFB41262B395B1ABE96F103606949C6C4BFB7E00B074434B3C54FD797EF32916E2A948", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785210, "uuid": "05966c95-d515-4dec-a949-d9fc53a75142", "value": "91c9c82d5da6c673b4454be0c166d822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785210, "uuid": "5fc573bf-5690-40cb-a910-db6d808e860e", "value": "12288:4NrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVj7jL:4thTiP+ffCfB5Lf0F7Z1E7jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699785210, "uuid": "6fa4f1a4-da0f-4091-a1aa-743e24fe702c", "value": 538224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699785210, "uuid": "57fffb4e-765e-4997-95c3-ece1a51024b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699785210, "uuid": "7d9876f6-ade1-4e7c-9497-96e4032d7049", "value": "a9b940ffc4f17d98e450bbbb821782ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371cea17-810d-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699760425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760425, "uuid": "f8dd673e-1cd8-4dac-807a-9fb755afa089", "comment": "Malware payload (Stealc)", "value": "67e893cdc7d9c0794f7dda0fdc9aa323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760425, "uuid": "63a4542a-6aff-40b6-b375-23de898c0a35", "comment": "Malware payload (Stealc)", "value": "fd2023e4dfcb089a237eb10a82aacdd092b8c8337b1bdd2f2a3942a5c12cbf8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760425, "uuid": "d27dac15-cabf-4038-8e85-674e17b7d58f", "comment": "Malware payload (Stealc)", "value": "c3704d11047c944d063cd88649794a10b5f7b2a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699760425, "uuid": "e09476ea-b10f-4892-ac9d-a904ab460ab0", "comment": "Malware payload (Stealc)", "value": "f156ae318c306afe29b16365d46d310a423e744869769b786b0e5e905896d1d940d9472e357184b795bc94e34bc00b45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760425, "uuid": "629d146f-5f73-4165-a5ea-68a2ce3dd735", "value": "T1CA652352B9E8D472E4A197B598F707531B30BC909ABC93AB2248B84F4C65FD07D32736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760425, "uuid": "1ce60393-87a5-454d-a4d9-c18386f7bf68", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760425, "uuid": "8a4271fe-76f4-451b-94bb-77eca02c81a3", "value": "24576:8yc/+yBQ2I7IBeuIs/hVGdJ3D7WdJdYzMrkW7Wy7XoJ8QZWn8C9wbm:rcmy6dwet2jGH/WdJdrr/7L0J+8CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699760425, "uuid": "d524d152-e5e9-486b-9937-46662dd633b7", "value": 1456640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699760425, "uuid": "fd2b8dd2-b6bb-41b2-81dc-f040811beae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699760425, "uuid": "a4f9a40a-9878-4964-b319-a66053f420dc", "value": "67e893cdc7d9c0794f7dda0fdc9aa323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c81e530-810a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699759226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759226, "uuid": "27c8ebed-ec3a-4f7f-bba9-7b8ae20602ce", "comment": "Malware payload (RedLineStealer)", "value": "810a3fb2be61b94ed08de729c6ff0d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759226, "uuid": "113b6ea6-a4a3-4acc-a517-848442a60837", "comment": "Malware payload (RedLineStealer)", "value": "fdc7ea766a91f88ecef70d8c9d8f6225158f24626678e09e5f2e82d9778e592c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759226, "uuid": "5af7b416-490c-4859-b495-6e9e98ba4292", "comment": "Malware payload (RedLineStealer)", "value": "0039bf4082470484d3e9a3119aec09c3547b7bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699759226, "uuid": "1c012577-6df2-47ab-95e8-acd294d23462", "comment": "Malware payload (RedLineStealer)", "value": "a403c181d1ce4c1f53f26448b07c752af7b26ba0e277780c90b7d1ee11734704044e53a4953ad6fe94ca97322e4862fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759226, "uuid": "56af5e34-94be-42d1-92f8-81e243442111", "value": "T1396523426DDD5037D4FA577618F603070774BC92AC78C72F3B692A2A6C63A901AB43B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759226, "uuid": "ad664c51-ff5d-4fb4-bf90-12a986b506ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759226, "uuid": "29be8da6-70c7-48b2-8930-a22d2c2035ce", "value": "24576:6y6lY5aJfWMnggGae1IsezcGNgoDJNOSizR4cMsb/+iS9wAVfhFv6/CHpu:Bb5aguT1e2BYG/1Hi14cMsb/+i5iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699759226, "uuid": "281621a1-0337-4982-b352-7a83a27b13f6", "value": 1447936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699759226, "uuid": "a94546e0-bce6-49d2-9a2c-4fff8cac8942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699759226, "uuid": "c91efc04-95e1-43b3-ae6f-1ae00ac6329d", "value": "810a3fb2be61b94ed08de729c6ff0d0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }